Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-1462 State: PUBLISHED Published: 2024-03-13T15:26:53.894Z Last Updated: 2024-08-01T18:40:21.196Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: themegrill Products: Maintenance Page Problem Types: CWE-284 Improper Access Control Description: The Maintenance Page plugin for WordPress is vulnerable to Basic Information Exposure in all versions up to, and including, 1.0.8 via the REST API. This makes it possible for unauthenticated attackers to view post titles and content when the site is in maintenance mode. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulner
yst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/653bf021-370d-4787-9ded-c5c915aed1d6?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3037664%40maintenance-page%2Ftrunk&old=1218033%40maintenance-page%2Ftrunk&sfp_email=&sfph_mail=
CVE ID: CVE-2024-1463 State: PUBLISHED Published: 2024-04-09T18:59:12.301Z Last Updated: 2024-08-01T18:40:21.218Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N) Vendors: thimpress Products: LearnPress – WordPress LMS Plugin Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Course, Lesson, and Quiz title and content in all versions up to, and including, 4.2.6.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with LP Instructo
sufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with LP Instructor-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/abb4b617-884b-4e72-812f-5f23a0976ab6?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3042945%40learnpress%2Ftags%2F4.2.6.3&new=3061851%40learnpress%2Ftags%2F4.2.6.4
CVE ID: CVE-2024-1464 State: PUBLISHED Published: 2024-04-09T18:59:01.486Z Last Updated: 2024-08-01T18:40:21.093Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: livemesh Products: Elementor Addons by Livemesh Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Elementor Addons by Livemesh plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘style’ attribute of the Posts Slider widget in all versions up to, and including, 8.3.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level acces
input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/7ce6e40e-b090-447a-9bf9-6337d30e7da3?source=cve - https://plugins.trac.wordpress.org/changeset/3048237/addons-for-elementor
CVE ID: CVE-2024-1465 State: PUBLISHED Published: 2024-04-09T18:59:07.035Z Last Updated: 2024-08-01T18:40:21.249Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: livemesh Products: Elementor Addons by Livemesh Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Elementor Addons by Livemesh plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘carousel_skin’ attribute of the Posts Carousel widget in all versions up to, and including, 8.3.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-l
ufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/96bdd465-e4ca-4a32-b38a-a2a51598a3a9?source=cve - https://plugins.trac.wordpress.org/changeset/3048237/addons-for-elementor
CVE ID: CVE-2024-1466 State: PUBLISHED Published: 2024-04-09T18:58:51.100Z Last Updated: 2024-08-01T18:40:21.142Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: livemesh Products: Elementor Addons by Livemesh Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Elementor Addons by Livemesh plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘slider_style’ attribute of the Posts Multislider widget in all versions up to, and including, 8.3.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor
nsufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. CVE-2024-27986 may be a duplicate of this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/604975b9-fe2f-4d8f-af13-995f08d72e8f?source=cve - https://plugins.trac.wordpress.org/changeset/3048237/addons-for-elementor
CVE ID: CVE-2024-1467 State: PUBLISHED Published: 2024-05-09T20:03:39.646Z Last Updated: 2024-08-01T18:40:21.081Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: brainstormforce Products: Starter Templates — Elementor, WordPress & Beaver Builder Templates Problem Types: CWE-918 Server-Side Request Forgery (SSRF) Description: The Starter Templates — Elementor, WordPress & Beaver Builder Templates plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 4.1.6 via the ai_api_request(). This makes it possible for authenticated attackers, with contributor-level access and above, to make web requests to arbitrary loca
it possible for authenticated attackers, with contributor-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/cf5075f9-9658-4a09-bd38-34a72f6560f4?source=cve - https://plugins.trac.wordpress.org/changeset/3074863/astra-sites/tags/4.1.7/inc/classes/class-astra-sites-importer.php - https://plugins.trac.wordpress.org/changeset/3074863/astra-sites/tags/4.1.7/inc/classes/class-astra-sites.php
CVE ID: CVE-2024-1468 State: PUBLISHED Published: 2024-02-29T03:30:29.778Z Last Updated: 2024-08-08T18:59:20.801Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: n/a Products: Avada | Website Builder For WordPress & WooCommerce Problem Types: CWE-434 Unrestricted Upload of File with Dangerous Type Description: The Avada | Website Builder For WordPress & WooCommerce theme for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the ajax_import_options() function in all versions up to, and including, 7.11.4. This makes it possible for authenticated attackers, with contributor-level access and above, to upload arbitrary files o
This makes it possible for authenticated attackers, with contributor-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/cde6e758-9723-43f2-9972-32be8aeb2b91?source=cve - https://avada.com/documentation/avada-changelog/
CVE ID: CVE-2024-1469 State: REJECTED Published: N/A Last Updated: 2024-06-17T14:22:19.214Z Description: No description available.
CVE ID: CVE-2024-1470 State: PUBLISHED Published: 2024-02-20T16:10:04.300Z Last Updated: 2024-08-01T18:40:21.195Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:N) Vendors: OpenText Products: NetIQ Client Login Extension Problem Types: CWE-639 Description: Authorization Bypass Through User-Controlled Key vulnerability in NetIQ (OpenText) Client Login Extension on Windows allows Privilege Escalation, Code Injection.This issue only affects NetIQ Client Login Extension: 4.6. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://portal.microfocus.com/s/article/KM000026667?language=en_US
CVE ID: CVE-2024-1471 State: PUBLISHED Published: 2024-02-14T21:39:59.570Z Last Updated: 2024-08-01T18:40:21.183Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: Tenable Products: Security Center Problem Types: CWE-20 Description: An HTML injection vulnerability exists where an authenticated, remote attacker with administrator privileges on the Security Center application could modify Repository parameters, which could lead to HTML redirection attacks. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.tenable.com/security/tns-2024-02
CVE ID: CVE-2024-1472 State: PUBLISHED Published: 2024-02-20T18:56:33.389Z Last Updated: 2024-08-01T18:40:21.086Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: florent73 Products: WP Maintenance Problem Types: CWE-284 Improper Access Control Description: The WP Maintenance plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 6.1.6 via the REST API. This makes it possible for unauthenticated attackers to bypass the plugin's maintenance mode obtain post and page content via REST API. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vuln
alyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/645328f3-2bcb-4287-952c-2e23ec57bb4e?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3035862%40wp-maintenance%2Ftrunk&old=3032356%40wp-maintenance%2Ftrunk&sfp_email=&sfph_mail=#file4
CVE ID: CVE-2024-1473 State: PUBLISHED Published: 2024-03-20T06:48:24.765Z Last Updated: 2024-08-02T16:21:23.930Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: colorlibplugins Products: Coming Soon & Maintenance Mode by Colorlib Problem Types: CWE-284 Improper Access Control Description: The Coming Soon & Maintenance Mode by Colorlib plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.0.99 via the REST API. This makes it possible for unauthenticated attackers to obtain post and page contents via REST API thus bypassing maintenance mode protection provided by the plugin. Additional Analyst Notes: - CVE Program
via REST API thus bypassing maintenance mode protection provided by the plugin. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/48dc10a9-7bb9-401f-befd-1bf620858825?source=cve - https://wordpress.org/plugins/colorlib-coming-soon-maintenance/
CVE ID: CVE-2024-1474 State: PUBLISHED Published: 2024-02-21T15:33:20.265Z Last Updated: 2024-08-01T18:40:21.196Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Progress Software Coproration Products: WS_FTP Server Problem Types: CWE-79 Description: In WS_FTP Server versions before 8.8.5, reflected cross-site scripting issues have been identified on various user supplied inputs on the WS_FTP Server administrative interface. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.progress.com/ws_ftp - https://community.progress.com/s/article/WS-FTP-Server-Service-Pack-February-2024
CVE ID: CVE-2024-1475 State: PUBLISHED Published: 2024-02-20T18:56:29.088Z Last Updated: 2024-08-01T18:40:21.203Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: awordpresslife Products: Coming Soon Maintenance Mode Problem Types: CWE-284 Improper Access Control Description: The Coming Soon Maintenance Mode plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.0.5 via the REST API. This makes it possible for unauthenticated attackers to obtain post and page content thus bypassing the protection provided by the plugin. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References:
otection provided by the plugin. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/44e4a1a3-71d0-4cad-9807-f6bbc99ccb13?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3037910%40coming-soon-maintenance-mode%2Ftrunk&old=3031487%40coming-soon-maintenance-mode%2Ftrunk&sfp_email=&sfph_mail=
CVE ID: CVE-2024-1476 State: PUBLISHED Published: 2024-02-28T08:33:14.049Z Last Updated: 2024-08-09T20:53:13.721Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: acurax Products: Under Construction / Maintenance Mode from Acurax Problem Types: CWE-284 Improper Access Control Description: The Under Construction / Maintenance Mode from Acurax plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.6 via the REST API. This makes it possible for unauthenticated attackers to obtain the contents of posts and pages when maintenance mode is active thus bypassing the protection provided by the plugin. Additional An
s of posts and pages when maintenance mode is active thus bypassing the protection provided by the plugin. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/f28c47e6-a37d-4328-afb2-6a9e6b3fe20a?source=cve - https://wordpress.org/plugins/coming-soon-maintenance-mode-from-acurax/
CVE ID: CVE-2024-1477 State: PUBLISHED Published: 2024-03-20T06:48:23.706Z Last Updated: 2024-08-05T19:31:59.559Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: aankit Products: Easy Maintenance Mode Problem Types: CWE-200 Information Exposure Description: The Easy Maintenance Mode plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.4.2 via the REST API. This makes it possible for authenticated attackers to obtain post and page content via REST API thus bypassign the protection provided by the plugin. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www
ded by the plugin. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/1a12f472-0ae1-4c3c-b7e3-85f637fe58c5?source=cve - https://wordpress.org/plugins/easy-maintenance-mode-coming-soon/
CVE ID: CVE-2024-1478 State: PUBLISHED Published: 2024-03-05T01:55:58.867Z Last Updated: 2024-08-11T13:49:22.393Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: helderk Products: Maintenance Mode Problem Types: CWE-284 Improper Access Control Description: The Maintenance Mode plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.5.0 via the REST API. This makes it possible for unauthenticated attackers to obtain post and page content via API thus bypassing the content protection provided by the plugin. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.
ed by the plugin. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/36def628-e09e-4da0-ab14-35aefcb67f73?source=cve - https://wordpress.org/plugins/hkdev-maintenance-mode/
CVE ID: CVE-2024-1479 State: PUBLISHED Published: 2024-03-13T15:26:54.886Z Last Updated: 2025-04-15T15:21:58.589Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: edge22 Products: WP Show Posts Problem Types: CWE-863 Incorrect Authorization Description: The WP Show Posts plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.1.4 via the wpsp_display function. This makes it possible for authenticated attackers with contributor access and above to view the contents of draft, trash, future, private and pending posts and pages. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: Referen
private and pending posts and pages. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/6788e2ee-ce61-494b-8d7f-6d1144466e58?source=cve - https://plugins.trac.wordpress.org/browser/wp-show-posts/trunk/wp-show-posts.php#L224 - https://plugins.trac.wordpress.org/browser/wp-show-posts/trunk/wp-show-posts.php#L591 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3041416%40wp-show-posts%2Ftrunk&old=2846296%40wp-show-posts%2Ftrunk&sfp_email=&sfph_mail=
CVE ID: CVE-2024-1480 State: PUBLISHED Published: 2024-04-19T21:19:27.592Z Last Updated: 2024-08-01T18:40:21.234Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Unitronics Products: Vision230, Vision280, Vision290, Vision530, Vision120 Problem Types: CWE-257 Description: Unitronics Vision Standard line of controllers allow the Information Mode password to be retrieved without authentication. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-24-109-01 - https://www.dragos.com/advisory/unitronics-vision-standard/
CVE ID: CVE-2024-1481 State: PUBLISHED Published: 2024-04-10T20:39:31.175Z Last Updated: 2025-11-06T21:48:38.355Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: Red Hat Products: Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 7 Problem Types: CWE-20 Description: A flaw was found in FreeIPA. This issue may allow a remote attacker to craft a HTTP request with parameters that can be interpreted as command arguments to kinit on the FreeIPA server, which can lead to a denial of service. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2024:2147 - http
: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2024:2147 - https://access.redhat.com/errata/RHSA-2024:3044 - https://access.redhat.com/security/cve/CVE-2024-1481 - https://bugzilla.redhat.com/show_bug.cgi?id=2262169
CVE ID: CVE-2024-1482 State: PUBLISHED Published: 2024-02-14T20:04:47.981Z Last Updated: 2024-08-01T18:40:21.100Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N) Vendors: GitHub Products: Enterprise Server Problem Types: CWE-863 Description: An incorrect authorization vulnerability was identified in GitHub Enterprise Server that allowed an attacker to create new branches in public repositories and run arbitrary GitHub Actions workflows with permissions from the GITHUB_TOKEN. To exploit this vulnerability, an attacker would need access to the Enterprise Server. This vulnerability affected all versions of GitHub Enterprise Server after 3.8 and prior to 3.12, and was fixe
e Server. This vulnerability affected all versions of GitHub Enterprise Server after 3.8 and prior to 3.12, and was fixed in versions 3.9.10, 3.10.7, 3.11.5. This vulnerability was reported via the GitHub Bug Bounty program. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://docs.github.com/en/enterprise-server@3.9/admin/release-notes#3.9.10 - https://docs.github.com/en/enterprise-server@3.10/admin/release-notes#3.10.7 - https://docs.github.com/en/enterprise-server@3.11/admin/release-notes#3.11.5
CVE ID: CVE-2024-1483 State: PUBLISHED Published: 2024-04-16T00:00:14.064Z Last Updated: 2024-08-01T18:40:21.239Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: mlflow Products: mlflow/mlflow Problem Types: CWE-22 Description: A path traversal vulnerability exists in mlflow/mlflow version 2.9.2, allowing attackers to access arbitrary files on the server. By crafting a series of HTTP POST requests with specially crafted 'artifact_location' and 'source' parameters, using a local URI with '#' instead of '?', an attacker can traverse the server's directory structure. The issue occurs due to insufficient validation of user-supplied input in the server's handlers.
s directory structure. The issue occurs due to insufficient validation of user-supplied input in the server's handlers. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://huntr.com/bounties/52a3855d-93ff-4460-ac24-9c7e4334198d
CVE ID: CVE-2024-1484 State: PUBLISHED Published: 2024-03-13T15:26:44.753Z Last Updated: 2024-08-01T18:40:21.188Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: ameliabooking Products: Booking for Appointments and Events Calendar – Amelia Problem Types: CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) Description: The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the date parameters in all versions up to, and including, 1.0.98 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to i
98 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/3a849ef2-ad0a-45ea-8827-9a7233b1ca30?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3041769%40ameliabooking%2Ftrunk&old=3037721%40ameliabooking%2Ftrunk&sfp_email=&sfph_mail=
CVE ID: CVE-2024-1485 State: PUBLISHED Published: 2024-02-13T23:31:14.427Z Last Updated: 2025-11-20T07:11:37.793Z Severity: HIGH (CVSS 8 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:H/A:H) Vendors: Red Hat Products: OpenShift Developer Tools and Services, Red Hat OpenShift Container Platform 4 Problem Types: CWE-23 Description: A flaw was found in the decompression function of registry-support. This issue can be triggered if an unauthenticated remote attacker tricks a user into parsing a devfile which uses the `parent` or `plugin` keywords. This could download a malicious archive and cause the cleanup process to overwrite or delete files outside of the archive, which should not be allowed. Additio