Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-43332 State: PUBLISHED Published: 2024-11-01T14:17:24.351Z Last Updated: 2024-11-04T16:59:00.199Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: Jordy Meow Products: Photo Engine Problem Types: CWE-862 Description: Missing Authorization vulnerability in Jordy Meow Photo Engine allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Photo Engine: from n/a through 6.4.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/wplr-sync/wordpress-photo-engine-plugin-6-4-0-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2024-43333 State: PUBLISHED Published: 2025-02-03T14:23:50.050Z Last Updated: 2025-02-03T16:00:13.091Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: NotFound Products: Admin and Site Enhancements (ASE) Pro Problem Types: CWE-266 Description: Incorrect Privilege Assignment vulnerability in NotFound Admin and Site Enhancements (ASE) Pro allows Privilege Escalation. This issue affects Admin and Site Enhancements (ASE) Pro: from n/a through 7.6.2.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/admin-site-enhancements-pro/vulnerability/wordpress-admin-and-site-enhancements-ase-pro-pl
com/database/wordpress/plugin/admin-site-enhancements-pro/vulnerability/wordpress-admin-and-site-enhancements-ase-pro-plugin-7-6-2-1-privilege-escalation-vulnerability?_s_id=cve
CVE ID: CVE-2024-43334 State: PUBLISHED Published: 2025-07-07T09:53:15.596Z Last Updated: 2025-07-07T17:23:20.034Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: Gavias Products: Halpes Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Gavias Halpes allows Reflected XSS.This issue affects Halpes: from n/a before 1.2.5. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/theme/halpes/vulnerability/wordpress-halpes-theme-1-0-3-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2024-43335 State: PUBLISHED Published: 2024-08-18T13:39:57.389Z Last Updated: 2024-08-19T16:41:24.567Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: CyberChimps Products: Responsive Blocks – WordPress Gutenberg Blocks Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in CyberChimps Responsive Blocks – WordPress Gutenberg Blocks allows Stored XSS.This issue affects Responsive Blocks – WordPress Gutenberg Blocks: from n/a through 1.8.8. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/responsive-
ditional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/responsive-block-editor-addons/wordpress-responsive-blocks-wordpress-gutenberg-blocks-plugin-1-8-8-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2024-43336 State: PUBLISHED Published: 2024-08-26T20:34:59.127Z Last Updated: 2024-08-27T13:50:44.614Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: WP User Manager Products: WP User Manager Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in WP User Manager.This issue affects WP User Manager: from n/a through 2.9.10. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/wp-user-manager/wordpress-wp-user-manager-user-profile-builder-membership-plugin-2-9-10-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2024-43337 State: PUBLISHED Published: 2024-08-26T20:34:03.029Z Last Updated: 2024-08-27T13:57:59.223Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: Brave Products: Brave Popup Builder Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Brave Brave Popup Builder.This issue affects Brave Popup Builder: from n/a through 0.7.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/brave-popup-builder/wordpress-brave-plugin-0-7-0-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2024-43338 State: PUBLISHED Published: 2024-11-19T16:32:36.244Z Last Updated: 2024-11-19T18:46:03.922Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: Automattic, Inc. Products: Crowdsignal Dashboard – Polls, Surveys & more Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Automattic, Inc. Crowdsignal Dashboard – Polls, Surveys & more allows Cross Site Request Forgery.This issue affects Crowdsignal Dashboard – Polls, Surveys & more: from n/a through 3.1.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/polldaddy/wordpress-crowdsignal-polls-ratings
Vulnrichment: References: - https://patchstack.com/database/vulnerability/polldaddy/wordpress-crowdsignal-polls-ratings-plugin-3-1-2-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2024-43339 State: PUBLISHED Published: 2024-08-26T20:24:48.751Z Last Updated: 2024-08-27T15:02:04.993Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L) Vendors: WebinarPress Products: WebinarPress Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in WebinarPress allows Cross-Site Scripting (XSS).This issue affects WebinarPress: from n/a through 1.33.20. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/wp-webinarsystem/wordpress-wordpress-webinar-plugin-webinarpress-plugin-1-33-20-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2024-43340 State: PUBLISHED Published: 2024-08-26T20:33:03.813Z Last Updated: 2024-08-26T20:49:13.453Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: Nasirahmed Products: Advanced Form Integration Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Nasirahmed Advanced Form Integration.This issue affects Advanced Form Integration: from n/a through 1.89.4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/advanced-form-integration/wordpress-afi-the-easiest-integration-plugin-plugin-1-89-4-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2024-43341 State: PUBLISHED Published: 2024-11-01T14:17:23.729Z Last Updated: 2024-11-01T18:06:38.545Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L) Vendors: CozyThemes Products: Hello Agency Problem Types: CWE-862 Description: Missing Authorization vulnerability in CozyThemes Hello Agency allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Hello Agency: from n/a through 1.0.5. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/hello-agency/wordpress-hello-agency-theme-1-0-5-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2024-43342 State: PUBLISHED Published: 2024-08-18T13:22:30.283Z Last Updated: 2024-09-13T14:00:45.415Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: BdThemes Products: Ultimate Store Kit Elementor Addons Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in BdThemes Ultimate Store Kit Elementor Addons allows Stored XSS.This issue affects Ultimate Store Kit Elementor Addons: from n/a through 1.6.4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/ultimate-store-kit/wordpress-ultimate-store-kit-el
richment: References: - https://patchstack.com/database/vulnerability/ultimate-store-kit/wordpress-ultimate-store-kit-elementor-addons-woocommerce-builder-edd-builder-elementor-store-builder-product-grid-product-table-woocommerce-slider-plugin-1-6-4-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2024-43343 State: PUBLISHED Published: 2024-11-01T14:17:23.131Z Last Updated: 2024-11-04T16:58:31.786Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: Etoile Web Design Products: Order Tracking Problem Types: CWE-862 Description: Missing Authorization vulnerability in Etoile Web Design Order Tracking allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Order Tracking: from n/a through 3.3.12. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/order-tracking/wordpress-order-tracking-wordpress-status-tracking-plugin-plugin-3-3-13-broken-access-control-vulnerab
ty/order-tracking/wordpress-order-tracking-wordpress-status-tracking-plugin-plugin-3-3-13-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2024-43344 State: PUBLISHED Published: 2024-08-18T13:20:04.506Z Last Updated: 2024-08-19T14:42:48.931Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: Icegram Products: Icegram Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Icegram allows Stored XSS.This issue affects Icegram: from n/a through 3.1.25. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/icegram/wordpress-icegram-engage-ultimate-wp-popup-builder-lead-generation-optins-and-cta-plugin-3-1-25-cross-site-scripting-xss-vulnerability?
am-engage-ultimate-wp-popup-builder-lead-generation-optins-and-cta-plugin-3-1-25-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2024-43345 State: PUBLISHED Published: 2024-08-19T19:28:11.768Z Last Updated: 2024-08-19T19:42:36.943Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: PluginOps Products: Landing Page Builder Problem Types: CWE-22 Description: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in PluginOps Landing Page Builder allows PHP Local File Inclusion.This issue affects Landing Page Builder: from n/a through 1.5.2.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/page-builder-add/wordpress-landing-page-builder-plugin-1-5-2-0-local-file-inclusion-vulnerab
.com/database/vulnerability/page-builder-add/wordpress-landing-page-builder-plugin-1-5-2-0-local-file-inclusion-vulnerability?_s_id=cve
CVE ID: CVE-2024-43346 State: PUBLISHED Published: 2024-08-18T13:18:38.073Z Last Updated: 2024-08-19T15:26:53.776Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: Wow-Company Products: Modal Window Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wow-Company Modal Window allows Stored XSS.This issue affects Modal Window: from n/a through 6.0.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/modal-window/wordpress-modal-window-create-popup-modal-window-plugin-6-0-3-cross-site-scripting-xss-vulnerability
bility/modal-window/wordpress-modal-window-create-popup-modal-window-plugin-6-0-3-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2024-43347 State: PUBLISHED Published: 2024-08-18T13:17:01.705Z Last Updated: 2024-08-19T14:43:17.519Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: VirusTran Products: Button contact VR Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in VirusTran Button contact VR allows Stored XSS.This issue affects Button contact VR: from n/a through 4.7.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/button-contact-vr/wordpress-button-contact-vr-plugin-4-7-3-cross-site-scripting-xss-vulnerability?_s_i
ase/vulnerability/button-contact-vr/wordpress-button-contact-vr-plugin-4-7-3-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2024-43348 State: PUBLISHED Published: 2024-08-18T13:15:21.494Z Last Updated: 2024-08-19T15:27:24.886Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: Iznyn Products: Purity Of Soul Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Iznyn Purity Of Soul allows Reflected XSS.This issue affects Purity Of Soul: from n/a through 1.9. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/purity-of-soul/wordpress-purity-of-soul-theme-1-9-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2024-43349 State: PUBLISHED Published: 2024-08-18T13:12:26.311Z Last Updated: 2024-08-19T14:44:39.181Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: AREOI Products: All Bootstrap Blocks Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in AREOI All Bootstrap Blocks allows Stored XSS.This issue affects All Bootstrap Blocks: from n/a through 1.3.19. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/all-bootstrap-blocks/wordpress-all-bootstrap-blocks-plugin-1-3-19-cross-site-scripting-xss-vulnerabi
abase/vulnerability/all-bootstrap-blocks/wordpress-all-bootstrap-blocks-plugin-1-3-19-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2024-43350 State: PUBLISHED Published: 2024-08-18T21:28:50.556Z Last Updated: 2024-09-03T15:25:32.178Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Propovoice Products: Propovoice CRM Problem Types: CWE-639 Description: Authorization Bypass Through User-Controlled Key vulnerability in Propovoice Propovoice CRM.This issue affects Propovoice CRM: from n/a through 1.7.6.4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/propovoice/wordpress-propovoice-crm-plugin-1-7-6-4-insecure-direct-object-references-idor-vulnerability?_s_id=cve
CVE ID: CVE-2024-43351 State: PUBLISHED Published: 2024-08-18T13:10:04.880Z Last Updated: 2024-08-19T13:41:51.524Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: CryoutCreations Products: Bravada Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in CryoutCreations Bravada bravada allows Stored XSS.This issue affects Bravada: from n/a through 1.1.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/bravada/wordpress-bravada-theme-1-1-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2024-43352 State: PUBLISHED Published: 2024-08-18T13:09:06.675Z Last Updated: 2024-08-19T13:42:26.827Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: Organic Themes Products: GivingPress Lite Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Organic Themes GivingPress Lite allows Stored XSS.This issue affects GivingPress Lite: from n/a through 1.8.6. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/givingpress-lite/wordpress-givingpress-lite-theme-1-8-6-cross-site-scripting-xss-vulnerability?
m/database/vulnerability/givingpress-lite/wordpress-givingpress-lite-theme-1-8-6-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2024-43353 State: PUBLISHED Published: 2024-08-18T13:02:54.080Z Last Updated: 2024-09-13T14:03:58.882Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: myCred Products: myCred Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in myCred allows Stored XSS.This issue affects myCred: from n/a through 2.7.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/mycred/wordpress-mycred-plugin-2-7-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2024-43354 State: PUBLISHED Published: 2024-08-19T19:30:05.590Z Last Updated: 2024-08-19T20:34:28.619Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: myCred Products: myCred Problem Types: CWE-502 Description: Deserialization of Untrusted Data vulnerability in myCred allows Object Injection.This issue affects myCred: from n/a through 2.7.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/mycred/wordpress-mycred-plugin-2-7-2-php-object-injection-vulnerability?_s_id=cve
CVE ID: CVE-2024-43355 State: PUBLISHED Published: 2024-11-01T14:17:22.439Z Last Updated: 2024-11-04T18:00:33.930Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: BearDev Products: JoomSport Problem Types: CWE-862 Description: Missing Authorization vulnerability in BearDev JoomSport allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JoomSport: from n/a through 5.3.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/joomsport-sports-league-results-management/wordpress-joomsport-plugin-5-3-0-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2024-43356 State: PUBLISHED Published: 2024-08-26T20:29:10.183Z Last Updated: 2024-08-27T13:07:22.537Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: bobbingwide Products: oik Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in bobbingwide.This issue affects oik: from n/a through 4.12.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/oik/wordpress-oik-plugin-4-12-0-arbitrary-file-deletion-vulnerability?_s_id=cve
CVE ID: CVE-2024-43357 State: PUBLISHED Published: 2024-08-15T18:36:49.012Z Last Updated: 2024-08-15T19:10:00.235Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H) Vendors: tc39 Products: ecma262 Problem Types: CWE-248, CWE-476, CWE-843 Description: ECMA-262 is the language specification for the scripting language ECMAScript. A problem in the ECMAScript (JavaScript) specification of async generators, introduced by a May 2021 spec refactor, may lead to mis-implementation in a way that could present as a security vulnerability, such as type confusion and pointer dereference. The internal async generator machinery calls regular promise resolver functions on IteratorResult
pointer dereference. The internal async generator machinery calls regular promise resolver functions on IteratorResult (`{ done, value }`) objects that it creates, assuming that the IteratorResult objects will not be then-ables. Unfortunately, these IteratorResult objects inherit from `Object.prototype`, so these IteratorResult objects can be made then-able, triggering arbitrary behaviour, including re-entering the async generator machinery in a way that violates some internal invariants. The ECMAScript specification is a living standard and the issue has been addressed at the time of this advisory's public disclosure. JavaScript engine implementors should refer to the latest specification
the time of this advisory's public disclosure. JavaScript engine implementors should refer to the latest specification and update their implementations to comply with the `AsyncGenerator` section. ## References - https://github.com/tc39/ecma262/commit/1e24a286d0a327d08e1154926b3ee79820232727 - https://bugzilla.mozilla.org/show_bug.cgi?id=1901411 - https://github.com/boa-dev/boa/security/advisories/GHSA-f67q-wr6w-23jq - https://bugs.webkit.org/show_bug.cgi?id=275407 - https://issues.chromium.org/issues/346692561 - https://www.cve.org/CVERecord?id=CVE-2024-7652 Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/tc39/ecma262/security/advisories/GHSA-g38c-wh3c-5
alyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/tc39/ecma262/security/advisories/GHSA-g38c-wh3c-5h9r - https://github.com/boa-dev/boa/security/advisories/GHSA-f67q-wr6w-23jq - https://github.com/tc39/ecma262/pull/2413 - https://github.com/tc39/ecma262/commit/1e24a286d0a327d08e1154926b3ee79820232727 - https://github.com/tc39/ecma262/commit/4cb5a6980e20be76c648f113c4cc762342172df3 - https://bugs.webkit.org/show_bug.cgi?id=275407 - https://bugzilla.mozilla.org/show_bug.cgi?id=1901411 - https://issues.chromium.org/issues/346692561 - https://tc39.es/ecma262/#sec-asyncgenerator-objects - https://www.cve.org/CVERecord?id=CVE-2024-7652
CVE ID: CVE-2024-43358 State: PUBLISHED Published: 2024-08-12T20:46:59.082Z Last Updated: 2024-08-14T13:40:05.699Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: ZoneMinder Products: zoneminder Problem Types: CWE-79 Description: ZoneMinder is a free, open source closed-circuit television software application. ZoneMinder has a cross-site scripting vulnerability in the filter view via the filter[Id]. This vulnerability is fixed in 1.36.34 and 1.37.61. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/ZoneMinder/zoneminder/security/advisories/GHSA-6rrw-66rf-6g5f - https://github.com/ZoneMinder/zoneminder/commit/062cf568a33fb6a
der/zoneminder/security/advisories/GHSA-6rrw-66rf-6g5f - https://github.com/ZoneMinder/zoneminder/commit/062cf568a33fb6a8604ec327b1de8bb2e0d1ff77 - https://github.com/ZoneMinder/zoneminder/commit/4602cd0470a3b90b18bcc44b3c86d963872d1ba0
CVE ID: CVE-2024-43359 State: PUBLISHED Published: 2024-08-12T20:49:28.130Z Last Updated: 2024-08-13T17:05:24.009Z Severity: NONE (CVSS N/A CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N) Vendors: ZoneMinder Products: zoneminder Problem Types: CWE-79 Description: ZoneMinder is a free, open source closed-circuit television software application. ZoneMinder has a cross-site scripting vulnerability in the montagereview via the displayinterval, speed, and scale parameters. This vulnerability is fixed in 1.36.34 and 1.37.61. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/ZoneMinder/zoneminder/security/advisories/GHSA-pjjm-3qxp-6hj8 - https://github.com/ZoneMinder
nces: - https://github.com/ZoneMinder/zoneminder/security/advisories/GHSA-pjjm-3qxp-6hj8 - https://github.com/ZoneMinder/zoneminder/commit/6cc64dddff6144a98680f65ecf8dc249028431af - https://github.com/ZoneMinder/zoneminder/commit/b51c5df0cb869ca48fccfc6e6fd7c19bf717ecd2
CVE ID: CVE-2024-43360 State: PUBLISHED Published: 2024-08-12T20:55:14.760Z Last Updated: 2024-08-15T19:00:59.189Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: ZoneMinder Products: zoneminder Problem Types: CWE-89 Description: ZoneMinder is a free, open source closed-circuit television software application. ZoneMinder is affected by a time-based SQL Injection vulnerability. This vulnerability is fixed in 1.36.34 and 1.37.61. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/ZoneMinder/zoneminder/security/advisories/GHSA-9cmr-7437-v9fj - https://github.com/ZoneMinder/zoneminder/commit/677f6a31551f128554f7b0110a52fd76453a
ty/advisories/GHSA-9cmr-7437-v9fj - https://github.com/ZoneMinder/zoneminder/commit/677f6a31551f128554f7b0110a52fd76453a657a - https://github.com/ZoneMinder/zoneminder/commit/a194fe81d34c5eea2ab1dc18dc8df615fca634a6 - https://github.com/ZoneMinder/zoneminder/commit/bb07118118e23b5670c2c18be8be2cc6b8529397 - https://github.com/ZoneMinder/zoneminder/commit/de8f387207e9c506e8e8007eda725741a25601c5