Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
e, if the user has already given permission for Cursor to do so. In version 0.41.0, the entitlements have been split by process: the main process gets the camera and microphone entitlements, but not the DyLib entitlements, whereas the extension host process gets the DyLib entitlements but not the camera or microphone entitlements. As a workaround, do not explicitly give Cursor the permission to access the camera or microphone if untrusted users can run arbitrary commands on the affected machine. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/getcursor/cursor/security/advisories/GHSA-x352-xv29-r74m
CVE ID: CVE-2024-45600 State: PUBLISHED Published: 2024-12-26T21:27:01.168Z Last Updated: 2024-12-30T14:53:26.436Z Severity: HIGH (CVSS 7.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) Vendors: pluginsGLPI Products: fields Problem Types: CWE-89 Description: Fields is a GLPI plugin that allows users to add custom fields on GLPI items forms. Prior to 1.21.13, an authenticated user can perform a SQL injection when the plugin is active. The vulnerability is fixed in 1.21.13. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/pluginsGLPI/fields/security/advisories/GHSA-wwxw-64g6-2992 - https://github.com/pluginsGLPI/fields/commit/eb927b0f084ee4ef6c87ab2eb7a15e993
security/advisories/GHSA-wwxw-64g6-2992 - https://github.com/pluginsGLPI/fields/commit/eb927b0f084ee4ef6c87ab2eb7a15e99369e74ae#diff-a7024a397fba9a026157683da73cc675ec6b73bd900374b3836bcdc76ec7bd5cR1166
CVE ID: CVE-2024-45601 State: PUBLISHED Published: 2024-09-18T17:49:58.158Z Last Updated: 2024-09-18T18:42:23.239Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: google Products: mesop Problem Types: CWE-22, CWE-20 Description: Mesop is a Python-based UI framework designed for rapid web apps development. A vulnerability has been discovered and fixed in Mesop that could potentially allow unauthorized access to files on the server hosting the Mesop application. The vulnerability was related to insufficient input validation in a specific endpoint. This could have allowed an attacker to access files not intended to be served. Users are strongly advised to update
nt. This could have allowed an attacker to access files not intended to be served. Users are strongly advised to update to the latest version of Mesop immediately. The latest version includes a fix for this vulnerability. At time of publication 0.12.4 is the most recently available version of Mesop. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/google/mesop/security/advisories/GHSA-pmv9-3xqp-8w42 - https://github.com/google/mesop/commit/17fb769d6a91f0a8cbccfab18f64977b158a6a31
CVE ID: CVE-2024-45604 State: PUBLISHED Published: 2024-09-17T19:56:02.588Z Last Updated: 2024-09-18T13:09:48.444Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: contao Products: contao Problem Types: CWE-22 Description: Contao is an Open Source CMS. In affected versions authenticated users in the back end can list files outside the document root in the file selector widget. Users are advised to update to Contao 4.13.49. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/contao/contao/security/advisories/GHSA-4p75-5p53-65m9 - https://contao.org/en/security-advisories/dir
https://github.com/contao/contao/security/advisories/GHSA-4p75-5p53-65m9 - https://contao.org/en/security-advisories/directory-traversal-in-the-fileselector-widget
CVE ID: CVE-2024-45605 State: PUBLISHED Published: 2024-09-17T19:44:50.664Z Last Updated: 2024-09-18T13:19:27.312Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) Vendors: getsentry Products: sentry Problem Types: CWE-639 Description: Sentry is a developer-first error tracking and performance monitoring platform. An authenticated user delete the user issue alert notifications for arbitrary users given a know alert ID. A patch was issued to ensure authorization checks are properly scoped on requests to delete user alert notifications. Sentry SaaS users do not need to take any action. Self-Hosted Sentry users should upgrade to version 24.9.0 or higher. There are no kno
rs do not need to take any action. Self-Hosted Sentry users should upgrade to version 24.9.0 or higher. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/getsentry/sentry/security/advisories/GHSA-54m3-95j9-v89j - https://github.com/getsentry/sentry/pull/77093 - https://github.com/getsentry/self-hosted
CVE ID: CVE-2024-45606 State: PUBLISHED Published: 2024-09-17T19:43:18.650Z Last Updated: 2024-09-18T13:20:30.270Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N) Vendors: getsentry Products: sentry Problem Types: CWE-639 Description: Sentry is a developer-first error tracking and performance monitoring platform. An authenticated user can mute alert rules from arbitrary organizations and projects with a know rule ID. The user does not need to be a member of the organization or have permissions on the project. In our review, we have identified no instances where alerts have been muted by unauthorized parties. A patch was issued to ensure authorization checks are properl
nces where alerts have been muted by unauthorized parties. A patch was issued to ensure authorization checks are properly scoped on requests to mute alert rules. Authenticated users who do not have the necessary permissions are no longer able to mute alerts. Sentry SaaS users do not need to take any action. Self-Hosted Sentry users should upgrade to version **24.9.0** or higher. The rule mute feature was generally available as of 23.6.0 but users with early access may have had the feature as of 23.4.0. Affected users are advised to upgrade to version 24.9.0. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.
own workarounds for this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/getsentry/sentry/security/advisories/GHSA-v345-w9f2-mpm5 - https://github.com/getsentry/sentry/pull/77016 - https://github.com/getsentry/self-hosted
CVE ID: CVE-2024-45607 State: PUBLISHED Published: 2024-09-12T19:58:13.803Z Last Updated: 2024-09-12T20:04:46.581Z Severity: MEDIUM (CVSS 5.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N) Vendors: Secreto31126 Products: whatsapp-api-js Problem Types: CWE-347 Description: whatsapp-api-js is a TypeScript server agnostic Whatsapp's Official API framework. It's possible to check the payload validation using the WhatsAppAPI.verifyRequestSignature and expect false when the signature is valid. Incorrect Access Control, anyone using the post or verifyRequestSignature methods to handle messages is impacted. This vulnerability is fixed in 4.0.3. Additional Analyst Notes: - CISA ADP Vulnrichment: Refer
dle messages is impacted. This vulnerability is fixed in 4.0.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Secreto31126/whatsapp-api-js/security/advisories/GHSA-mwhf-vhr5-7j23 - https://github.com/Secreto31126/whatsapp-api-js/pull/371 - https://github.com/Secreto31126/whatsapp-api-js/commit/56620c65126427496a94d176082fbd8393a95b6d
CVE ID: CVE-2024-45608 State: PUBLISHED Published: 2024-11-15T18:24:48.240Z Last Updated: 2024-11-15T18:40:55.776Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: glpi-project Products: glpi Problem Types: CWE-89 Description: GLPI is a free asset and IT management software package. An authenticated user can perfom a SQL injection by changing its preferences. Upgrade to 10.0.17. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/glpi-project/glpi/security/advisories/GHSA-67p8-v79j-jp86
CVE ID: CVE-2024-45609 State: PUBLISHED Published: 2024-11-15T20:02:33.302Z Last Updated: 2024-11-15T21:11:16.977Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) Vendors: glpi-project Products: glpi Problem Types: CWE-79 Description: GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. An unauthenticated user can provide a malicious link to a GLPI technician in order to exploit a reflected XSS vulnerability located in the reports pages. Upgrade to 10.0.17. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/glpi-project/glpi/security/advisories/GHS
ional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/glpi-project/glpi/security/advisories/GHSA-3j2f-3j4v-hppr
CVE ID: CVE-2024-45610 State: PUBLISHED Published: 2024-11-15T20:14:33.893Z Last Updated: 2024-11-15T21:10:37.523Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) Vendors: glpi-project Products: glpi Problem Types: CWE-79 Description: GLPI is an open-source asset and IT management software package that provides ITIL Service Desk features, licenses tracking and software auditing. An unauthenticated user can provide a malicious link to a GLPI technician in order to exploit a reflected XSS vulnerability located in the Cable form. Upgrade to 10.0.17. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/glpi-project/glpi/security/advisories/
ditional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/glpi-project/glpi/security/advisories/GHSA-vvr8-chwj-9m4c
CVE ID: CVE-2024-45611 State: PUBLISHED Published: 2024-11-15T20:16:18.459Z Last Updated: 2024-11-19T14:13:31.675Z Severity: MEDIUM (CVSS 5.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N) Vendors: glpi-project Products: glpi Problem Types: CWE-79 Description: GLPI is an open-source asset and IT management software package that provides ITIL Service Desk features, licenses tracking and software auditing. An authenticated user can bypass the access control policy to create a private RSS feed attached to another user account and use a malicious payload to triggger a stored XSS. Upgrade to 10.0.17. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/glpi-project/g
. Upgrade to 10.0.17. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/glpi-project/glpi/security/advisories/GHSA-j73h-x6j3-m479
CVE ID: CVE-2024-45612 State: PUBLISHED Published: 2024-09-17T18:29:27.210Z Last Updated: 2024-09-18T14:09:48.584Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: contao Products: contao Problem Types: CWE-20 Description: Contao is an Open Source CMS. In affected versions an untrusted user can inject insert tags into the canonical tag, which are then replaced on the web page (front end). Users are advised to update to Contao 4.13.49, 5.3.15 or 5.4.3. Users unable to upgrade should disable canonical tags in the root page settings. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/contao/contao/security/advisories/GHSA-2xpq-xp
Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/contao/contao/security/advisories/GHSA-2xpq-xp6c-5mgj - https://contao.org/en/security-advisories/insert-tag-injection-via-canonical-urls
CVE ID: CVE-2024-45613 State: PUBLISHED Published: 2024-09-25T13:27:03.546Z Last Updated: 2024-10-01T21:20:44.633Z Vendors: ckeditor Products: ckeditor5 Problem Types: CWE-79 Description: CKEditor 5 is a JavaScript rich-text editor. Starting in version 40.0.0 and prior to version 43.1.1, a Cross-Site Scripting (XSS) vulnerability is present in the CKEditor 5 clipboard package. This vulnerability could be triggered by a specific user action, leading to unauthorized JavaScript code execution, if the attacker managed to insert a malicious content into the editor, which might happen with a very specific editor configuration. This vulnerability only affects installations where the Block Toolbar p
appen with a very specific editor configuration. This vulnerability only affects installations where the Block Toolbar plugin is enabled and either the General HTML Support (with a configuration that permits unsafe markup) or the HTML Embed plugin is also enabled. A fix for the problem is available in version 43.1.1. As a workaround, one may disable the block toolbar plugin. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/ckeditor/ckeditor5/security/advisories/GHSA-rgg8-g5x8-wr9v - https://github.com/ckeditor/ckeditor5/releases/tag/v43.1.1
CVE ID: CVE-2024-45614 State: PUBLISHED Published: 2024-09-19T22:42:33.974Z Last Updated: 2025-11-03T22:15:51.621Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N) Vendors: puma Products: puma Problem Types: CWE-639 Description: Puma is a Ruby/Rack web server built for parallelism. In affected versions clients could clobber values set by intermediate proxies (such as X-Forwarded-For) by providing a underscore version of the same header (X-Forwarded_For). Any users relying on proxy set variables is affected. v6.4.3/v5.6.9 now discards any headers using underscores if the non-underscore version also exists. Effectively, allowing the proxy defined headers to always win.
g underscores if the non-underscore version also exists. Effectively, allowing the proxy defined headers to always win. Users are advised to upgrade. Nginx has a underscores_in_headers configuration variable to discard these headers at the proxy level as a mitigation. Any users that are implicitly trusting the proxy defined headers for security should immediately cease doing so until upgraded to the fixed versions. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/puma/puma/security/advisories/GHSA-9hf4-67fc-4vf4 - https://nginx.org/en/docs/http/ngx_http_core_module.html#underscores_in_headers
CVE ID: CVE-2024-45615 State: PUBLISHED Published: 2024-09-03T21:19:51.000Z Last Updated: 2025-11-07T00:29:37.676Z Severity: LOW (CVSS 3.9 CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: Red Hat Products: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9 Problem Types: CWE-457 Description: A vulnerability was found in OpenSC, OpenSC tools, PKCS#11 module, minidriver, and CTK. The problem is missing initialization of variables expected to be initialized (as arguments to other functions, etc.). Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://access.redhat.com/security/cve/CVE-
alyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://access.redhat.com/security/cve/CVE-2024-45615 - https://bugzilla.redhat.com/show_bug.cgi?id=2309285
CVE ID: CVE-2024-45616 State: PUBLISHED Published: 2024-09-03T21:20:22.459Z Last Updated: 2025-11-07T00:29:40.250Z Severity: LOW (CVSS 3.9 CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: Red Hat Products: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9 Problem Types: CWE-457 Description: A vulnerability was found in OpenSC, OpenSC tools, PKCS#11 module, minidriver, and CTK. An attacker could use a crafted USB Device or Smart Card, which would present the system with a specially crafted response to APDUs. The following problems were caused by insufficient control of the response APDU buffer and its length when communicatin
The following problems were caused by insufficient control of the response APDU buffer and its length when communicating with the card. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://access.redhat.com/security/cve/CVE-2024-45616 - https://bugzilla.redhat.com/show_bug.cgi?id=2309290
CVE ID: CVE-2024-45617 State: PUBLISHED Published: 2024-09-03T21:20:53.782Z Last Updated: 2025-11-07T00:29:43.651Z Severity: LOW (CVSS 3.9 CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: Red Hat Products: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9 Problem Types: CWE-457 Description: A vulnerability was found in OpenSC, OpenSC tools, PKCS#11 module, minidriver, and CTK. An attacker could use a crafted USB Device or Smart Card, which would present the system with a specially crafted response to APDUs. Insufficient or missing checking of return values of functions leads to unexpected work with variables that have not be
Insufficient or missing checking of return values of functions leads to unexpected work with variables that have not been initialized. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://access.redhat.com/security/cve/CVE-2024-45617 - https://bugzilla.redhat.com/show_bug.cgi?id=2309286
CVE ID: CVE-2024-45618 State: PUBLISHED Published: 2024-09-03T21:21:25.869Z Last Updated: 2025-11-07T00:29:40.117Z Severity: LOW (CVSS 3.9 CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: Red Hat Products: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9 Problem Types: CWE-457 Description: A vulnerability was found in pkcs15-init in OpenSC. An attacker could use a crafted USB Device or Smart Card, which would present the system with a specially crafted response to APDUs. Insufficient or missing checking of return values of functions leads to unexpected work with variables that have not been initialized. Additional Analyst N
return values of functions leads to unexpected work with variables that have not been initialized. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://access.redhat.com/security/cve/CVE-2024-45618 - https://bugzilla.redhat.com/show_bug.cgi?id=2309287
CVE ID: CVE-2024-45619 State: PUBLISHED Published: 2024-09-03T21:21:39.080Z Last Updated: 2025-11-07T00:29:48.516Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: Red Hat Products: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9 Problem Types: CWE-120 Description: A vulnerability was found in OpenSC, OpenSC tools, PKCS#11 module, minidriver, and CTK. An attacker could use a crafted USB Device or Smart Card, which would present the system with a specially crafted response to APDUs. When buffers are partially filled with data, initialized parts of the buffer can be incorrectly accessed. Additional
Us. When buffers are partially filled with data, initialized parts of the buffer can be incorrectly accessed. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://access.redhat.com/security/cve/CVE-2024-45619 - https://bugzilla.redhat.com/show_bug.cgi?id=2309288
CVE ID: CVE-2024-45620 State: PUBLISHED Published: 2024-09-03T21:21:57.892Z Last Updated: 2025-11-07T00:29:53.044Z Severity: LOW (CVSS 3.9 CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: Red Hat Products: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9 Problem Types: CWE-120 Description: A vulnerability was found in the pkcs15-init tool in OpenSC. An attacker could use a crafted USB Device or Smart Card, which would present the system with a specially crafted response to APDUs. When buffers are partially filled with data, initialized parts of the buffer can be incorrectly accessed. Additional Analyst Notes: - CISA ADP Vul
filled with data, initialized parts of the buffer can be incorrectly accessed. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://access.redhat.com/security/cve/CVE-2024-45620 - https://bugzilla.redhat.com/show_bug.cgi?id=2309289
CVE ID: CVE-2024-45621 State: PUBLISHED Published: 2024-09-02T00:00:00.000Z Last Updated: 2025-03-13T20:22:43.986Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Electron desktop application of Rocket.Chat through 6.3.4 allows stored XSS via links in an uploaded file, related to failure to use a separate browser upon encountering third-party external actions from PDF documents. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://hackerone.com/reports/1967109 - https://github.com/RocketChat/Rocket.Chat/releases/tag/6.3.4
CVE ID: CVE-2024-45622 State: PUBLISHED Published: 2024-09-02T00:00:00 Last Updated: 2024-09-03T15:17:21.055Z Vendors: n/a Products: n/a Problem Types: n/a Description: ASIS (aka Aplikasi Sistem Sekolah using CodeIgniter 3) 3.0.0 through 3.2.0 allows index.php username SQL injection for Authentication Bypass. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/atoz-chevara/cve/blob/main/2024/ASIS_AplikasiSistemSekolah_Using_CodeIgniter3-SQL_Injection_Authentication_Bypass.md
CVE ID: CVE-2024-45623 State: PUBLISHED Published: 2024-09-02T00:00:00 Last Updated: 2024-09-03T14:50:09.815Z Vendors: n/a Products: n/a Problem Types: n/a Description: D-Link DAP-2310 Hardware A Firmware 1.16RC028 allows remote attackers to execute arbitrary code via a stack-based buffer overflow in the ATP binary that handles PHP HTTP GET requests for the Apache HTTP Server (httpd). NOTE: This vulnerability only affects products that are no longer supported by the maintainer. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10406
CVE ID: CVE-2024-45624 State: PUBLISHED Published: 2024-09-12T04:33:40.437Z Last Updated: 2025-11-03T22:16:02.168Z Vendors: PgPool Global Development Group Products: Pgpool-II Problem Types: Exposure of Sensitive Information Due to Incompatible Policies Description: Exposure of sensitive information due to incompatible policies issue exists in Pgpool-II. If a database user accesses a query cache, table data unauthorized for the user may be retrieved. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.pgpool.net/mediawiki/index.php/Main_Page#News - https://jvn.jp/en/jp/JVN67456481/
CVE ID: CVE-2024-45625 State: PUBLISHED Published: 2024-09-09T04:44:54.663Z Last Updated: 2025-03-26T20:02:44.348Z Vendors: WPMU DEV Products: Forminator Problem Types: Cross-site scripting (XSS) Description: Cross-site scripting vulnerability exists in Forminator versions prior to 1.34.1. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who follows a crafted URL and accesses the webpage with the web form created by Forminator. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wordpress.org/plugins/forminator/ - https://plugins.trac.wordpress.org/changeset?new=3135507%40forminator%2Ftrunk%2Fassets%2Fjs%2Ffront%2Ffro
/forminator/ - https://plugins.trac.wordpress.org/changeset?new=3135507%40forminator%2Ftrunk%2Fassets%2Fjs%2Ffront%2Ffront.mergetags.js&old=3111152%40forminator%2Ftrunk%2Fassets%2Fjs%2Ffront%2Ffront.mergetags.js - https://wpmudev.com/ - https://jvn.jp/en/jp/JVN65724976/
CVE ID: CVE-2024-45626 State: PUBLISHED Published: 2025-02-06T11:21:12.417Z Last Updated: 2025-02-12T19:51:10.343Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: Apache Software Foundation Products: Apache James server Problem Types: CWE-400 Description: Apache James server JMAP HTML to text plain implementation in versions below 3.8.2 and 3.7.6 is subject to unbounded memory consumption that can result in a denial of service. Users are recommended to upgrade to version 3.7.6 and 3.8.2, which fix this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://lists.apache.org/thread/1fr9hvpsylomwwfr3rv82g84sxszn
Program Container: - CISA ADP Vulnrichment: References: - https://lists.apache.org/thread/1fr9hvpsylomwwfr3rv82g84sxszn4kl