Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
tion that does prevent actions from changing claims that start with `urn:zitadel:iam`. This vulnerability is fixed in 2.48.3, 2.47.8, 2.46.5, 2.45.5, 2.44.7, 2.43.11, and 2.42.17. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/zitadel/zitadel/security/advisories/GHSA-gp8g-f42f-95q2 - https://github.com/zitadel/zitadel/releases/tag/v2.42.17 - https://github.com/zitadel/zitadel/releases/tag/v2.43.11 - https://github.com/zitadel/zitadel/releases/tag/v2.44.7 - https://github.com/zitadel/zitadel/releases/tag/v2.45.5 - https://github.com/zitadel/zitadel/releases/tag/v2.46.5 - https://github.com/zitadel/zitadel/releases/tag/v2.47.8 - htt
https://github.com/zitadel/zitadel/releases/tag/v2.46.5 - https://github.com/zitadel/zitadel/releases/tag/v2.47.8 - https://github.com/zitadel/zitadel/releases/tag/v2.48.3
CVE ID: CVE-2024-29893 State: PUBLISHED Published: 2024-03-29T15:07:51.057Z Last Updated: 2024-08-02T01:17:58.029Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: argoproj Products: argo-cd Problem Types: CWE-400 Description: Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. All versions of ArgoCD starting from v2.4 have a bug where the ArgoCD repo-server component is vulnerable to a Denial-of-Service attack vector. Specifically, it's possible to crash the repo server component through an out of memory error by pointing it to a malicious Helm registry. The loadRepoIndex() function in the ArgoCD's helm package, does not limit the size
ing it to a malicious Helm registry. The loadRepoIndex() function in the ArgoCD's helm package, does not limit the size nor time while fetching the data. It fetches it and creates a byte slice from the retrieved data in one go. If the registry is implemented to push data continuously, the repo server will keep allocating memory until it runs out of it. A patch for this vulnerability has been released in v2.10.3, v2.9.8, and v2.8.12. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/argoproj/argo-cd/security/advisories/GHSA-jhwx-mhww-rgc3 - https://github.com/argoproj/argo-cd/commit/14f681e3ee7c38731943b98f92277e88a3db109d - https://g
es/GHSA-jhwx-mhww-rgc3 - https://github.com/argoproj/argo-cd/commit/14f681e3ee7c38731943b98f92277e88a3db109d - https://github.com/argoproj/argo-cd/commit/36b8a12a38f8d92d55bffc81deed44389bf6eb59 - https://github.com/argoproj/argo-cd/commit/3e5a878f6e30d935fa149723ea2a2e93748fcddd
CVE ID: CVE-2024-29894 State: PUBLISHED Published: 2024-05-13T14:24:32.871Z Last Updated: 2025-02-13T17:47:43.692Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L) Vendors: Cacti Products: cacti Problem Types: CWE-116, CWE-79 Description: Cacti provides an operational monitoring and fault management framework. Versions of Cacti prior to 1.2.27 contain a residual cross-site scripting vulnerability caused by an incomplete fix for CVE-2023-50250. `raise_message_javascript` from `lib/functions.php` now uses purify.js to fix CVE-2023-50250 (among others). However, it still generates the code out of unescaped PHP variables `$title` and `$header`. If those variables contain
However, it still generates the code out of unescaped PHP variables `$title` and `$header`. If those variables contain single quotes, they can be used to inject JavaScript code. An attacker exploiting this vulnerability could execute actions on behalf of other users. This ability to impersonate users could lead to unauthorized changes to settings. Version 1.2.27 fixes this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/Cacti/cacti/security/advisories/GHSA-grj5-8fcj-34gh - https://github.com/Cacti/cacti/security/advisories/GHSA-xwqc-7jc4-xm73 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproje
curity/advisories/GHSA-xwqc-7jc4-xm73 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RBEOAFKRARQHTDIYSL723XAFJ2Q6624X/
CVE ID: CVE-2024-29895 State: PUBLISHED Published: 2024-05-13T14:33:27.594Z Last Updated: 2024-08-02T01:17:58.192Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: Cacti Products: cacti Problem Types: CWE-77 Description: Cacti provides an operational monitoring and fault management framework. A command injection vulnerability on the 1.3.x DEV branch allows any unauthenticated user to execute arbitrary command on the server when `register_argc_argv` option of PHP is `On`. In `cmd_realtime.php` line 119, the `$poller_id` used as part of the command execution is sourced from `$_SERVER['argv']`, which can be controlled by URL when `register_argc_argv` option of
ommand execution is sourced from `$_SERVER['argv']`, which can be controlled by URL when `register_argc_argv` option of PHP is `On`. And this option is `On` by default in many environments such as the main PHP Docker image for PHP. Commit 53e8014d1f082034e0646edc6286cde3800c683d contains a patch for the issue, but this commit was reverted in commit 99633903cad0de5ace636249de16f77e57a3c8fc. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/Cacti/cacti/security/advisories/GHSA-cr28-x256-xf5m - https://github.com/Cacti/cacti/commit/53e8014d1f082034e0646edc6286cde3800c683d - https://github.com/Cacti/cacti/commit/99633903cad0de5ace636249d
/cacti/commit/53e8014d1f082034e0646edc6286cde3800c683d - https://github.com/Cacti/cacti/commit/99633903cad0de5ace636249de16f77e57a3c8fc - https://github.com/Cacti/cacti/blob/501712998589763d411a68d35e3cda98fd9cfd18/cmd_realtime.php#L119
CVE ID: CVE-2024-29896 State: PUBLISHED Published: 2024-03-28T12:48:53.104Z Last Updated: 2024-08-02T01:17:58.611Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) Vendors: KindSpells Products: astro-shield Problem Types: CWE-74 Description: Astro-Shield is a library to compute the subresource integrity hashes for your JS scripts and CSS stylesheets. When automated CSP headers generation for SSR content is enabled and the web application serves content that can be partially controlled by external users, then it is possible that the CSP headers generation feature might be "allow-listing" malicious injected resources like inlined JS, or references to external malicious sc
on feature might be "allow-listing" malicious injected resources like inlined JS, or references to external malicious scripts. The fix is available in version 1.3.0. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/KindSpells/astro-shield/security/advisories/GHSA-w387-5qqw-7g8m - https://github.com/KindSpells/astro-shield/commit/41b84576d37fa486a57005ea297658d0bc38566d
CVE ID: CVE-2024-29897 State: PUBLISHED Published: 2024-03-28T13:40:43.231Z Last Updated: 2024-09-03T18:09:56.991Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) Vendors: miraheze Products: CreateWiki Problem Types: CWE-200 Description: CreateWiki is Miraheze's MediaWiki extension for requesting & creating wikis. It is possible for users with (delete) or (suppressrevision) on any wiki in the farm to access suppressed wiki requests by going to the request's entry on Special:RequestWikiQueue on the wiki where they have these rights. The same vulnerability was present briefly on the REST API before being quickly corrected in commit `6bc0685`. To our knowledge, the vuln
ility was present briefly on the REST API before being quickly corrected in commit `6bc0685`. To our knowledge, the vulnerable commits of the REST API are not running in production anywhere. This vulnerability is fixed in 23415c17ffb4832667c06abcf1eadadefd4c8937. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/miraheze/CreateWiki/security/advisories/GHSA-4rcf-3cj2-46mq - https://github.com/miraheze/mw-config/commit/fb3e68bcef459e9cf2a415241b28042a6c9727e8 - https://issue-tracker.miraheze.org/F3093343 - https://issue-tracker.miraheze.org/T11999
CVE ID: CVE-2024-29898 State: PUBLISHED Published: 2024-03-28T13:43:07.988Z Last Updated: 2024-08-02T01:17:58.434Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) Vendors: miraheze Products: CreateWiki Problem Types: CWE-200 Description: CreateWiki is Miraheze's MediaWiki extension for requesting & creating wikis. An oversight during the writing of the patch for CVE-2024-29897 may have exposed suppressed wiki requests to private wikis that added Special:RequestWikiQueue to the read whitelist to users without the `(read)` permission. This vulnerability is fixed in 8f8442ed5299510ea3e58416004b9334134c149c. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Progra
ty is fixed in 8f8442ed5299510ea3e58416004b9334134c149c. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/miraheze/CreateWiki/security/advisories/GHSA-5rcv-cf88-gv8v - https://github.com/miraheze/CreateWiki/security/advisories/GHSA-4rcf-3cj2-46mq - https://github.com/miraheze/CreateWiki/commit/8f8442ed5299510ea3e58416004b9334134c149c
CVE ID: CVE-2024-29900 State: PUBLISHED Published: 2024-03-29T15:15:45.766Z Last Updated: 2024-08-02T01:17:58.508Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: electron Products: packager Problem Types: CWE-402 Description: Electron Packager bundles Electron-based application source code with a renamed Electron executable and supporting files into folders ready for distribution. A random segment of ~1-10kb of Node.js heap memory allocated either side of a known buffer will be leaked into the final executable. This memory _could_ contain sensitive information such as environment variables, secrets files, etc. This issue is patched in 18.3.1. Additional Analy
nsitive information such as environment variables, secrets files, etc. This issue is patched in 18.3.1. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/electron/packager/security/advisories/GHSA-34h3-8mw4-qw57 - https://github.com/electron/packager/commit/d421d4bd3ced889a4143c5c3ab6d95e3be249eee
CVE ID: CVE-2024-29901 State: PUBLISHED Published: 2024-03-29T15:23:02.184Z Last Updated: 2024-08-02T01:17:58.024Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N) Vendors: workos Products: authkit-nextjs Problem Types: CWE-294 Description: The AuthKit library for Next.js provides helpers for authentication and session management using WorkOS & AuthKit with Next.js. A user can reuse an expired session by controlling the `x-workos-session` header. The vulnerability is patched in v0.4.2. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/workos/authkit-nextjs/security/advisories/GHSA-35w3-6qhc-474v - https://gith
Container: References: - https://github.com/workos/authkit-nextjs/security/advisories/GHSA-35w3-6qhc-474v - https://github.com/workos/authkit-nextjs/commit/6c3f4f3179d66cbb15de3962792083ff3b244a01 - https://github.com/workos/authkit-nextjs/releases/tag/v0.4.2
CVE ID: CVE-2024-29902 State: PUBLISHED Published: 2024-04-10T22:28:19.788Z Last Updated: 2024-08-02T01:17:58.609Z Severity: MEDIUM (CVSS 4.2 CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:N/A:H) Vendors: sigstore Products: cosign Problem Types: CWE-770 Description: Cosign provides code signing and transparency for containers and binaries. Prior to version 2.2.4, a remote image with a malicious attachment can cause denial of service of the host machine running Cosign. This can impact other services on the machine that rely on having memory available such as a Redis database which can result in data loss. It can also impact the availability of other services on the machine that will not be available
an result in data loss. It can also impact the availability of other services on the machine that will not be available for the duration of the machine denial. The root cause of this issue is that Cosign reads the attachment from a remote image entirely into memory without checking the size of the attachment first. As such, a large attachment can make Cosign read a large attachment into memory; If the attachments size is larger than the machine has memory available, the machine will be denied of service. The Go runtime will make a SigKill after a few seconds of system-wide denial. This issue can allow a supply-chain escalation from a compromised registry to the Cosign user: If an attacher ha
denial. This issue can allow a supply-chain escalation from a compromised registry to the Cosign user: If an attacher has compromised a registry or the account of an image vendor, they can include a malicious attachment and hurt the image consumer. Version 2.2.4 contains a patch for the vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/sigstore/cosign/security/advisories/GHSA-88jx-383q-w4qc - https://github.com/sigstore/cosign/commit/629f5f8fa672973503edde75f84dcd984637629e - https://github.com/google/go-containerregistry/blob/a0658aa1d0cc7a7f1bcc4a3af9155335b6943f40/pkg/v1/remote/layer.go#L36-L40 - https://github.com/
/go-containerregistry/blob/a0658aa1d0cc7a7f1bcc4a3af9155335b6943f40/pkg/v1/remote/layer.go#L36-L40 - https://github.com/sigstore/cosign/blob/9bc3ee309bf35d2f6e17f5d23f231a3d8bf580bc/pkg/oci/remote/remote.go#L228-L239 - https://github.com/sigstore/cosign/releases/tag/v2.2.4
CVE ID: CVE-2024-29903 State: PUBLISHED Published: 2024-04-10T22:30:50.890Z Last Updated: 2024-08-02T01:17:58.600Z Severity: MEDIUM (CVSS 4.2 CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:N/A:H) Vendors: sigstore Products: cosign Problem Types: CWE-770 Description: Cosign provides code signing and transparency for containers and binaries. Prior to version 2.2.4, maliciously-crafted software artifacts can cause denial of service of the machine running Cosign thereby impacting all services on the machine. The root cause is that Cosign creates slices based on the number of signatures, manifests or attestations in untrusted artifacts. As such, the untrusted artifact can control the amount of memory tha
, manifests or attestations in untrusted artifacts. As such, the untrusted artifact can control the amount of memory that Cosign allocates. The exact issue is Cosign allocates excessive memory on the lines that creates a slice of the same length as the manifests. Version 2.2.4 contains a patch for the vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/sigstore/cosign/security/advisories/GHSA-95pr-fxf5-86gv - https://github.com/sigstore/cosign/commit/629f5f8fa672973503edde75f84dcd984637629e - https://github.com/sigstore/cosign/blob/14795db16417579fac0c00c11e166868d7976b61/pkg/cosign/verify.go#L948-L955 - https://github.c
thub.com/sigstore/cosign/blob/14795db16417579fac0c00c11e166868d7976b61/pkg/cosign/verify.go#L948-L955 - https://github.com/sigstore/cosign/blob/286a98a4a99c1b2f32f84b0d560e324100312280/pkg/oci/remote/signatures.go#L56-L70 - https://github.com/sigstore/cosign/releases/tag/v2.2.4
CVE ID: CVE-2024-29904 State: PUBLISHED Published: 2024-03-29T15:32:38.686Z Last Updated: 2024-08-21T22:44:16.609Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: codeigniter4 Products: CodeIgniter4 Problem Types: CWE-835 Description: CodeIgniter is a PHP full-stack web framework A vulnerability was found in the Language class that allowed DoS attacks. This vulnerability can be exploited by an attacker to consume a large amount of memory on the server. Upgrade to v4.4.7 or later. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/codeigniter4/CodeIgniter4/security/advisories/GHSA-39fp-mqmm-gxj6 - https:
ulnrichment: References: - https://github.com/codeigniter4/CodeIgniter4/security/advisories/GHSA-39fp-mqmm-gxj6 - https://github.com/codeigniter4/CodeIgniter4/commit/fa851acbae7ae4c5a97f8f38ae87aa0822a334c0
CVE ID: CVE-2024-29905 State: PUBLISHED Published: 2024-04-09T16:49:48.158Z Last Updated: 2024-08-02T01:17:58.559Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L) Vendors: DIRACGrid Products: DIRAC Problem Types: CWE-668 Description: DIRAC is an interware, meaning a software framework for distributed computing. Prior to version 8.0.41, during the proxy generation process (e.g., when using `dirac-proxy-init`), it is possible for unauthorized users on the same machine to gain read access to the proxy. This allows the user to then perform any action that is possible with the original proxy. This vulnerability only exists for a short period of time (sub-millsecond) during
is possible with the original proxy. This vulnerability only exists for a short period of time (sub-millsecond) during the generation process. Version 8.0.41 contains a patch for the issue. As a workaround, setting the `X509_USER_PROXY` environment variable to a path that is inside a directory that is only readable to the current user avoids the potential risk. After the file has been written, it can be safely copied to the standard location (`/tmp/x509up_uNNNN`). Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/DIRACGrid/DIRAC/security/advisories/GHSA-v6f3-gh5h-mqwx - https://github.com/DIRACGrid/DIRAC/commit/1faa709341969a6321e29
IRACGrid/DIRAC/security/advisories/GHSA-v6f3-gh5h-mqwx - https://github.com/DIRACGrid/DIRAC/commit/1faa709341969a6321e29c843ca94039d33b2c3d
CVE ID: CVE-2024-29906 State: PUBLISHED Published: 2024-03-27T06:53:22.559Z Last Updated: 2024-08-05T16:52:15.338Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: realmag777 Products: WordPress Meta Data and Taxonomies Filter (MDTF) Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in realmag777 WordPress Meta Data and Taxonomies Filter (MDTF) allows Stored XSS.This issue affects WordPress Meta Data and Taxonomies Filter (MDTF): from n/a through 1.3.2. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vul
ional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/wp-meta-data-filter-and-taxonomy-filter/wordpress-mdtf-meta-data-and-taxonomies-filter-plugin-1-3-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2024-29907 State: PUBLISHED Published: 2024-03-27T06:50:03.186Z Last Updated: 2024-08-02T18:30:15.134Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: Active Websight Products: SEO Backlink Monitor Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Active Websight SEO Backlink Monitor allows Reflected XSS.This issue affects SEO Backlink Monitor: from n/a through 1.5.0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/seo-backlink-monitor/wordpress-seo-backlink-monitor-plugin-1-5
ferences: - https://patchstack.com/database/vulnerability/seo-backlink-monitor/wordpress-seo-backlink-monitor-plugin-1-5-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2024-29908 State: PUBLISHED Published: 2024-03-27T06:56:13.734Z Last Updated: 2024-08-02T15:44:28.048Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: Kienso Products: Co-marquage service-public.fr Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kienso Co-marquage service-public.Fr allows Stored XSS.This issue affects Co-marquage service-public.Fr: from n/a through 0.5.71. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/co-marquage-service-public/wordpress-co-marquage-serv
hment: References: - https://patchstack.com/database/vulnerability/co-marquage-service-public/wordpress-co-marquage-service-public-fr-plugin-0-5-71-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2024-29909 State: PUBLISHED Published: 2024-03-27T06:57:26.453Z Last Updated: 2024-08-06T16:26:30.293Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: Camille Verrier Products: Travelers' Map Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Camille Verrier Travelers' Map allows Stored XSS.This issue affects Travelers' Map: from n/a through 2.2.0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/travelers-map/wordpress-travelers-map-plugin-2-2-0-cross-site-scripting-xss-vulne
/patchstack.com/database/vulnerability/travelers-map/wordpress-travelers-map-plugin-2-2-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2024-29910 State: PUBLISHED Published: 2024-03-27T06:58:38.347Z Last Updated: 2024-08-06T19:16:59.916Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: Alordiel Products: Dropdown Multisite selector Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Alordiel Dropdown Multisite selector allows Stored XSS.This issue affects Dropdown Multisite selector: from n/a through 0.9.2. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/dropdown-multisite-selector/wordpress-dropdown-multisite
nt: References: - https://patchstack.com/database/vulnerability/dropdown-multisite-selector/wordpress-dropdown-multisite-selector-plugin-0-9-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2024-29911 State: PUBLISHED Published: 2024-03-27T06:59:54.748Z Last Updated: 2024-08-02T14:30:30.228Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: Jewel Theme Products: Master Addons for Elementor Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jewel Theme Master Addons for Elementor allows Stored XSS.This issue affects Master Addons for Elementor: from n/a through 2.0.5.4.1. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/master-addons/wordpress-master-addons-for-elem
Vulnrichment: References: - https://patchstack.com/database/vulnerability/master-addons/wordpress-master-addons-for-elementor-plugin-2-0-5-4-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2024-29912 State: PUBLISHED Published: 2024-03-27T07:01:14.591Z Last Updated: 2024-08-02T14:49:33.952Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: Baptiste Placé Products: iCalendrier Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Baptiste Placé iCalendrier allows Stored XSS.This issue affects iCalendrier: from n/a through 1.80. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/icalendrier/wordpress-icalendrier-plugin-1-80-cross-site-scripting-xss-vulnerability?_s_id=cv
com/database/vulnerability/icalendrier/wordpress-icalendrier-plugin-1-80-cross-site-scripting-xss-vulnerability?_s_id=cve