Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
o known workarounds for this issue. Affected Windows users are recommended to upgrade. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/bytecodealliance/cap-std/security/advisories/GHSA-hxf5-99xg-86hw - https://github.com/bytecodealliance/cap-std/pull/371 - https://github.com/bytecodealliance/cap-std/commit/dcc3818039761331fbeacbb3a40c542b65b5ebf7 - https://en.wikipedia.org/wiki/ISO/IEC_8859-1 - https://learn.microsoft.com/en-us/windows/win32/fileio/naming-a-file#naming-conventions
CVE ID: CVE-2024-51757 State: PUBLISHED Published: 2024-11-06T19:18:23.923Z Last Updated: 2024-11-06T20:05:28.358Z Vendors: capricorn86 Products: happy-dom Problem Types: CWE-94, CWE-79 Description: happy-dom is a JavaScript implementation of a web browser without its graphical user interface. Versions of happy-dom prior to 15.10.2 may execute code on the host via a script tag. This would execute code in the user context of happy-dom. Users are advised to upgrade to version 15.10.2. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/capricorn86/happy-dom/security/advisories/GHSA-96g7-g7g9-jxw8 - https://g
Vulnrichment: References: - https://github.com/capricorn86/happy-dom/security/advisories/GHSA-96g7-g7g9-jxw8 - https://github.com/capricorn86/happy-dom/issues/1585 - https://github.com/capricorn86/happy-dom/pull/1586 - https://github.com/capricorn86/happy-dom/commit/5ee0b1676d4ce20cc2a70d1c9c8d6f1e3f57efac - https://github.com/capricorn86/happy-dom/commit/d23834c232f1cf5519c9418b073f1dcec6b2f0fd - https://github.com/capricorn86/happy-dom/releases/tag/v15.10.2
CVE ID: CVE-2024-51758 State: PUBLISHED Published: 2024-11-07T17:46:36.151Z Last Updated: 2024-11-21T16:23:23.083Z Vendors: filamentphp Products: filament Problem Types: CWE-1188 Description: Filament is a collection of full-stack components for accelerated Laravel development. All Filament features that interact with storage use the `default_filesystem_disk` config option. This allows the user to easily swap their storage driver to something production-ready like `s3` when deploying their app, without having to touch multiple configuration options and potentially forgetting about some. The default disk is set to `public` when you first install Filament, since this allows users to quickly ge
g about some. The default disk is set to `public` when you first install Filament, since this allows users to quickly get started developing with a functional disk that allows features such as file upload previews locally without the need to set up an S3 disk with temporary URL support. However, some features of Filament such as exports also rely on storage, and the files that are stored contain data that should often not be public. This is not an issue for the many deployed applications, since many use a secure default disk such as S3 in production. However, [CWE-1188](https://cwe.mitre.org/data/definitions/1188.html) suggests that having the `public` disk as the default disk in Filament is
ps://cwe.mitre.org/data/definitions/1188.html) suggests that having the `public` disk as the default disk in Filament is a security vulnerability itself. As such, we have implemented a measure to protect users whereby if the `public` disk is set as the default disk, the exports feature will automatically swap it out for the `local` disk, if that exists. Users who set the default disk to `local` or `s3` already are not affected. If a user wants to continue to use the `public` disk for exports, they can by setting the export disk deliberately. This change has been included in the 3.2.123 release and all users who use the `public` disk are advised to upgrade. Additional Analyst Notes: - CISA AD
the 3.2.123 release and all users who use the `public` disk are advised to upgrade. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/filamentphp/filament/security/advisories/GHSA-4hxw-gc2q-f6f3 - https://filamentphp.com/docs/3.x/actions/prebuilt-actions/export#customizing-the-storage-disk
CVE ID: CVE-2024-51759 State: PUBLISHED Published: 2024-11-09T11:51:58.630Z Last Updated: 2024-11-09T15:48:04.548Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: Detlef Beyer Products: SVT Simple Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Detlef Beyer SVT Simple allows Reflected XSS.This issue affects SVT Simple: from n/a through 1.0.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/svt-simple/wordpress-svt-simple-plugin-1-0-1-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2024-51760 State: PUBLISHED Published: 2024-11-09T11:51:01.966Z Last Updated: 2024-11-09T15:48:23.700Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: RistrettoApps Products: Dashing Memberships Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in RistrettoApps Dashing Memberships allows Reflected XSS.This issue affects Dashing Memberships: from n/a through 1.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/dashing-memberships/wordpress-dashing-memberships-plugin-1-1-reflected-cross-site-scripti
ack.com/database/vulnerability/dashing-memberships/wordpress-dashing-memberships-plugin-1-1-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2024-51761 State: PUBLISHED Published: 2024-11-09T11:49:49.468Z Last Updated: 2024-11-09T15:48:42.847Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: Zack Gilbert and Paul Jarvis Products: WPHelpful Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Zack Gilbert and Paul Jarvis WPHelpful allows Reflected XSS.This issue affects WPHelpful: from n/a through 1.2.4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/wphelpful/wordpress-wphelpful-plugin-1-2-4-reflected-cross-site-scripting-xss-vulnerabi
stack.com/database/vulnerability/wphelpful/wordpress-wphelpful-plugin-1-2-4-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2024-51762 State: PUBLISHED Published: 2024-11-09T09:28:49.442Z Last Updated: 2024-11-09T15:18:48.414Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: Nightshift Creative Products: PropertyShift Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Nightshift Creative PropertyShift allows Reflected XSS.This issue affects PropertyShift: from n/a through 1.0.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/propertyshift/wordpress-propertyshift-plugin-1-0-0-reflected-cross-site-scripting-xss-vulnera
com/database/vulnerability/propertyshift/wordpress-propertyshift-plugin-1-0-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2024-51763 State: PUBLISHED Published: 2024-11-09T09:27:36.879Z Last Updated: 2024-11-09T15:19:08.934Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: Biplob Adhikari Products: Team Showcase and Slider – Team Members Builder Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Biplob Adhikari Team Showcase and Slider – Team Members Builder allows Reflected XSS.This issue affects Team Showcase and Slider – Team Members Builder: from n/a through 1.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/t
gh 1.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/team-showcase-ultimate/wordpress-team-showcase-and-slider-plugin-1-3-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2024-51764 State: PUBLISHED Published: 2024-11-15T21:32:21.248Z Last Updated: 2024-11-19T16:28:26.077Z Vendors: Hewlett Packard Enterprise (HPE) Products: SGI CXFS Description: A security vulnerability has been identified in HPE Data Management Framework (DMF) Suite (CXFS). Depending on configuration, this vulnerability may lead to local/cluster unauthorized access. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbcr04747en_us&docLocale=en_US
CVE ID: CVE-2024-51765 State: PUBLISHED Published: 2024-11-15T21:42:37.775Z Last Updated: 2024-11-19T16:23:52.392Z Vendors: Hewlett Packard Enterprise (HPE) Products: Cray System Management Software Description: A security vulnerability has been identified in HPE Cray Data Virtualization Service (DVS). Depending on configuration, this vulnerability may lead to local/cluster unauthorized access. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbcr04748en_us&docLocale=en_US
CVE ID: CVE-2024-51766 State: PUBLISHED Published: 2024-11-22T11:41:42.072Z Last Updated: 2024-11-26T14:20:15.172Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H) Vendors: Hewlett Packard Enterprise Products: HPE NonStop DISK UTIL Problem Types: CWE-755 Description: A potential security vulnerability has been identified in the HPE NonStop DISK UTIL (T9208) product. This vulnerability could be exploited to cause a denial of service (DoS) to NonStop server. It exists in all prior DISK UTIL product versions of L-series and J-series. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbns04759en_us&do
Notes: - CISA ADP Vulnrichment: References: - https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbns04759en_us&docLocale=en_US
CVE ID: CVE-2024-51767 State: PUBLISHED Published: 2025-07-14T10:18:48.455Z Last Updated: 2025-07-14T13:51:18.617Z Vendors: Hewlett Packard Enterprise Products: HPE AutoPass License Server Description: An authentication bypass vulnerability exists in HPE AutoPass License Server (APLS) prior to 9.17. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbgn04760en_us
CVE ID: CVE-2024-51768 State: PUBLISHED Published: 2025-07-14T10:26:00.842Z Last Updated: 2025-07-18T03:55:37.869Z Vendors: Hewlett Packard Enterprise Products: HPE AutoPass License Server Description: An hsqldb-related remote code execution vulnerability exists in HPE AutoPass License Server (APLS) prior to 9.17. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbgn04760en_us
CVE ID: CVE-2024-51769 State: PUBLISHED Published: 2025-07-14T10:29:34.881Z Last Updated: 2025-07-14T13:36:42.302Z Vendors: Hewlett Packard Enterprise Products: HPE AutoPass License Server Description: An information disclosure vulnerability exists in HPE AutoPass License Server (APLS) prior to 9.17. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbgn04760en_us
CVE ID: CVE-2024-51770 State: PUBLISHED Published: 2025-07-14T10:33:55.109Z Last Updated: 2025-07-15T16:28:00.507Z Vendors: Hewlett Packard Enterprise Products: HPE AutoPass License Server Description: An information disclosure vulnerability exists in HPE AutoPass License Server (APLS) prior to 9.17. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbgn04760en_us
CVE ID: CVE-2024-51771 State: PUBLISHED Published: 2024-12-03T20:02:02.240Z Last Updated: 2024-12-03T21:55:47.056Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Hewlett Packard Enterprise (HPE) Products: HPE Aruba Networking ClearPass Policy Manager Description: A vulnerability in the HPE Aruba Networking ClearPass Policy Manager web-based management interface could allow an authenticated remote threat actor to conduct a remote code execution attack. Successful exploitation could enable the attacker to run arbitrary commands on the underlying operating system. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.hpe.com/hpesc/publ
ng operating system. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04761en_us&docLocale=en_US
CVE ID: CVE-2024-51772 State: PUBLISHED Published: 2024-12-03T20:08:00.358Z Last Updated: 2024-12-03T21:54:52.951Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H) Vendors: Hewlett Packard Enterprise (HPE) Products: HPE Aruba Networking ClearPass Policy Manager Description: An authenticated RCE vulnerability in the ClearPass Policy Manager web-based management interface allows remote authenticated users to run arbitrary commands on the underlying host. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.hpe.com/hpesc/public/doc
rating system. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04761en_us&docLocale=en_US
CVE ID: CVE-2024-51773 State: PUBLISHED Published: 2024-12-03T20:11:03.981Z Last Updated: 2024-12-03T21:56:04.237Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N) Vendors: Hewlett Packard Enterprise (HPE) Products: HPE Aruba Networking ClearPass Policy Manager Description: A vulnerability in the HPE Aruba Networking ClearPass Policy Manager web-based management interface could allow an authenticated remote Attacker to conduct a stored cross-site scripting (XSS) attack. Successful exploitation could enable a threat actor to perform any actions the user is authorized to do, including accessing the user's data and altering information within the user's permissions. This
er is authorized to do, including accessing the user's data and altering information within the user's permissions. This could lead to data modification, deletion, or theft, including unauthorized access to files, file deletion, or the theft of session cookies, which an attacker could use to hijack a user's session. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04761en_us&docLocale=en_US
CVE ID: CVE-2024-51774 State: PUBLISHED Published: 2024-11-02T00:00:00 Last Updated: 2024-11-06T16:24:13.957Z Vendors: n/a Products: n/a Problem Types: n/a Description: qBittorrent before 5.0.1 proceeds with use of https URLs even after certificate validation errors. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://sharpsec.run/rce-vulnerability-in-qbittorrent/ - https://news.ycombinator.com/item?id=42004219 - https://www.qbittorrent.org/news
CVE ID: CVE-2024-51775 State: PUBLISHED Published: 2025-08-03T10:13:17.467Z Last Updated: 2025-11-04T21:09:01.910Z Vendors: Apache Software Foundation Products: Apache Zeppelin Problem Types: CWE-1385 Description: Missing Origin Validation in WebSockets vulnerability in Apache Zeppelin. The attacker could access the Zeppelin server from another origin without any restriction, and get internal information about paragraphs. This issue affects Apache Zeppelin: from 0.11.1 before 0.12.0. Users are recommended to upgrade to version 0.12.0, which fixes the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/apache/zeppelin/pull/4823
CVE ID: CVE-2024-51776 State: PUBLISHED Published: 2024-11-09T09:25:08.228Z Last Updated: 2024-11-09T15:19:49.706Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: samhotchkiss Products: Daily Image Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in samhotchkiss Daily Image allows Reflected XSS.This issue affects Daily Image: from n/a through 1.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/daily-image/wordpress-daily-image-plugin-1-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2024-51778 State: PUBLISHED Published: 2024-11-09T09:24:03.580Z Last Updated: 2024-11-09T15:20:09.371Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: Starfish Reviews Products: Satisfaction Reports from Help Scout Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Starfish Reviews Satisfaction Reports from Help Scout allows Reflected XSS.This issue affects Satisfaction Reports from Help Scout: from n/a through 2.0.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/happiness-reports-for-help-sco
tes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/happiness-reports-for-help-scout/wordpress-satisfaction-reports-from-help-scout-plugin-2-0-3-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2024-51779 State: PUBLISHED Published: 2024-11-09T09:23:07.919Z Last Updated: 2024-11-09T15:20:30.939Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: Stranger Studios (WordCamp Philly) Products: Don't Break The Code Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Stranger Studios (WordCamp Philly) Don't Break The Code allows Reflected XSS.This issue affects Don't Break The Code: from n/a through .3.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/dont-break-the-code/wordpress-don-t-break-t
DP Vulnrichment: References: - https://patchstack.com/database/vulnerability/dont-break-the-code/wordpress-don-t-break-the-code-plugin-3-1-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2024-51780 State: PUBLISHED Published: 2024-11-09T09:21:57.074Z Last Updated: 2024-11-09T15:20:52.913Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: Michael DUMONTET Products: eewee admin custom Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Michael DUMONTET eewee admin custom allows Reflected XSS.This issue affects eewee admin custom: from n/a through 1.8.2.4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/eewee-admincustom/wordpress-eewee-admin-custom-plugin-1-8-2-4-reflected-cross-site
patchstack.com/database/vulnerability/eewee-admincustom/wordpress-eewee-admin-custom-plugin-1-8-2-4-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2024-51781 State: PUBLISHED Published: 2024-11-09T09:20:55.808Z Last Updated: 2024-11-09T15:21:18.964Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: Loop Now Technologies, Inc. Products: Firework Shoppable Live Video Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Loop Now Technologies, Inc. Firework Shoppable Live Video allows Reflected XSS.This issue affects Firework Shoppable Live Video: from n/a through 6.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/firework-videos/wordpress-firew
es: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/firework-videos/wordpress-firework-shoppable-live-video-plugin-6-3-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2024-51782 State: PUBLISHED Published: 2024-11-09T08:31:32.038Z Last Updated: 2024-11-09T15:21:39.257Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: Sanjaysolutions Products: Loginplus Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Sanjaysolutions Loginplus allows Stored XSS.This issue affects Loginplus: from n/a through 1.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/loginplus/wordpress-loginplus-plugin-1-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2024-51783 State: PUBLISHED Published: 2024-11-09T08:29:58.931Z Last Updated: 2024-11-09T15:21:59.835Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: zaus Products: Forms: 3rd-Party Post Again Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in zaus Forms: 3rd-Party Post Again allows Reflected XSS.This issue affects Forms: 3rd-Party Post Again: from n/a through 0.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/forms-3rdparty-post-again/wordpress-forms-3rd-party-post-again-plugin-0-3-reflected
atchstack.com/database/vulnerability/forms-3rdparty-post-again/wordpress-forms-3rd-party-post-again-plugin-0-3-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2024-51784 State: PUBLISHED Published: 2024-11-09T08:28:59.331Z Last Updated: 2024-11-09T15:22:20.863Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: VietFriend team Products: FriendStore for WooCommerce Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in VietFriend team FriendStore for WooCommerce allows Reflected XSS.This issue affects FriendStore for WooCommerce: from n/a through 1.4.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/friendstore-for-woocommerce/wordpress-friendstore-for-wooco
References: - https://patchstack.com/database/vulnerability/friendstore-for-woocommerce/wordpress-friendstore-for-woocommerce-plugin-1-4-2-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2024-51785 State: PUBLISHED Published: 2024-11-09T08:21:04.828Z Last Updated: 2024-11-11T11:54:58.750Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N) Vendors: I Thirteen Web Solution Products: Responsive Filterable Portfolio Problem Types: CWE-918 Description: Server-Side Request Forgery (SSRF) vulnerability in I Thirteen Web Solution Responsive Filterable Portfolio allows Server Side Request Forgery.This issue affects Responsive Filterable Portfolio: from n/a through 1.0.22. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/responsive-filterable-portfolio/wordpress-responsive-filterable-portfo
: - https://patchstack.com/database/vulnerability/responsive-filterable-portfolio/wordpress-responsive-filterable-portfolio-plugin-1-0-22-server-side-request-forgery-ssrf-vulnerability?_s_id=cve
CVE ID: CVE-2024-51786 State: PUBLISHED Published: 2024-11-09T08:27:15.775Z Last Updated: 2024-11-09T15:22:42.743Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: BestWebSoft Products: Realty by BestWebSoft Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in BestWebSoft Realty by BestWebSoft allows Stored XSS.This issue affects Realty by BestWebSoft: from n/a through 1.1.5. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/realty/wordpress-realty-by-bestwebsoft-plugin-1-1-5-cross-site-scripting-xss-vulnerabi