Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-12201 State: PUBLISHED Published: 2024-12-12T06:46:34.430Z Last Updated: 2024-12-12T14:43:46.473Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: hashthemes Products: Hash Form – Drag & Drop Form Builder Problem Types: CWE-862 Description: The Hash Form – Drag & Drop Form Builder plugin for WordPress is vulnerable to unauthorized access due to a missing capability check when creating form styles in all versions up to, and including, 1.2.1. This makes it possible for authenticated attackers, with Contributor-level access and above, to create new form styles. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfenc
above, to create new form styles. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/bb81b2ce-583b-411c-b0f5-a233e0d1986b?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3205245%40hash-form&new=3205245%40hash-form&sfp_email=&sfph_mail=
CVE ID: CVE-2024-12202 State: PUBLISHED Published: 2025-01-07T07:22:33.123Z Last Updated: 2025-01-07T15:57:20.537Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: IronTemplates Products: Croma Music Problem Types: CWE-862 Description: The Croma Music plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the 'ironMusic_ajax' function in all versions up to, and including, 3.6. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update arbitrary options on the WordPress site. This can be leveraged to update the default role for r
ess and above, to update arbitrary options on the WordPress site. This can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/4ce8e0f1-5a7b-41a3-81d0-7fd12c9da6d9?source=cve - https://croma.irontemplates.com/lowtempo/wp-content/themes/croma/changelog.txt
CVE ID: CVE-2024-12203 State: PUBLISHED Published: 2025-01-17T07:01:29.571Z Last Updated: 2025-02-12T16:52:43.469Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N) Vendors: brandondove Products: RSS Icon Widget Problem Types: CWE-79 Description: The RSS Icon Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘link_color’ parameter in all versions up to, and including, 5.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-
ect arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/fbd8fec7-c95a-4c03-ac0d-894a54906863?source=cve - https://plugins.trac.wordpress.org/browser/rss-icon-widget/trunk/rss-icon-widget.php#L83 - https://plugins.trac.wordpress.org/browser/rss-icon-widget/trunk/rss-icon-widget.php#L195
CVE ID: CVE-2024-12204 State: PUBLISHED Published: 2025-01-11T02:20:55.309Z Last Updated: 2025-01-13T19:37:50.979Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) Vendors: galdub Products: Coupon X: Discount Pop Up, Promo Code Pop Ups, Announcement Pop Up, WooCommerce Popups Problem Types: CWE-862 Description: The Coupon X: Discount Pop Up, Promo Code Pop Ups, Announcement Pop Up, WooCommerce Popups plugin for WordPress is vulnerable to unauthorized access due to missing capability checks on several functions in the class-cx-rest.php file in all versions up to, and including, 1.3.5. This makes it possible for authenticated attackers, with Subscriber-level access and
sions up to, and including, 1.3.5. This makes it possible for authenticated attackers, with Subscriber-level access and above, to create 100% off coupons, delete posts, delete leads, and update coupon statuses. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/e52d8b5e-727f-474a-a255-c24033db17d8?source=cve - https://plugins.trac.wordpress.org/changeset/3219466/coupon-x-discount-pop-up/trunk/inc/class-cx-rest.php
CVE ID: CVE-2024-12205 State: PUBLISHED Published: 2025-01-08T04:17:58.274Z Last Updated: 2025-01-08T14:41:14.679Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: themesflat Products: Themesflat Addons For Elementor Problem Types: CWE-79 Description: The Themesflat Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the TF E Slider Widget in all versions up to, and including, 2.2.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an in
ibutor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/45c6c041-91b0-4abe-ba72-ec1251651fdb?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3215859%40themesflat-addons-for-elementor&new=3215859%40themesflat-addons-for-elementor&sfp_email=&sfph_mail=
CVE ID: CVE-2024-12206 State: PUBLISHED Published: 2025-01-09T11:10:57.161Z Last Updated: 2025-01-09T14:50:01.350Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: stylemix Products: WordPress Header Builder Plugin – Pearl Problem Types: CWE-352 Description: The WordPress Header Builder Plugin – Pearl plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.3.8. This is due to missing or incorrect nonce validation on the stm_header_builder page. This makes it possible for unauthenticated attackers to delete arbitrary headers via a forged request granted they can trick a site administrator into performing an acti
ers to delete arbitrary headers via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/4de0d05f-2f51-4fea-9520-ff07a882d95e?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3218670%40pearl-header-builder&new=3218670%40pearl-header-builder&sfp_email=&sfph_mail=
CVE ID: CVE-2024-12207 State: PUBLISHED Published: 2025-01-07T04:22:13.206Z Last Updated: 2025-01-07T16:22:22.335Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N) Vendors: otwthemes Products: Toggles Shortcode and Widget Problem Types: CWE-79 Description: The Toggles Shortcode and Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘content’ parameter in all versions up to, and including, 1.14 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Th
r-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/755c8863-33c2-47aa-880a-0ef8b2d594a3?source=cve - https://plugins.trac.wordpress.org/browser/toggles-shortcode-and-widget/trunk/include/otw_components/otw_shortcode/shortcodes/otw_shortcode_content_toggle.class.php#L246
CVE ID: CVE-2024-12208 State: REJECTED Published: 2025-01-07T04:22:21.646Z Last Updated: 2025-01-17T16:51:27.104Z Description: No description available.
CVE ID: CVE-2024-12209 State: PUBLISHED Published: 2024-12-08T05:25:16.114Z Last Updated: 2024-12-09T15:54:53.710Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: wphealth Products: WP Umbrella: Update Backup Restore & Monitoring Problem Types: CWE-98 Description: The WP Umbrella: Update Backup Restore & Monitoring plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.17.0 via the 'filename' parameter of the 'umbrella-restore' action. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used t
ude and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/c74ce3e8-cab9-4cc6-a1ad-1e51f7268474?source=cve - https://plugins.trac.wordpress.org/browser/wp-health/tags/v2.16.4/src/Actions/RestoreRouter.php#L45 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3202883%40wp-health&new=3202883%40wp-health&sfp_email=&sfph_mail=
CVE ID: CVE-2024-12210 State: PUBLISHED Published: 2024-12-24T05:23:43.614Z Last Updated: 2024-12-24T16:34:52.979Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: tychesoftwares Products: Print Invoice & Delivery Notes for WooCommerce Problem Types: CWE-862 Description: The Print Invoice & Delivery Notes for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'wcdn_remove_shoplogo' AJAX action in all versions up to, and including, 5.4.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to remove the shop's logo. Additional Analyst Notes: - CISA
enticated attackers, with Subscriber-level access and above, to remove the shop's logo. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/8883d4fe-3ca6-4591-9972-219b114126d3?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3209682%40woocommerce-delivery-notes&new=3209682%40woocommerce-delivery-notes&sfp_email=&sfph_mail=
CVE ID: CVE-2024-12211 State: PUBLISHED Published: 2025-01-13T16:14:59.224Z Last Updated: 2025-08-26T19:58:08.100Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) Vendors: Pegasystems Products: Pega Infinity Problem Types: CWE-79 Description: Pega Platform versions 8.1 to Infinity 24.2.0 are affected by an Stored XSS issue with profile. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.pega.com/support-doc/pega-security-advisory-f24-vulnerability-remediation-note
CVE ID: CVE-2024-12212 State: PUBLISHED Published: 2024-12-13T00:50:45.290Z Last Updated: 2024-12-13T21:14:45.265Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Horner Automation Products: Cscape Problem Types: CWE-125 Description: The vulnerability occurs in the parsing of CSP files. The issues result from the lack of proper validation of user-supplied data, which could allow reading past the end of allocated data structures, resulting in execution of arbitrary code. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-24-345-05 - https://hornerautomation.com/cscape-software-free/cscape-softwa
www.cisa.gov/news-events/ics-advisories/icsa-24-345-05 - https://hornerautomation.com/cscape-software-free/cscape-software/
CVE ID: CVE-2024-12213 State: PUBLISHED Published: 2025-02-12T09:22:49.896Z Last Updated: 2025-02-12T16:08:13.748Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: http://apusthemes.com/ Products: WP Job Board Pro Problem Types: CWE-266 Description: The WP Job Board Pro plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 1.2.76. This is due to the plugin allowing a user to supply the 'role' field when registering. This makes it possible for unauthenticated attackers to register as an administrator on vulnerable sites. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threa
or on vulnerable sites. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/7cdfce88-b6c2-4820-9d6f-446f61b9b596?source=cve - https://themeforest.net/item/superio-job-board-wordpress-theme/32180231
CVE ID: CVE-2024-12214 State: PUBLISHED Published: 2025-01-07T04:21:57.210Z Last Updated: 2025-01-07T16:25:22.605Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: hoststreamsell Products: WooCommerce HSS Extension for Streaming Video Problem Types: CWE-79 Description: The WooCommerce HSS Extension for Streaming Video plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘videolink’ parameter in all versions up to, and including, 3.31 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user
r unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/1d633f71-3b2b-4fe3-80f1-4c2dcc86313c?source=cve - https://wordpress.org/plugins/woocommerce-hss-extension-for-streaming-video/#developers
CVE ID: CVE-2024-12215 State: PUBLISHED Published: 2025-03-20T10:11:39.404Z Last Updated: 2025-10-15T12:49:30.535Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: kedro-org Products: kedro-org/kedro Problem Types: CWE-94 Description: In kedro-org/kedro version 0.19.8, the `pull_package()` API function allows users to download and extract micro packages from the Internet. However, the function `project_wheel_metadata()` within the code path can execute the `setup.py` file inside the tar file, leading to remote code execution (RCE) by running arbitrary commands on the victim's machine. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://hunt
rbitrary commands on the victim's machine. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/fad27503-97a4-4933-91d4-96223b8c54d8
CVE ID: CVE-2024-12216 State: PUBLISHED Published: 2025-03-20T10:09:30.436Z Last Updated: 2025-10-15T12:50:16.527Z Severity: HIGH (CVSS 7.1 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H) Vendors: dmlc Products: dmlc/gluon-cv Problem Types: CWE-59 Description: A vulnerability in the `ImageClassificationDataset.from_csv()` API of the `dmlc/gluon-cv` repository, version 0.10.0, allows for arbitrary file write. The function downloads and extracts `tar.gz` files from URLs without proper sanitization, making it susceptible to a TarSlip vulnerability. Attackers can exploit this by crafting malicious tar files that, when extracted, can overwrite files on the victim's system via path traversal or fake
crafting malicious tar files that, when extracted, can overwrite files on the victim's system via path traversal or faked symlinks. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/46081fdc-2951-4deb-a2c9-2627007bdce0
CVE ID: CVE-2024-12217 State: PUBLISHED Published: 2025-03-20T10:11:08.996Z Last Updated: 2025-03-20T15:14:58.726Z Severity: MEDIUM (CVSS 5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: gradio-app Products: gradio-app/gradio Problem Types: CWE-22 Description: A vulnerability in the gradio-app/gradio repository, version git 67e4044, allows for path traversal on Windows OS. The implementation of the blocked_path functionality, which is intended to disallow users from reading certain files, is flawed. Specifically, while the application correctly blocks access to paths like 'C:/tmp/secret.txt', it fails to block access when using NTFS Alternate Data Streams (ADS) syntax, such as 'C:/
ths like 'C:/tmp/secret.txt', it fails to block access when using NTFS Alternate Data Streams (ADS) syntax, such as 'C:/tmp/secret.txt::$DATA'. This flaw can lead to unauthorized reading of blocked file paths. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/0439bf3d-cb38-43a5-8314-0fadf85cc5a0
CVE ID: CVE-2024-12218 State: PUBLISHED Published: 2025-01-09T11:10:58.656Z Last Updated: 2025-01-09T14:48:11.159Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: phoeniixx Products: Woocommerce check pincode/zipcode for shipping Problem Types: CWE-352 Description: The Woocommerce check pincode/zipcode for shipping plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0.4. This is due to missing or incorrect nonce validation. This makes it possible for unauthenticated attackers to inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as c
licious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/5b79b5ae-7ce5-4065-8d7c-487df6752bc7?source=cve - https://plugins.trac.wordpress.org/browser/woocommerce-check-pincode-zipcode-for-shipping/trunk/classes/pincode-list.php#L93 - https://wordpress.org/plugins/woocommerce-check-pincode-zipcode-for-shipping/#developers
CVE ID: CVE-2024-12219 State: PUBLISHED Published: 2024-12-17T07:23:15.247Z Last Updated: 2024-12-17T14:36:50.667Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: tomroyal Products: Stop Registration Spam Problem Types: CWE-352 Description: The Stop Registration Spam plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.23. This is due to missing or incorrect nonce validation. This makes it possible for unauthenticated attackers to inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CIS
hey can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/2d5fb4ac-f86e-4b5e-ad4b-be19158ab745?source=cve - https://wordpress.org/plugins/stop-registration-spam/#developers - https://plugins.trac.wordpress.org/changeset/3206562/
CVE ID: CVE-2024-12220 State: PUBLISHED Published: 2024-12-17T07:23:15.854Z Last Updated: 2024-12-17T14:37:15.184Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: theafricanboss Products: SMS for WooCommerce Problem Types: CWE-352 Description: The SMS for WooCommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.8.1. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analy
quest granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/35707e4e-ca67-43fe-b120-79101ef31155?source=cve - https://wordpress.org/plugins/wc-sms/#developers - https://plugins.trac.wordpress.org/changeset/3207316/
CVE ID: CVE-2024-12221 State: PUBLISHED Published: 2025-01-04T09:22:37.090Z Last Updated: 2025-01-06T16:34:21.958Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: wpweaver Products: Turnkey bbPress by WeaverTheme Problem Types: CWE-79 Description: The Turnkey bbPress by WeaverTheme plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘_wpnonce’ parameter in all versions up to, and including, 1.6.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as cl
t arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/35c608c3-9c28-4e0d-b0ec-d0a279fccd3b?source=cve - https://wordpress.org/plugins/weaver-for-bbpress/ - https://plugins.trac.wordpress.org/changeset/3209473/
CVE ID: CVE-2024-12222 State: PUBLISHED Published: 2025-01-09T11:10:55.725Z Last Updated: 2025-01-09T14:46:43.360Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: amitrotem Products: Deliver via Shipos for WooCommerce Problem Types: CWE-79 Description: The Deliver via Shipos for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘dvsfw_bulk_label_url’ parameter in all versions up to, and including, 2.1.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing
ed attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/377afb95-02d9-46b9-936d-3d58257dd928?source=cve - https://wordpress.org/plugins/wc-shipos-delivery/#developers
CVE ID: CVE-2024-12223 State: PUBLISHED Published: 2025-08-20T00:44:56.421Z Last Updated: 2025-08-20T15:15:34.599Z Vendors: Nutanix Products: Prism Central Problem Types: CWE-79 Description: Prism Central versions prior to 2024.3.1 are vulnerable to a stored cross-site scripting attack via the Events component, allowing an attacker to hijack a victim user’s session and perform actions in their security context. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.themissinglink.com.au/security-advisories/cve-2024-12223
CVE ID: CVE-2024-12224 State: PUBLISHED Published: 2025-05-30T01:16:47.829Z Last Updated: 2025-05-30T12:46:56.887Z Vendors: servo Products: rust-url Problem Types: CWE-1289 Description: Improper Validation of Unsafe Equivalence in punycode by the idna crate from Servo rust-url allows an attacker to create a punycode hostname that one part of a system might treat as distinct while another part of that system would treat as equivalent to another hostname. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://rustsec.org/advisories/RUSTSEC-2024-0421.html - https://bugzilla.mozilla.org/show_bug.cgi?id=1887898