Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-3173 State: PUBLISHED Published: 2024-07-16T22:14:03.372Z Last Updated: 2024-08-01T20:05:07.040Z Vendors: Google Products: Chrome Problem Types: Insufficient data validation Description: Insufficient data validation in Updater in Google Chrome prior to 120.0.6099.62 allowed a remote attacker to perform OS-level privilege escalation via a malicious file. (Chromium security severity: High) Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://chromereleases.googleblog.com/2023/12/stable-channel-update-for-desktop.html - https://issues.chromium.org/issues/40075849
CVE ID: CVE-2024-3174 State: PUBLISHED Published: 2024-07-16T22:14:03.618Z Last Updated: 2025-03-20T14:40:52.636Z Vendors: Google Products: Chrome Problem Types: Inappropriate implementation Description: Inappropriate implementation in V8 in Google Chrome prior to 119.0.6045.105 allowed a remote attacker to potentially exploit object corruption via a crafted HTML page. (Chromium security severity: High) Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://chromereleases.googleblog.com/2023/10/stable-channel-update-for-desktop_31.html - https://issues.chromium.org/issues/40073339
CVE ID: CVE-2024-3175 State: PUBLISHED Published: 2024-07-16T22:14:03.875Z Last Updated: 2024-08-01T20:05:07.500Z Vendors: Google Products: Chrome Problem Types: Insufficient data validation Description: Insufficient data validation in Extensions in Google Chrome prior to 120.0.6099.62 allowed a remote attacker to perform privilege escalation via a crafted Chrome Extension. (Chromium security severity: Low) Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://chromereleases.googleblog.com/2023/12/stable-channel-update-for-desktop.html - https://issues.chromium.org/issues/40069571
CVE ID: CVE-2024-3176 State: PUBLISHED Published: 2024-07-16T22:30:27.489Z Last Updated: 2025-03-17T17:53:10.945Z Vendors: Google Products: Chrome Problem Types: Out of bounds write Description: Out of bounds write in SwiftShader in Google Chrome prior to 117.0.5938.62 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: High) Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop_12.html - https://issues.chromium.org/issues/40061476
CVE ID: CVE-2024-3177 State: PUBLISHED Published: 2024-04-22T23:00:39.702Z Last Updated: 2024-09-10T20:48:09.780Z Severity: LOW (CVSS 2.7 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N) Vendors: Kubernetes Products: Kubernetes Problem Types: CWE-20 Description: A security issue was discovered in Kubernetes where users may be able to launch containers that bypass the mountable secrets policy enforced by the ServiceAccount admission plugin when using containers, init containers, and ephemeral containers with the envFrom field populated. The policy ensures pods running with a service account may only reference secrets specified in the service account’s secrets field. Kubernetes clusters are only
rvice account may only reference secrets specified in the service account’s secrets field. Kubernetes clusters are only affected if the ServiceAccount admission plugin and the kubernetes.io/enforce-mountable-secrets annotation are used together with containers, init containers, and ephemeral containers with the envFrom field populated. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://groups.google.com/g/kubernetes-security-announce/c/JxjHf7fkVd8/m/oVCzypyOAQAJ - https://github.com/kubernetes/kubernetes/issues/124336
CVE ID: CVE-2024-3178 State: PUBLISHED Published: 2024-04-03T18:31:42.467Z Last Updated: 2024-08-30T21:19:41.699Z Severity: LOW (CVSS 3.1 CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:L/A:L) Vendors: Concrete CMS Products: Concrete CMS Problem Types: CWE-79 Description: Concrete CMS versions 9 below 9.2.8 and versions below 8.5.16 are vulnerable to Cross-site Scripting (XSS) in the Advanced File Search Filter. Prior to the fix, a rogue administrator could add malicious code in the file manager because of insufficient validation of administrator provided data. All administrators have access to the File Manager and hence could create a search filter with the malicious code attached. The Concrete CMS
ve access to the File Manager and hence could create a search filter with the malicious code attached. The Concrete CMS security team gave this vulnerability a CVSS v3.1 score of 3.1 with a vector of AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:L/A:L https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator . Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://documentation.concretecms.org/developers/introduction/version-history/8516-release-notes?_gl=1*1oa3zn1*_ga*MTc1NDc0Njk2Mi4xNzA2ODI4MDU1*_ga_HFB3HPNNLS*MTcxMjE2NjYyNi4xMy4xLjE3MTIxNjY3MDcuMC4wLjA. - https://documentation.concretecms.org/9-x/developers/introduction/version-history/928-release-notes?_gl=1*1bcxp5s
LjA. - https://documentation.concretecms.org/9-x/developers/introduction/version-history/928-release-notes?_gl=1*1bcxp5s*_ga*MTc1NDc0Njk2Mi4xNzA2ODI4MDU1*_ga_HFB3HPNNLS*MTcxMjE2NjYyNi4xMy4xLjE3MTIxNjY2ODEuMC4wLjA.
CVE ID: CVE-2024-3179 State: PUBLISHED Published: 2024-04-03T18:50:45.711Z Last Updated: 2024-08-30T21:18:39.995Z Severity: LOW (CVSS 3.1 CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:L/A:L) Vendors: Concrete CMS Products: Concrete CMS Problem Types: CWE-79 Description: Concrete CMS version 9 before 9.2.8 and previous versions before 8.5.16 are vulnerable to Stored XSS in the Custom Class page editing. Prior to the fix, a rogue administrator could insert malicious code in the custom class field due to insufficient validation of administrator provided data. The Concrete CMS security team gave this vulnerability a CVSS v3.1 score of 3.1 with a vector of AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:L/A:L https://nvd
y team gave this vulnerability a CVSS v3.1 score of 3.1 with a vector of AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:L/A:L https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator . Thanks Alexey Solovyev for reporting. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://documentation.concretecms.org/developers/introduction/version-history/8516-release-notes?_gl=1*1oa3zn1*_ga*MTc1NDc0Njk2Mi4xNzA2ODI4MDU1*_ga_HFB3HPNNLS*MTcxMjE2NjYyNi4xMy4xLjE3MTIxNjY3MDcuMC4wLjA. - https://documentation.concretecms.org/9-x/developers/introduction/version-history/928-release-notes?_gl=1*1bcxp5s*_ga*MTc1NDc0Njk2Mi4xNzA2ODI4MDU1*_ga_HFB3HPNNLS*MTcxMjE2NjYyNi4xMy4xLjE3MTIxNjY2ODEuMC4w
928-release-notes?_gl=1*1bcxp5s*_ga*MTc1NDc0Njk2Mi4xNzA2ODI4MDU1*_ga_HFB3HPNNLS*MTcxMjE2NjYyNi4xMy4xLjE3MTIxNjY2ODEuMC4wLjA.
CVE ID: CVE-2024-3180 State: PUBLISHED Published: 2024-04-03T19:00:02.642Z Last Updated: 2024-08-30T21:18:06.229Z Severity: LOW (CVSS 3.1 CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:L/A:L) Vendors: Concrete CMS Products: Concrete CMS Problem Types: CWE-79 Description: Concrete CMS version 9 below 9.2.8 and previous versions below 8.5.16 is vulnerable to Stored XSS in blocks of type file. Stored XSS could be caused by a rogue administrator adding malicious code to the link-text field when creating a block of type file. The Concrete CMS security team gave this vulnerability a CVSS v3.1 score of 3.1 with a vector of AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:L/A:L https://nvd.nist.gov/vuln-metrics/cvss/v3-calcul
v3.1 score of 3.1 with a vector of AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:L/A:L https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator . Thanks Alexey Solovyev for reporting. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://documentation.concretecms.org/developers/introduction/version-history/8516-release-notes?_gl=1*1oa3zn1*_ga*MTc1NDc0Njk2Mi4xNzA2ODI4MDU1*_ga_HFB3HPNNLS*MTcxMjE2NjYyNi4xMy4xLjE3MTIxNjY3MDcuMC4wLjA. - https://documentation.concretecms.org/9-x/developers/introduction/version-history/928-release-notes?_gl=1*1bcxp5s*_ga*MTc1NDc0Njk2Mi4xNzA2ODI4MDU1*_ga_HFB3HPNNLS*MTcxMjE2NjYyNi4xMy4xLjE3MTIxNjY2ODEuMC4wLjA.
CVE ID: CVE-2024-3181 State: PUBLISHED Published: 2024-04-03T19:09:44.345Z Last Updated: 2024-08-30T21:17:27.290Z Severity: LOW (CVSS 3.1 CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:L/A:L) Vendors: Concrete CMS Products: Concrete CMS Problem Types: CWE-79 Description: Concrete CMS version 9 prior to 9.2.8 and previous versions prior to 8.5.16 are vulnerable to Stored XSS in the Search Field. Prior to the fix, stored XSS could be executed by an administrator changing a filter to which a rogue administrator had previously added malicious code. The Concrete CMS security team gave this vulnerability a CVSS v3.1 score of 3.1 with a vector of AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:L/A:L https://nvd.nist.gov/vul
his vulnerability a CVSS v3.1 score of 3.1 with a vector of AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:L/A:L https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator . Thanks Alexey Solovyev for reporting Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://documentation.concretecms.org/developers/introduction/version-history/8516-release-notes?_gl=1*1oa3zn1*_ga*MTc1NDc0Njk2Mi4xNzA2ODI4MDU1*_ga_HFB3HPNNLS*MTcxMjE2NjYyNi4xMy4xLjE3MTIxNjY3MDcuMC4wLjA. - https://documentation.concretecms.org/9-x/developers/introduction/version-history/928-release-notes?_gl=1*1bcxp5s*_ga*MTc1NDc0Njk2Mi4xNzA2ODI4MDU1*_ga_HFB3HPNNLS*MTcxMjE2NjYyNi4xMy4xLjE3MTIxNjY2ODEuMC4wLjA.
CVE ID: CVE-2024-3182 State: PUBLISHED Published: 2024-05-15T18:04:49.997Z Last Updated: 2024-08-01T20:05:07.485Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) Vendors: TIBCO Products: Hawk Description: Install-type password disclosure vulnerability in Universal Installer including the Silent Installer in TIBCO Hawk versions 6.2.0, 6.2.1, 6.2.2 and 6.2.3 allows user's Enterprise Message Service (EMS) password to be exposed outside of the hawkagent.cfg and hawkevent.cfg config files. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://community.tibco.com/advisories/tibco-security-advisory-may-14-2024-tibco-hawk-cve-2024-
Container: References: - https://community.tibco.com/advisories/tibco-security-advisory-may-14-2024-tibco-hawk-cve-2024-3182-r213/
CVE ID: CVE-2024-3183 State: PUBLISHED Published: 2024-06-12T08:18:51.691Z Last Updated: 2025-11-20T07:16:16.609Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) Vendors: Red Hat Products: Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 8.2 Advanced Update Support, Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support, Red Hat Enterprise Linux 8.4 Telecommunications Update Service, Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions, Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support, Red Hat Enterprise Linux 8.6 Telecommunications Update Service, Red Hat Enterprise Linux 8.6 Update Services
te Support, Red Hat Enterprise Linux 8.6 Telecommunications Update Service, Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions, Red Hat Enterprise Linux 8.8 Extended Update Support, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 9.0 Extended Update Support, Red Hat Enterprise Linux 9.2 Extended Update Support, Red Hat Enterprise Linux 10 Problem Types: CWE-916 Description: A vulnerability was found in FreeIPA in a way when a Kerberos TGS-REQ is encrypted using the client’s session key. This key is different for each new session, which protects it from brute force attacks. However, the ticket it contains is encrypted using the target principal key directly. For user principa
e force attacks. However, the ticket it contains is encrypted using the target principal key directly. For user principals, this key is a hash of a public per-principal randomly-generated salt and the user’s password. If a principal is compromised it means the attacker would be able to retrieve tickets encrypted to any principal, all of them being encrypted by their own key directly. By taking these tickets and salts offline, the attacker could run brute force attacks to find character strings able to decrypt tickets when combined to a principal salt (i.e. find the principal’s password). Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://access.
l’s password). Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2024:3754 - https://access.redhat.com/errata/RHSA-2024:3755 - https://access.redhat.com/errata/RHSA-2024:3756 - https://access.redhat.com/errata/RHSA-2024:3757 - https://access.redhat.com/errata/RHSA-2024:3758 - https://access.redhat.com/errata/RHSA-2024:3759 - https://access.redhat.com/errata/RHSA-2024:3760 - https://access.redhat.com/errata/RHSA-2024:3761 - https://access.redhat.com/errata/RHSA-2024:3775 - https://access.redhat.com/security/cve/CVE-2024-3183 - https://bugzilla.redhat.com/show_bug.cgi?id=2270685 - https://www.freeipa.org/release-note
/security/cve/CVE-2024-3183 - https://bugzilla.redhat.com/show_bug.cgi?id=2270685 - https://www.freeipa.org/release-notes/4-12-1.html
CVE ID: CVE-2024-3184 State: PUBLISHED Published: 2024-10-17T07:32:18.369Z Last Updated: 2024-10-17T14:42:12.325Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: EmbedThis Products: GoAhead Problem Types: CWE-476 Description: Multiple CWE-476 NULL Pointer Dereference vulnerabilities were found in GoAhead Web Server up to version 6.0.0 when compiled with the ME_GOAHEAD_REPLACE_MALLOC flag. Without a memory notifier for allocation failures, remote attackers can exploit these vulnerabilities by sending malicious requests, leading to a crash and Denial of Service (DoS). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.nozominetworks.c
d Denial of Service (DoS). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2024-3184
CVE ID: CVE-2024-3185 State: PUBLISHED Published: 2024-04-23T08:39:03.387Z Last Updated: 2024-08-01T20:05:08.199Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:H) Vendors: Rapid7 Products: Insight Agent Problem Types: CWE-1284 Description: A key used in logging.json does not follow the least privilege principle by default and is exposed to local users in the Rapid7 Platform. This allows an attacker with local access to a machine with the logging.json file to use that key to authenticate to the platform with high privileges. This was fixed in the Rapid7 platform starting 3 April 2024 via the introduction of a restricted role and the removal of automatic API key generat
d7 platform starting 3 April 2024 via the introduction of a restricted role and the removal of automatic API key generation on installation of an agent. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://docs.rapid7.com/insightidr/configure-the-insight-agent-to-send-logs/
CVE ID: CVE-2024-3186 State: PUBLISHED Published: 2024-10-17T07:34:37.433Z Last Updated: 2024-10-17T14:41:27.052Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: EmbedThis Products: GoAhead Problem Types: CWE-476 Description: CWE-476 NULL Pointer Dereference vulnerability in the evalExpr() function of GoAhead Web Server (version <= 6.0.0) when compiled with the ME_GOAHEAD_JAVASCRIPT flag. This vulnerability allows a remote attacker with the privileges to modify JavaScript template (JST) files to trigger a crash and cause a Denial of Service (DoS) by providing malicious templates. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.no
(DoS) by providing malicious templates. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2024-3186
CVE ID: CVE-2024-3187 State: PUBLISHED Published: 2024-10-17T07:34:50.960Z Last Updated: 2024-10-17T14:40:42.458Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H) Vendors: EmbedThis Products: GoAhead Problem Types: CWE-416, CWE-415 Description: This issue tracks two CWE-416 Use After Free (UAF) and one CWE-415 Double Free vulnerabilities in Goahead versions <= 6.0.0. These are caused by JST values not being nulled when freed during parsing of JST templates. If the ME_GOAHEAD_JAVASCRIPT flag is enabled, a remote attacker with the privileges to modify JavaScript template (JST) files could exploit this by providing malicious templates. This may lead to memory corruption,
JavaScript template (JST) files could exploit this by providing malicious templates. This may lead to memory corruption, potentially causing a Denial of Service (DoS) or, in rare cases, code execution, though the latter is highly context-dependent. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2024-3187
CVE ID: CVE-2024-3188 State: PUBLISHED Published: 2024-04-26T05:00:05.277Z Last Updated: 2024-08-01T20:05:07.524Z Vendors: Unknown Products: WP Shortcodes Plugin — Shortcodes Ultimate Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The WP Shortcodes Plugin — Shortcodes Ultimate WordPress plugin before 7.1.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://wpscan.com/vulnerability/bc273e75-7fa
yst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://wpscan.com/vulnerability/bc273e75-7faf-4eaf-8ebd-efc5d6e9261f/
CVE ID: CVE-2024-3189 State: PUBLISHED Published: 2024-05-15T02:32:43.451Z Last Updated: 2024-08-01T20:05:07.561Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) Vendors: britner Products: Gutenberg Blocks with AI by Kadence WP – Page Builder Features Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Gutenberg Blocks by Kadence Blocks – Page Builder Features plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'Testimonial', 'Progress Bar', 'Lottie Animations', 'Row Layout', 'Google Maps', and 'Advanced Gallery' blocks in all versions up to, and including, 3.2.37 d
e Animations', 'Row Layout', 'Google Maps', and 'Advanced Gallery' blocks in all versions up to, and including, 3.2.37 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/766b0bde-c555-40c1-b174-20045bd89c11?source=cve - https://plugins.trac.wordpress.org/changeset/3083616/kadence-blocks/trunk/includes/blocks/class-kade
d89c11?source=cve - https://plugins.trac.wordpress.org/changeset/3083616/kadence-blocks/trunk/includes/blocks/class-kadence-blocks-lottie-block.php - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3076712%40kadence-blocks&new=3076712%40kadence-blocks&sfp_email=&sfph_mail= - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3084683%40kadence-blocks&new=3084683%40kadence-blocks&sfp_email=&sfph_mail=#file2
CVE ID: CVE-2024-3190 State: PUBLISHED Published: 2024-05-30T03:34:28.259Z Last Updated: 2024-08-01T20:05:07.495Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) Vendors: unitecms Products: Unlimited Elements For Elementor (Free Widgets, Addons, Templates) Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's text field widget in all versions up to, and including, 1.5.107 due to insufficient input sanitization and output escaping on user supplied attr
versions up to, and including, 1.5.107 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Please note that this vulnerability is different in that the issue stems from an external template. It appears that older version may also be patched due to this, however, we are choosing 1.5.108 as the patched version since that is the most recent version containing as known patch. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - htt
containing as known patch. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/78d8ddc9-69ad-4d69-ac23-5a31dfeafd54?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3090199%40unlimited-elements-for-elementor&new=3090199%40unlimited-elements-for-elementor&sfp_email=&sfph_mail=
CVE ID: CVE-2024-3191 State: PUBLISHED Published: 2024-04-29T06:21:47.288Z Last Updated: 2024-08-27T17:34:56.094Z Severity: N/A (CVSS 10 AV:N/AC:L/Au:N/C:C/I:C/A:C) Vendors: n/a Products: MailCleaner Problem Types: CWE-78 Description: A vulnerability, which was classified as critical, has been found in MailCleaner up to 2023.03.14. This issue affects some unknown processing of the component Email Handler. The manipulation leads to os command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-262307. Additional Analyst Notes:
ply a patch to fix this issue. The associated identifier of this vulnerability is VDB-262307. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.262307 - https://vuldb.com/?ctiid.262307 - https://modzero.com/en/advisories/mz-24-01-mailcleaner/ - https://modzero.com/static/MZ-24-01_modzero_MailCleaner.pdf - https://github.com/MailCleaner/MailCleaner/pull/601
CVE ID: CVE-2024-3192 State: PUBLISHED Published: 2024-04-29T06:22:37.114Z Last Updated: 2024-08-01T20:05:08.206Z Severity: N/A (CVSS 5 AV:N/AC:L/Au:N/C:N/I:P/A:N) Vendors: n/a Products: MailCleaner Problem Types: CWE-79 Description: A vulnerability, which was classified as problematic, was found in MailCleaner up to 2023.03.14. Affected is an unknown function of the component Admin Interface. The manipulation as part of Mail Message leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-262308. Additional Analys
is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-262308. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.262308 - https://vuldb.com/?ctiid.262308 - https://modzero.com/en/advisories/mz-24-01-mailcleaner/ - https://modzero.com/static/MZ-24-01_modzero_MailCleaner.pdf - https://github.com/MailCleaner/MailCleaner/pull/601