Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/487e5add-726c-4cfc-b86e-bb4eeec168a3?source=cve - https://plugins.trac.wordpress.org/browser/video-embed-privacy/trunk/preview/preview.php - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3162600%40video-embed-privacy&new=3162600%40video-embed-privacy&sfp_email=&sfph_mail=
CVE ID: CVE-2024-9347 State: PUBLISHED Published: 2024-10-17T03:32:49.973Z Last Updated: 2024-10-17T13:03:52.020Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: wpextended Products: The Ultimate WordPress Toolkit – WP Extended Problem Types: CWE-79 Description: The The Ultimate WordPress Toolkit – WP Extended plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'wpext-export' parameter in all versions up to, and including, 3.0.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user int
nauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/822c0a33-e57e-48c7-b8df-fddf3bb2e552?source=cve - https://plugins.trac.wordpress.org/browser/wpextended/tags/3.0.9/includes/libraries/wpext_export/wpext_export.php#L209 - https://plugins.trac.wordpress.org/changeset/3169963/wpextended/trunk/includes/libraries/wpext_export/wpext_export.php
CVE ID: CVE-2024-9348 State: PUBLISHED Published: 2024-10-16T14:50:06.031Z Last Updated: 2024-10-17T13:30:08.548Z Vendors: Docker Products: Docker Desktop Problem Types: CWE-20 Description: Docker Desktop before v4.34.3 allows RCE via unsanitized GitHub source link in Build view. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://docs.docker.com/desktop/release-notes/#4343
CVE ID: CVE-2024-9349 State: PUBLISHED Published: 2024-10-04T02:04:52.591Z Last Updated: 2024-10-04T14:00:21.188Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: miunosoft Products: Auto Amazon Links – Amazon Associates Affiliate Plugin Problem Types: CWE-79 Description: The Auto Amazon Links – Amazon Associates Affiliate Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 5.4.2. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into
authenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/7ebd4936-9d68-42cb-a427-a1db894b49ec?source=cve - https://plugins.trac.wordpress.org/browser/amazon-auto-links/tags/5.4.2/include/core/main/admin/report/http_request/AmazonAutoLinks_AdminPage_Tab_HTTPRequest.php#L133 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3161302%40amazon-auto-links&new=3161302%40amazon-auto-links&sfp_email=&sfph_mail=#file5
CVE ID: CVE-2024-9350 State: PUBLISHED Published: 2024-10-18T04:32:53.714Z Last Updated: 2024-10-18T13:55:12.150Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: dpdbaltics Products: DPD Baltic Shipping Problem Types: CWE-79 Description: The DPD Baltic Shipping plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'search_value' parameter in all versions up to, and including, 1.2.83 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link
scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/6251d0f6-b536-4122-8fdf-bb77665a4f41?source=cve - https://plugins.trac.wordpress.org/browser/woo-shipping-dpd-baltic/trunk/includes/class-dpd.php#L318
CVE ID: CVE-2024-9351 State: PUBLISHED Published: 2024-10-17T05:33:09.391Z Last Updated: 2024-10-17T19:34:53.850Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: wpmudev Products: Forminator Forms – Contact Form, Payment Form & Custom Form Builder Problem Types: CWE-352 Description: The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.35.1. This is due to missing or incorrect nonce validation on the quiz 'create_module' function. This makes it possible for unauthenticated attackers to create draft quizzes via a forged request granted th
' function. This makes it possible for unauthenticated attackers to create draft quizzes via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/8d89e3b7-d980-42bb-ab0c-d86ab174a69c?source=cve - https://plugins.trac.wordpress.org/browser/forminator/tags/1.35.0/library/modules/quizzes/admin/admin-loader.php#L719 - https://plugins.trac.wordpress.org/changeset/3169243/
CVE ID: CVE-2024-9352 State: PUBLISHED Published: 2024-10-17T05:33:08.753Z Last Updated: 2024-10-17T19:43:17.165Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: wpmudev Products: Forminator Forms – Contact Form, Payment Form & Custom Form Builder Problem Types: CWE-352 Description: The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.35.1. This is due to missing or incorrect nonce validation on the custom form 'create_module' function. This makes it possible for unauthenticated attackers to create draft forms via a forged request grant
_module' function. This makes it possible for unauthenticated attackers to create draft forms via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/81e6e266-078a-4f4f-a335-c9d388f41ef2?source=cve - https://plugins.trac.wordpress.org/browser/forminator/tags/1.35.0/library/modules/custom-forms/admin/admin-loader.php#L418 - https://plugins.trac.wordpress.org/changeset/3169243/
CVE ID: CVE-2024-9353 State: PUBLISHED Published: 2024-10-04T02:04:51.507Z Last Updated: 2024-10-04T14:00:53.442Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: themes4wp Products: Popularis Extra Problem Types: CWE-79 Description: The Popularis Extra plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg & remove_query_arg without appropriate escaping on the URL in all versions up to, and including, 1.2.6. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additiona
pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/4fc82778-0493-456f-bc73-3d70e3a2b1bf?source=cve - https://plugins.trac.wordpress.org/browser/popularis-extra/tags/1.2.6/includes/wizard/wizard.php#L305 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3161466%40popularis-extra&new=3161466%40popularis-extra&sfp_email=&sfph_mail=
CVE ID: CVE-2024-9354 State: PUBLISHED Published: 2025-01-07T06:40:57.604Z Last Updated: 2025-01-07T16:12:50.053Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: estatik Products: Estatik Mortgage Calculator Problem Types: CWE-79 Description: The Estatik Mortgage Calculator plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'color' parameter in all versions up to, and including, 2.0.11 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on
y web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/4b955a0f-d064-436f-8648-0e84fac752d2?source=cve - https://plugins.trac.wordpress.org/browser/estatik-mortgage-calculator/trunk/public/images/info.php - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3199224%40estatik-mortgage-calculator&new=3199224%40estatik-mortgage-calculator&sfp_email=&sfph_mail=
CVE ID: CVE-2024-9355 State: PUBLISHED Published: 2024-10-01T18:17:29.420Z Last Updated: 2025-11-20T20:57:54.155Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L) Vendors: Red Hat Products: Red Hat Enterprise Linux 7 Extended Lifecycle Support, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 9.4 Extended Update Support, Satellite Client 6 for RHEL 8, Satellite Client 6 for RHEL 9, Streams for Apache Kafka 2.9.0, NBDE Tang Server, OpenShift Developer Tools and Services, OpenShift Pipelines, OpenShift Serverless, Red Hat Ansible Automation Platform 1.2, Red Hat Ansible Automation Platform 2, Red Hat Enterprise Linux 10, Red Hat Enterpris
t Ansible Automation Platform 1.2, Red Hat Ansible Automation Platform 2, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 7, Red Hat OpenShift Container Platform 4, Red Hat Openshift Container Storage 4, Red Hat Openshift Data Foundation 4, Red Hat OpenShift Dev Spaces, Red Hat OpenShift GitOps, Red Hat OpenShift on AWS, Red Hat OpenShift Virtualization 4, Red Hat OpenStack Platform 16.2, Red Hat OpenStack Platform 17.1, Red Hat Satellite 6, Red Hat Service Interconnect 1, Red Hat Storage 3, Red Hat Trusted Artifact Signer Problem Types: CWE-457 Description: A vulnerability was found in Golang FIPS OpenSSL. This flaw allows a malicious user to randomly cause an uninitialized buffer len
bility was found in Golang FIPS OpenSSL. This flaw allows a malicious user to randomly cause an uninitialized buffer length variable with a zeroed buffer to be returned in FIPS mode. It may also be possible to force a false positive match between non-equal hashes when comparing a trusted computed hmac sum to an untrusted input sum if an attacker can send a zeroed buffer in place of a pre-computed sum. It is also possible to force a derived key to be all zeros instead of an unpredictable value. This may have follow-on implications for the Go TLS stack. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://access.redhat.com/errata/RHSA-2024:10133 - https://access.redhat.com/
es: - CISA ADP Vulnrichment: References: - https://access.redhat.com/errata/RHSA-2024:10133 - https://access.redhat.com/errata/RHSA-2024:7502 - https://access.redhat.com/errata/RHSA-2024:7550 - https://access.redhat.com/errata/RHSA-2024:8327 - https://access.redhat.com/errata/RHSA-2024:8678 - https://access.redhat.com/errata/RHSA-2024:8847 - https://access.redhat.com/errata/RHSA-2024:9551 - https://access.redhat.com/errata/RHSA-2025:2416 - https://access.redhat.com/errata/RHSA-2025:7118 - https://access.redhat.com/errata/RHSA-2025:7256 - https://access.redhat.com/errata/RHSA-2025:7624 - https://access.redhat.com/security/cve/CVE-2024-9355 - https://bugzilla.redhat.com/show_bug.cgi?id=2315719
A-2025:7624 - https://access.redhat.com/security/cve/CVE-2024-9355 - https://bugzilla.redhat.com/show_bug.cgi?id=2315719 - https://github.com/golang-fips/openssl/pull/198
CVE ID: CVE-2024-9356 State: PUBLISHED Published: 2024-11-15T05:30:55.822Z Last Updated: 2024-11-20T22:37:22.305Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: yotpo Products: Yotpo: Product & Photo Reviews for WooCommerce Problem Types: CWE-79 Description: The Yotpo: Product & Photo Reviews for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'yotpo_user_email' and 'yotpo_user_name' parameters in all versions up to, and including, 1.7.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can suc
is makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/2f7ddb34-cb5b-4089-bd3e-07056f0b6bd5?source=cve - https://plugins.trac.wordpress.org/browser/yotpo-social-reviews-for-woocommerce/trunk/lib/utils/wc-yotpo-settings-functions.php#L100
CVE ID: CVE-2024-9357 State: PUBLISHED Published: 2024-11-12T05:31:08.211Z Last Updated: 2024-11-12T11:21:20.551Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: michelwppi Products: xili-tidy-tags Problem Types: CWE-79 Description: The xili-tidy-tags plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'action' parameter in all versions up to, and including, 1.12.04 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional An
s that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/28fd9f64-4451-46fd-bdeb-cc5a538ea563?source=cve - https://plugins.trac.wordpress.org/browser/xili-tidy-tags/tags/1.12.04/xili-includes/class-xili-tidy-tags-admin.php#L156 - https://plugins.trac.wordpress.org/changeset?old_path=/xili-tidy-tags/tags/1.12.04&new_path=/xili-tidy-tags/tags/1.12.05&sfp_email=&sfph_mail=
CVE ID: CVE-2024-9358 State: PUBLISHED Published: 2024-10-01T01:00:07.228Z Last Updated: 2024-10-01T14:37:56.030Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: n/a Products: ThingsBoard Problem Types: CWE-400 Description: A vulnerability has been found in ThingsBoard up to 3.7.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the component HTTP RPC API. The manipulation leads to resource consumption. The attack can be launched remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. Upgrading to version 3.7.1 is
on appears to be difficult. The exploit has been disclosed to the public and may be used. Upgrading to version 3.7.1 is able to address this issue. It is recommended to upgrade the affected component. The vendor was informed on 2024-07-24 about this vulnerability and announced the release of 3.7.1 for the second half of September 2024. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.278887 - https://vuldb.com/?ctiid.278887 - https://vuldb.com/?submit.379486 - https://1drv.ms/v/s!AksJ421iyCG-mytAcEUF6WqOTwj2?e=6WAp5G
CVE ID: CVE-2024-9359 State: PUBLISHED Published: 2024-10-01T01:31:04.318Z Last Updated: 2024-10-01T14:07:39.035Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: code-projects Products: Restaurant Reservation System Problem Types: CWE-89 Description: A vulnerability was found in code-projects Restaurant Reservation System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /addcompany.php. The manipulation of the argument company leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?i
sed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.278888 - https://vuldb.com/?ctiid.278888 - https://vuldb.com/?submit.416041 - https://github.com/ppp-src/a/issues/22 - https://code-projects.org/
CVE ID: CVE-2024-9360 State: PUBLISHED Published: 2024-10-01T03:00:08.196Z Last Updated: 2024-10-01T14:02:46.137Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: code-projects Products: Restaurant Reservation System Problem Types: CWE-89 Description: A vulnerability was found in code-projects Restaurant Reservation System 1.0. It has been classified as critical. This affects an unknown part of the file /updatebal.php. The manipulation of the argument company leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.278
o the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.278889 - https://vuldb.com/?ctiid.278889 - https://vuldb.com/?submit.416058 - https://github.com/halhalz/-/issues/1 - https://code-projects.org/
CVE ID: CVE-2024-9361 State: PUBLISHED Published: 2024-10-18T04:32:55.239Z Last Updated: 2024-10-18T16:37:24.259Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: giuliopanda Products: Bulk images optimizer: Resize, optimize, convert to webp, rename … Problem Types: CWE-862 Description: The Bulk images optimizer: Resize, optimize, convert to webp, rename … plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'save_configuration' function in all versions up to, and including, 2.0.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update plugin options. Ad
This makes it possible for authenticated attackers, with Subscriber-level access and above, to update plugin options. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/a189e436-e8af-4379-aa6e-2d1a4a2d4bfa?source=cve - https://plugins.trac.wordpress.org/browser/bulk-image-resizer/trunk/includes/class-bir-loader.php#L44
CVE ID: CVE-2024-9362 State: PUBLISHED Published: 2025-03-20T10:09:48.070Z Last Updated: 2025-03-20T18:34:35.259Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: polyaxon Products: polyaxon/polyaxon Problem Types: CWE-22 Description: An unauthenticated directory traversal vulnerability exists in Polyaxon, affecting the latest version. This vulnerability allows an attacker to retrieve directory information and file contents from the server without proper authorization, leading to sensitive information disclosure. The issue enables access to system directories such as `/etc`, potentially resulting in significant security risks. Additional Analyst Notes: - CISA A
stem directories such as `/etc`, potentially resulting in significant security risks. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/d8dcb40f-ce76-4524-8d06-e0f12a07809d
CVE ID: CVE-2024-9363 State: PUBLISHED Published: 2025-03-20T10:09:20.436Z Last Updated: 2025-03-20T18:56:16.931Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: polyaxon Products: polyaxon/polyaxon Problem Types: CWE-23 Description: An unauthorized file deletion vulnerability exists in the latest version of the Polyaxon platform, which can lead to denial of service by terminating critical containers. An attacker can delete important files within the containers, such as `polyaxon.sock`, causing the API container to exit unexpectedly. This disrupts related services and prevents the system from functioning normally, without requiring authentication or UUID param
rupts related services and prevents the system from functioning normally, without requiring authentication or UUID parameters. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/ec7b7e1d-795d-4414-93d5-9df35d2fd391
CVE ID: CVE-2024-9364 State: PUBLISHED Published: 2024-10-18T04:32:55.748Z Last Updated: 2024-10-18T16:36:55.955Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: smackcoders Products: SendGrid for WordPress Problem Types: CWE-862 Description: The SendGrid for WordPress plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'wp_mailplus_clear_logs' function in all versions up to, and including, 1.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete the plugin's log files. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.c
delete the plugin's log files. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/bb7d99a7-1e7d-43e1-839c-286b454c8276?source=cve - https://plugins.svn.wordpress.org/wp-sendgrid-mailer/tags/1.4/wp-sendgrid-mailer.php - https://plugins.trac.wordpress.org/browser/wp-sendgrid-mailer/trunk/wp-sendgrid-mailer.php#L167
CVE ID: CVE-2024-9365 State: PUBLISHED Published: 2025-03-20T10:10:43.972Z Last Updated: 2025-03-20T18:17:34.295Z Severity: MEDIUM (CVSS 6.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N) Vendors: polyaxon Products: polyaxon/polyaxon Problem Types: CWE-352 Description: A Cross-Site Request Forgery (CSRF) vulnerability in polyaxon/polyaxon v2.4.0 allows attackers to perform unauthorized actions in the context of the victim's browser. This includes creating projects, model versions, and artifact versions, or changing settings. The impact of this vulnerability includes potential data loss and service disruption. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/b
l data loss and service disruption. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/cdfa012b-a694-4beb-9a9a-12a9dde07ef9
CVE ID: CVE-2024-9366 State: PUBLISHED Published: 2024-10-18T04:32:57.844Z Last Updated: 2024-10-18T16:34:31.130Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: wpzest Products: Easy Menu Manager | WPZest Problem Types: CWE-79 Description: The Easy Menu Manager | WPZest plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.0.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file. Additional Analys
ove, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/f60df43a-eef3-449d-96fd-b26e28361f81?source=cve - https://wordpress.org/plugins/easy-menu-manager-wpzest/#developers