Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
ociated identifier of this vulnerability is VDB-250707. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.250707 - https://vuldb.com/?ctiid.250707 - https://github.com/jylsec/vuldb/blob/main/Tenda/W9/2/README.md
CVE ID: CVE-2024-0538 State: PUBLISHED Published: 2024-01-15T04:00:06.512Z Last Updated: 2024-10-23T15:38:09.787Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C) Vendors: Tenda Products: W9 Problem Types: CWE-121 Description: A vulnerability has been found in Tenda W9 1.0.0.7(4456) and classified as critical. This vulnerability affects the function formQosManage_auto of the component httpd. The manipulation of the argument ssidIndex leads to stack-based buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-250708. NOTE: The vendor was contacted early about this disclosure but did not
identifier of this vulnerability is VDB-250708. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.250708 - https://vuldb.com/?ctiid.250708 - https://github.com/jylsec/vuldb/blob/main/Tenda/W9/3/README.md
CVE ID: CVE-2024-0539 State: PUBLISHED Published: 2024-01-15T04:31:04.023Z Last Updated: 2025-06-03T14:01:34.808Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C) Vendors: Tenda Products: W9 Problem Types: CWE-121 Description: A vulnerability was found in Tenda W9 1.0.0.7(4456) and classified as critical. This issue affects the function formQosManage_user of the component httpd. The manipulation of the argument ssidIndex leads to stack-based buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-250709 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not res
DB-250709 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.250709 - https://vuldb.com/?ctiid.250709 - https://github.com/jylsec/vuldb/blob/main/Tenda/W9/4/README.md
CVE ID: CVE-2024-0540 State: PUBLISHED Published: 2024-01-15T04:31:05.060Z Last Updated: 2025-06-03T14:01:28.839Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: Tenda Products: W9 Problem Types: CWE-121 Description: A vulnerability was found in Tenda W9 1.0.0.7(4456). It has been classified as critical. Affected is the function formOfflineSet of the component httpd. The manipulation of the argument ssidIndex leads to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-250710 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did
10 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.250710 - https://vuldb.com/?ctiid.250710 - https://github.com/jylsec/vuldb/blob/main/Tenda/W9/5/README.md
CVE ID: CVE-2024-0541 State: PUBLISHED Published: 2024-01-15T05:00:06.027Z Last Updated: 2025-05-12T15:12:08.152Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C) Vendors: Tenda Products: W9 Problem Types: CWE-121 Description: A vulnerability was found in Tenda W9 1.0.0.7(4456). It has been declared as critical. Affected by this vulnerability is the function formAddSysLogRule of the component httpd. The manipulation of the argument sysRulenEn leads to stack-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-250711. NOTE: The vendor was contacted early about this disc
sed. The associated identifier of this vulnerability is VDB-250711. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.250711 - https://vuldb.com/?ctiid.250711 - https://github.com/jylsec/vuldb/blob/main/Tenda/W9/6/README.md
CVE ID: CVE-2024-0542 State: PUBLISHED Published: 2024-01-15T05:00:07.333Z Last Updated: 2025-06-09T17:21:34.296Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C) Vendors: Tenda Products: W9 Problem Types: CWE-121 Description: A vulnerability was found in Tenda W9 1.0.0.7(4456). It has been rated as critical. Affected by this issue is the function formWifiMacFilterGet of the component httpd. The manipulation of the argument index leads to stack-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-250712. NOTE: The vendor was contacted early about this disclosure but did not respo
tifier of this vulnerability is VDB-250712. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.250712 - https://vuldb.com/?ctiid.250712 - https://github.com/jylsec/vuldb/blob/main/Tenda/W9/7/README.md
CVE ID: CVE-2024-0543 State: PUBLISHED Published: 2024-01-15T05:31:04.333Z Last Updated: 2025-06-17T21:19:14.060Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: CodeAstro Products: Real Estate Management System Problem Types: CWE-89 Description: A vulnerability classified as critical has been found in CodeAstro Real Estate Management System up to 1.0. This affects an unknown part of the file propertydetail.php. The manipulation of the argument pid leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-250713 was assigned to this vulnerability. Additional Analyst Notes: - CVE Progra
ic and may be used. The identifier VDB-250713 was assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.250713 - https://vuldb.com/?ctiid.250713 - https://drive.google.com/drive/folders/1U2nirIi6OtuCi-vrD2-VHyJbsHK5yA7t?usp=sharing
CVE ID: CVE-2024-0545 State: PUBLISHED Published: 2024-01-15T06:00:05.824Z Last Updated: 2025-04-21T14:16:29.575Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: CodeCanyon Products: RISE Ultimate Project Manager Problem Types: CWE-601 Description: A vulnerability classified as problematic was found in CodeCanyon RISE Ultimate Project Manager 3.5.3. This vulnerability affects unknown code of the file /index.php/signin. The manipulation of the argument redirect with the input http://evil.com leads to open redirect. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CVE Program Contai
d remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.250714 - https://vuldb.com/?ctiid.250714 - https://vuldb.com/?submit.266974
CVE ID: CVE-2024-0546 State: PUBLISHED Published: 2024-01-15T06:00:07.098Z Last Updated: 2025-06-03T14:01:19.774Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: n/a Products: EasyFTP Problem Types: CWE-404 Description: A vulnerability, which was classified as problematic, has been found in EasyFTP 1.7.0. This issue affects some unknown processing of the component LIST Command Handler. The manipulation leads to denial of service. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-250715. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnric
ed identifier of this vulnerability is VDB-250715. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.250715 - https://vuldb.com/?ctiid.250715 - https://packetstormsecurity.com/files/94905/EasyFTP-1.7.0.x-Denial-Of-Service.html
CVE ID: CVE-2024-0547 State: PUBLISHED Published: 2024-01-15T06:31:04.022Z Last Updated: 2024-10-23T15:35:42.969Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: n/a Products: Ability FTP Server Problem Types: CWE-404 Description: A vulnerability has been found in Ability FTP Server 2.34 and classified as problematic. Affected by this vulnerability is an unknown functionality of the component APPE Command Handler. The manipulation leads to denial of service. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-250717 was assigned to this vulnerability. Additional Analyst Notes: - CVE Program Co
nd may be used. The identifier VDB-250717 was assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.250717 - https://vuldb.com/?ctiid.250717 - https://packetstormsecurity.com/files/163079/Ability-FTP-Server-2.34-Denial-Of-Service.html
CVE ID: CVE-2024-0548 State: PUBLISHED Published: 2024-01-15T06:31:05.053Z Last Updated: 2024-08-26T18:19:19.041Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: FreeFloat Products: FTP Server Problem Types: CWE-404 Description: A vulnerability was found in FreeFloat FTP Server 1.0 and classified as problematic. Affected by this issue is some unknown functionality of the component SIZE Command Handler. The manipulation leads to denial of service. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-250718 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CI
ed. VDB-250718 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.250718 - https://vuldb.com/?ctiid.250718 - https://packetstormsecurity.com/files/163038/FreeFloat-FTP-Server-1.0-Denial-Of-Service.html
CVE ID: CVE-2024-0549 State: PUBLISHED Published: 2024-04-16T00:00:14.132Z Last Updated: 2024-08-01T18:11:35.275Z Severity: HIGH (CVSS 8.1 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H) Vendors: mintplex-labs Products: mintplex-labs/anything-llm Problem Types: CWE-23 Description: mintplex-labs/anything-llm is vulnerable to a relative path traversal attack, allowing unauthorized attackers with a default role account to delete files and folders within the filesystem, including critical database files such as 'anythingllm.db'. The vulnerability stems from insufficient input validation and normalization in the handling of file and folder deletion requests. Successful exploitation results in the c
idation and normalization in the handling of file and folder deletion requests. Successful exploitation results in the compromise of data integrity and availability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://huntr.com/bounties/fcb4001e-0290-4b78-a2f0-91ee5d20cc72 - https://github.com/mintplex-labs/anything-llm/commit/026849df0224b6a8754f4103530bc015874def62
CVE ID: CVE-2024-0550 State: PUBLISHED Published: 2024-02-28T04:52:21.831Z Last Updated: 2024-08-22T19:40:03.830Z Severity: CRITICAL (CVSS 9.6 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N) Vendors: mintplex-labs Products: mintplex-labs/anything-llm Problem Types: CWE-23 Description: A user who is privileged already `manager` or `admin` can set their profile picture via the frontend API using a relative filepath to then user the PFP GET API to download any valid files. The attacker would have to have been granted privileged permissions to the system before executing this attack. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.com/bountie
ack. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/c6afeb5e-f211-4b3d-aa4b-6bad734217a6 - https://github.com/mintplex-labs/anything-llm/commit/e1dcd5ded010b03abd6aa32d1bf0668a48e38e17
CVE ID: CVE-2024-0551 State: PUBLISHED Published: 2024-02-27T14:07:28.927Z Last Updated: 2024-08-01T18:23:28.766Z Severity: HIGH (CVSS 7.1 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N) Vendors: mintplex-labs Products: mintplex-labs/anything-llm Problem Types: CWE-284 Description: Enable exports of the database and associated exported information of the system via the default user role. The attacked would have to have been granted access to the system prior to the attack. It is worth noting that the deterministic nature of the export name is lower risk as the UI for exporting would start the download at the same time, which once downloaded - deletes the export from the system. The endpoint fo
g would start the download at the same time, which once downloaded - deletes the export from the system. The endpoint for exporting should simply be patched to a higher privilege level. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/f114c787-ab5f-4f83-afa5-c000435efb78 - https://github.com/mintplex-labs/anything-llm/commit/7aaa4b38e7112a6cd879c1238310c56b1844c6d8
CVE ID: CVE-2024-0552 State: PUBLISHED Published: 2024-01-15T04:03:07.044Z Last Updated: 2024-10-14T06:11:21.141Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Intumit inc. Products: SmartRobot Problem Types: CWE-1395 Description: Intumit inc. SmartRobot's web framwork has a remote code execution vulnerability. An unauthorized remote attacker can exploit this vulnerability to execute arbitrary commands on the remote server. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.twcert.org.tw/tw/cp-132-7662-41d50-1.html
CVE ID: CVE-2024-0553 State: PUBLISHED Published: 2024-01-16T11:40:50.677Z Last Updated: 2025-11-20T18:09:07.238Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Red Hat Products: Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 8.6 Extended Update Support, Red Hat Enterprise Linux 8.8 Extended Update Support, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 9.2 Extended Update Support, RHODF-4.15-RHEL-9, RHOL-5.8-RHEL-9, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7 Problem Types: CWE-203 Description: A vulnerability was found in GnuTLS. The response times to malformed ciphertexts in RSA-PSK ClientKeyExchange differ from the response times of
nd in GnuTLS. The response times to malformed ciphertexts in RSA-PSK ClientKeyExchange differ from the response times of ciphertexts with correct PKCS#1 v1.5 padding. This issue may allow a remote attacker to perform a timing side-channel attack in the RSA-PSK key exchange, potentially leading to the leakage of sensitive data. CVE-2024-0553 is designated as an incomplete resolution for CVE-2023-5981. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://access.redhat.com/errata/RHSA-2024:0533 - https://access.redhat.com/errata/RHSA-2024:0627 - https://access.redhat.com/errata/RHSA-2024:0796 - https://access.redhat.com/errata/RHSA-2024:1082 - https:
A-2024:0627 - https://access.redhat.com/errata/RHSA-2024:0796 - https://access.redhat.com/errata/RHSA-2024:1082 - https://access.redhat.com/errata/RHSA-2024:1108 - https://access.redhat.com/errata/RHSA-2024:1383 - https://access.redhat.com/errata/RHSA-2024:2094 - https://access.redhat.com/security/cve/CVE-2024-0553 - https://bugzilla.redhat.com/show_bug.cgi?id=2258412 - https://gitlab.com/gnutls/gnutls/-/issues/1522 - https://lists.gnupg.org/pipermail/gnutls-help/2024-January/004841.html
CVE ID: CVE-2024-0554 State: PUBLISHED Published: 2024-01-16T10:08:29.929Z Last Updated: 2025-06-02T15:11:31.696Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L) Vendors: Full Compass Systems Products: WIC1200 Problem Types: CWE-79 Description: A Cross-site scripting (XSS) vulnerability has been found on WIC1200, affecting version 1.1. An authenticated user could store a malicious javascript payload in the device model parameter via '/setup/diags_ir_learn.asp', allowing the attacker to retrieve the session details of another user. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/avi
Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-full-compass-systems-wic1200
CVE ID: CVE-2024-0555 State: PUBLISHED Published: 2024-01-16T10:09:58.665Z Last Updated: 2025-06-17T21:19:15.624Z Severity: MEDIUM (CVSS 4.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L) Vendors: Full Compass Systems Products: WIC1200 Problem Types: CWE-352 Description: A Cross-Site Request Forgery (CSRF) vulnerability has been found on WIC1200, affecting version 1.1. An authenticated user could lead another user into executing unwanted actions inside the application they are logged in. This vulnerability is possible due to the lack of propper CSRF token implementation. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-c
itional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-full-compass-systems-wic1200
CVE ID: CVE-2024-0556 State: PUBLISHED Published: 2024-01-16T10:10:58.438Z Last Updated: 2024-11-13T20:18:15.269Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N) Vendors: Full Compass Systems Products: WIC1200 Problem Types: CWE-261 Description: A Weak Cryptography for Passwords vulnerability has been detected on WIC200 affecting version 1.1. This vulnerability allows a remote user to intercept the traffic and retrieve the credentials from another user and decode it in base64 allowing the attacker to see the credentials in plain text. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/a
st Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-full-compass-systems-wic1200
CVE ID: CVE-2024-0557 State: PUBLISHED Published: 2024-01-15T16:31:03.584Z Last Updated: 2025-05-09T16:07:00.478Z Severity: N/A (CVSS 3.3 AV:N/AC:L/Au:M/C:N/I:P/A:N) Vendors: n/a Products: DedeBIZ Problem Types: CWE-79 Description: A vulnerability, which was classified as problematic, was found in DedeBIZ 6.3.0. This affects an unknown part of the component Website Copyright Setting. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-250725 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Ad
ned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.250725 - https://vuldb.com/?ctiid.250725 - https://github.com/JTZ-a/SRC/blob/master/DedeBIZ/DedeBIZ%20-%20StoredXSS/README.md
CVE ID: CVE-2024-0558 State: PUBLISHED Published: 2024-01-15T17:00:06.687Z Last Updated: 2025-06-11T20:10:46.486Z Severity: N/A (CVSS 5.8 AV:N/AC:L/Au:M/C:P/I:P/A:P) Vendors: n/a Products: DedeBIZ Problem Types: CWE-89 Description: A vulnerability has been found in DedeBIZ 6.3.0 and classified as critical. This vulnerability affects unknown code of the file /admin/makehtml_freelist_action.php. The manipulation of the argument startid leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-250726 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respon
identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.250726 - https://vuldb.com/?ctiid.250726 - https://github.com/JTZ-a/SRC/blob/master/DedeBIZ/DedeBIZ%20-%20sqli%201/README.md
CVE ID: CVE-2024-0559 State: PUBLISHED Published: 2024-03-11T17:56:05.059Z Last Updated: 2025-03-20T18:48:42.335Z Vendors: Unknown Products: Enhanced Text Widget Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Enhanced Text Widget WordPress plugin before 1.6.6 does not validate and escape some of its Widget options before outputting them back in attributes, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/b257daf2-95
lyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/b257daf2-9540-4a0f-a560-54b47d2b913f/ - https://research.cleantalk.org/cve-2024-0559/
CVE ID: CVE-2024-0560 State: PUBLISHED Published: 2024-02-28T16:37:01.247Z Last Updated: 2025-11-20T18:09:12.702Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: Red Hat Products: Red Hat 3scale API Management Platform 2 Problem Types: CWE-280 Description: A vulnerability was found in 3Scale, when used with Keycloak 15 (or RHSSO 7.5.0) and superiors. When the auth_type is use_3scale_oidc_issuer_endpoint, the Token Introspection policy discovers the Token Introspection endpoint from the token_introspection_endpoint field, but the field was removed on RH-SSO 7.5. As a result, the policy doesn't inspect tokens, it determines that all tokens are valid. Additiona
emoved on RH-SSO 7.5. As a result, the policy doesn't inspect tokens, it determines that all tokens are valid. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://access.redhat.com/security/cve/CVE-2024-0560 - https://bugzilla.redhat.com/show_bug.cgi?id=2258456 - https://github.com/3scale/APIcast/pull/1438
CVE ID: CVE-2024-0561 State: PUBLISHED Published: 2024-03-11T17:56:07.112Z Last Updated: 2024-10-31T14:12:59.580Z Vendors: Unknown Products: Ultimate Posts Widget Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Ultimate Posts Widget WordPress plugin before 2.3.1 does not validate and escape some of its Widget options before outputting them back in attributes, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://wpscan.com/vulnerability/99b6aa8b-
nalyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://wpscan.com/vulnerability/99b6aa8b-deb9-48f8-8896-f3c8118a4f70/