Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-11718 State: PUBLISHED Published: 2025-05-15T20:06:50.765Z Last Updated: 2025-05-20T19:33:48.089Z Vendors: Unknown Products: tarteaucitron-wp Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The tarteaucitron-wp WordPress plugin before 0.3.0 allows author level and above users to add HTML into a post/page, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/02da3a49-20e4-4476-a78d-4c627994a90a/
CVE ID: CVE-2024-11719 State: PUBLISHED Published: 2025-05-15T20:06:50.972Z Last Updated: 2025-05-20T19:33:28.595Z Vendors: Unknown Products: tarteaucitron-wp Problem Types: CWE-79 Cross-Site Scripting (XSS), CWE-352 Cross-Site Request Forgery (CSRF) Description: The tarteaucitron-wp WordPress plugin before 0.3.0 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/64c2a296-5fc6-450e-a12d-75cbf8b73e3a/
CVE ID: CVE-2024-11720 State: PUBLISHED Published: 2024-12-14T08:26:38.920Z Last Updated: 2024-12-16T16:40:53.414Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) Vendors: shabti Products: Frontend Admin by DynamiApps Problem Types: CWE-79 Description: The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via submission forms in all versions up to, and including, 3.24.5 due to insufficient input sanitization and output escaping on the new Taxonomy form. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is only exploi
o inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is only exploitable when lower-level users have been granted access to submit specific forms, which is disabled by default. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/69a464f4-c357-446f-a5b8-0919d9af56c9?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3204192%40acf-frontend-form-element&new=3204192%40acf-frontend-form-element&sfp_email=&sfph_mail=#file32
CVE ID: CVE-2024-11721 State: PUBLISHED Published: 2024-12-14T08:26:39.587Z Last Updated: 2024-12-16T16:40:45.292Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: shabti Products: Frontend Admin by DynamiApps Problem Types: CWE-269 Description: The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 3.24.5. This is due to insufficient controls on the user role select field when utilizing the 'Role' field in a form. This makes it possible for unauthenticated attackers to create new administrative user accounts, even when the administrative user role has not been provided as an option to t
create new administrative user accounts, even when the administrative user role has not been provided as an option to the user, granted that unauthenticated users have been provided access to the form. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/e9fdc833-8384-42c0-ad9b-72e5b6351964?source=cve - https://plugins.trac.wordpress.org/changeset/3204192/acf-frontend-form-element/trunk/main/frontend/fields/user/class-role.php
CVE ID: CVE-2024-11722 State: PUBLISHED Published: 2024-12-21T09:23:55.317Z Last Updated: 2024-12-28T00:49:07.590Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: shabti Products: Frontend Admin by DynamiApps Problem Types: CWE-89 Description: The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to SQL Injection via the 'orderby' parameter in all versions up to, and including, 3.25.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extrac
for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This requires an unauthenticated user to have been given permission to view form submissions, and the form submission shortcode be added to a page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/97cef309-da2f-461a-b5a3-3a85c540c7aa?source=cve - https://plugins.trac.wordpress.org/browser/acf-frontend-form-element/trunk/main/admin/admin-pages/submissions/crud.php#L171 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3209204%4
s/submissions/crud.php#L171 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3209204%40acf-frontend-form-element&new=3209204%40acf-frontend-form-element&sfp_email=&sfph_mail=
CVE ID: CVE-2024-11723 State: PUBLISHED Published: 2024-12-12T04:23:08.407Z Last Updated: 2024-12-12T15:07:18.588Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: insiderealestate Products: kvCORE IDX Problem Types: CWE-79 Description: The kvCORE IDX plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via any parameter on pages with the kvcoreidx_listings_sitemap_ranges, kvcoreidx_listings_sitemap_page, kvcoreidx_agent_profile_sitemap, or kvcoreidx_agent_profile shortcode present in all versions up to, and including, 2.3.35 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inj
due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/074d8ccc-4fd6-4d46-9bc2-98d209f5a6a1?source=cve - https://plugins.trac.wordpress.org/browser/kvcore-idx/includes/kvcore/class-actions.php#L1170
CVE ID: CVE-2024-11724 State: PUBLISHED Published: 2024-12-12T06:46:34.875Z Last Updated: 2024-12-12T14:45:52.572Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: wplegalpages Products: Cookie Consent, Consent Log, Cookie Scanner, Script Blocker (for GDPR, CCPA & ePrivacy) : WP Cookie Consent Problem Types: CWE-862 Description: The Cookie Consent for WP – Cookie Consent, Consent Log, Cookie Scanner, Script Blocker (for GDPR, CCPA & ePrivacy) plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the wpl_script_save AJAX action in all versions up to, and including, 3.6.5. This makes it possible for authent
check on the wpl_script_save AJAX action in all versions up to, and including, 3.6.5. This makes it possible for authenticated attackers, with Subscriber-level access and above, to whitelist scripts. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/e9a1de53-330f-49ab-a8f8-22753c62bd36?source=cve - https://plugins.trac.wordpress.org/changeset/3203552/gdpr-cookie-consent/tags/3.6.6/public/modules/script-blocker/class-wpl-cookie-consent-script-blocker.php
CVE ID: CVE-2024-11725 State: PUBLISHED Published: 2025-01-07T06:40:56.260Z Last Updated: 2025-01-07T17:16:03.368Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: cozyvision1 Products: SMS Alert Order Notifications – WooCommerce Problem Types: CWE-862 Description: The SMS Alert Order Notifications – WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the updateWcWarrantySettings() function in all versions up to, and including, 3.7.6. This makes it possible for authenticated attackers, with subscriber-level access and above, to update arbitrary options on
s makes it possible for authenticated attackers, with subscriber-level access and above, to update arbitrary options on the WordPress site. This can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site. Please note this requires the woocommerce-warranty plugin to be installed in order to be exploited. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/33517dba-78ac-4391-a55e-d1f13801b212?source=cve - https://plugins.trac.wordpress.org/browser/sms-alert/trunk/helper/return-warranty.php#L74 - https://plug
12?source=cve - https://plugins.trac.wordpress.org/browser/sms-alert/trunk/helper/return-warranty.php#L74 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3199795%40sms-alert&new=3199795%40sms-alert&sfp_email=&sfph_mail= - https://plugins.trac.wordpress.org/changeset/3198056/sms-alert/trunk/helper/return-warranty.php - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3197777%40sms-alert&new=3197777%40sms-alert&sfp_email=&sfph_mail= - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3207391%40sms-alert&new=3207391%40sms-alert&sfp_email=&sfph_mail=
CVE ID: CVE-2024-11726 State: PUBLISHED Published: 2024-12-24T11:09:50.216Z Last Updated: 2024-12-24T14:39:00.800Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: reputeinfosystems Products: Appointment Booking Calendar Plugin and Scheduling Plugin – BookingPress Problem Types: CWE-89 Description: The Appointment Booking Calendar Plugin and Scheduling Plugin – BookingPress plugin for WordPress is vulnerable to SQL Injection via the 'category' parameter of the 'bookingpress_form' shortcode in all versions up to, and including, 1.1.21 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This
insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/6d081b89-1b98-4f4f-8728-d1ea676d7afd?source=cve - https://plugins.trac.wordpress.org/changeset/3206780/bookingpress-appointment-booking/trunk/core/classes/frontend/class.bookingpress_appointment_bookings.php
CVE ID: CVE-2024-11727 State: PUBLISHED Published: 2024-12-12T06:46:32.990Z Last Updated: 2024-12-12T15:45:45.651Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N) Vendors: wpdevteam Products: NotificationX – Live Sales Notification, WooCommerce Sales Popup, FOMO, Social Proof, Announcement Banner & Floating Notification Top Bar Problem Types: CWE-79 Description: The NotificationX – Live Sales Notification, WooCommerce Sales Popup, FOMO, Social Proof, Announcement Banner & Floating Notification Top Bar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's content settings for notifications in all versions up to, and including, 2.9.3 due to
ss-Site Scripting via the plugin's content settings for notifications in all versions up to, and including, 2.9.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/338edb1d-101a-4b6e-ac25-b59bd3e17f8b?source=cve - https://plugins.trac.wordpress.org/changeset/3205
l/vulnerabilities/id/338edb1d-101a-4b6e-ac25-b59bd3e17f8b?source=cve - https://plugins.trac.wordpress.org/changeset/3205560/notificationx/trunk/includes/FrontEnd/Preview.php
CVE ID: CVE-2024-11728 State: PUBLISHED Published: 2024-12-06T09:22:59.195Z Last Updated: 2024-12-06T17:11:27.673Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: iqonicdesign Products: KiviCare – Clinic & Patient Management System (EHR) Problem Types: CWE-89 Description: The KiviCare – Clinic & Patient Management System (EHR) plugin for WordPress is vulnerable to SQL Injection via the 'visit_type[service_id]' parameter of the tax_calculated_data AJAX action in all versions up to, and including, 3.6.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthentica
supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/53c18834-3026-4d4d-888b-add314a0e56e?source=cve - https://plugins.trac.wordpress.org/changeset/3201428/kivicare-clinic-management-system/trunk/app/controllers/KCTaxController.php
CVE ID: CVE-2024-11729 State: PUBLISHED Published: 2024-12-06T11:09:11.089Z Last Updated: 2024-12-06T17:30:40.844Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: iqonicdesign Products: KiviCare – Clinic & Patient Management System (EHR) Problem Types: CWE-89 Description: The KiviCare – Clinic & Patient Management System (EHR) plugin for WordPress is vulnerable to SQL Injection via the 'service_list[0][service_id]' parameter of the get_widget_payment_options AJAX action in all versions up to, and including, 3.6.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible fo
g on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Custom-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/86632212-37b5-4280-8a2a-163957ad9787?source=cve - https://plugins.trac.wordpress.org/changeset/3201428/kivicare-clinic-management-system/trunk/app/controllers/KCBookAppointmentWidgetController.php
CVE ID: CVE-2024-11730 State: PUBLISHED Published: 2024-12-06T11:09:10.486Z Last Updated: 2024-12-06T17:30:47.606Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: iqonicdesign Products: KiviCare – Clinic & Patient Management System (EHR) Problem Types: CWE-89 Description: The KiviCare – Clinic & Patient Management System (EHR) plugin for WordPress is vulnerable to SQL Injection via the 'sort[]' parameter of the static_data_list AJAX action in all versions up to, and including, 3.6.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with
r and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with doctor/receptionist-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/30f2a3ee-7f95-478c-b3d7-c254b9472d42?source=cve - https://plugins.trac.wordpress.org/changeset/3201428/kivicare-clinic-management-system/trunk/app/controllers/KCStaticDataController.php
CVE ID: CVE-2024-11731 State: PUBLISHED Published: 2025-03-05T09:21:50.557Z Last Updated: 2025-03-05T14:52:41.393Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: averta Products: Master Slider – Responsive Touch Slider Problem Types: CWE-79 Description: The Master Slider – Responsive Touch Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's ms_slider shortcode in all versions up to, and including, 3.10.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pag
it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/f1dcafe1-bdba-4476-bcc7-ad844da38a01?source=cve - https://plugins.trac.wordpress.org/browser/master-slider/tags/3.10.0/includes/msp-shortcodes.php#L526 - https://wordpress.org/plugins/master-slider/#developers
CVE ID: CVE-2024-11732 State: PUBLISHED Published: 2024-12-03T07:35:01.056Z Last Updated: 2024-12-03T11:23:42.003Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: venutius Products: BP Profile Shortcodes Extra Problem Types: CWE-89 Description: The BP Profile Shortcodes Extra plugin for WordPress is vulnerable to time-based SQL Injection via the ‘tab’ parameter in all versions up to, and including, 2.6.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Contributor-level access and above, to append additional SQL queries into alrea
ssible for authenticated attackers, with Contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/d7324a4e-ff45-4908-bcaa-379b130f73c0?source=cve - https://plugins.trac.wordpress.org/browser/bp-profile-shortcodes-extra/tags/2.6.0/inc/bppsc-shortcodes-extra.php#L1694 - https://wordpress.org/plugins/bp-profile-shortcodes-extra/#developers
CVE ID: CVE-2024-11733 State: PUBLISHED Published: 2025-01-03T22:22:06.377Z Last Updated: 2025-01-06T15:07:47.449Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: hcabrera Products: WordPress Popular Posts Problem Types: CWE-94 Description: The The WordPress Popular Posts plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 7.1.0. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes. Additional Analyst Notes: - CISA ADP Vulnrichment: References:
authenticated attackers to execute arbitrary shortcodes. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/c38ac8d6-c6de-4be7-bf7b-198e085a0ad2?source=cve - https://plugins.trac.wordpress.org/browser/wordpress-popular-posts/tags/7.1.0/src/Rest/ViewLoggerEndpoint.php#L70
CVE ID: CVE-2024-11734 State: PUBLISHED Published: 2025-01-14T08:35:42.107Z Last Updated: 2025-11-20T18:22:05.817Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: Red Hat Products: Red Hat build of Keycloak 26.0, RHBK 26.0.8, Red Hat JBoss Enterprise Application Platform 8, Red Hat JBoss Enterprise Application Platform Expansion Pack Problem Types: CWE-693 Description: A denial of service vulnerability was found in Keycloak that could allow an administrative user with the right to change realm settings to disrupt the service. This action is done by modifying any of the security headers and inserting newlines, which causes the Keycloak server to write to a re
done by modifying any of the security headers and inserting newlines, which causes the Keycloak server to write to a request that has already been terminated, leading to the failure of said request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://access.redhat.com/errata/RHSA-2025:0299 - https://access.redhat.com/errata/RHSA-2025:0300 - https://access.redhat.com/security/cve/CVE-2024-11734 - https://bugzilla.redhat.com/show_bug.cgi?id=2328846
CVE ID: CVE-2024-11736 State: PUBLISHED Published: 2025-01-14T08:36:08.583Z Last Updated: 2025-11-20T18:22:08.157Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) Vendors: Red Hat Products: Red Hat build of Keycloak 26.0, RHBK 26.0.8, Red Hat JBoss Enterprise Application Platform 8, Red Hat JBoss Enterprise Application Platform Expansion Pack Problem Types: CWE-526 Description: A vulnerability was found in Keycloak. Admin users may have to access sensitive server environment variables and system properties through user-configurable URLs. When configuring backchannel logout URLs or admin URLs, admin users can include placeholders like ${env.VARNAME} or ${PROPNAME}. Th
uring backchannel logout URLs or admin URLs, admin users can include placeholders like ${env.VARNAME} or ${PROPNAME}. The server replaces these placeholders with the actual values of environment variables or system properties during URL processing. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://access.redhat.com/errata/RHSA-2025:0299 - https://access.redhat.com/errata/RHSA-2025:0300 - https://access.redhat.com/security/cve/CVE-2024-11736 - https://bugzilla.redhat.com/show_bug.cgi?id=2328850
CVE ID: CVE-2024-11737 State: PUBLISHED Published: 2024-12-11T09:36:29.282Z Last Updated: 2024-12-11T15:22:05.910Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Schneider Electric Products: Modicon Controllers M241 / M251, Modicon Controllers M258 / LMC058 Problem Types: CWE-20 Description: CWE-20: Improper Input Validation vulnerability exists that could lead to a denial of service and a loss of confidentiality, integrity of the controller when an unauthenticated crafted Modbus packet is sent to the device. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2024-345-03&p_enDocTyp
CISA ADP Vulnrichment: References: - https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2024-345-03&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2024-345-03.pdf
CVE ID: CVE-2024-11738 State: PUBLISHED Published: 2024-12-06T14:54:11.310Z Last Updated: 2025-11-20T18:22:11.892Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: Red Hat Products: Red Hat Trusted Artifact Signer Problem Types: CWE-248 Description: A flaw was found in Rustls 0.23.13 and related APIs. This vulnerability allows denial of service (panic) via a fragmented TLS ClientHello message. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://access.redhat.com/security/cve/CVE-2024-11738 - https://bugzilla.redhat.com/show_bug.cgi?id=2328732 - https://github.com/advisories/GHSA-qg5g-gv98-5ffh - https://github.com/rustls/rustls - https://
how_bug.cgi?id=2328732 - https://github.com/advisories/GHSA-qg5g-gv98-5ffh - https://github.com/rustls/rustls - https://github.com/rustls/rustls/issues/2227 - https://rustsec.org/advisories/RUSTSEC-2024-0399.html