Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-37262 State: PUBLISHED Published: 2024-07-22T09:02:49.521Z Last Updated: 2024-08-02T03:50:55.230Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: vCita.com Products: Online Booking & Scheduling Calendar for WordPress by vcita Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in vCita.Com Online Booking & Scheduling Calendar for WordPress by vcita allows Reflected XSS.This issue affects Online Booking & Scheduling Calendar for WordPress by vcita: from n/a through 4.4.2. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References
by vcita: from n/a through 4.4.2. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/meeting-scheduler-by-vcita/wordpress-online-booking-scheduling-calendar-plugin-4-4-2-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2024-37263 State: PUBLISHED Published: 2024-07-22T08:49:15.438Z Last Updated: 2024-08-02T03:50:55.543Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: ThemeLooks Products: Enter Addons Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in ThemeLooks Enter Addons enteraddons allows Stored XSS.This issue affects Enter Addons: from n/a through 2.1.6. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/enteraddons/wordpress-enter-addons-ultimate-template-builder-for-elementor-plu
s://patchstack.com/database/vulnerability/enteraddons/wordpress-enter-addons-ultimate-template-builder-for-elementor-plugin-2-1-6-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2024-37264 State: PUBLISHED Published: 2024-07-22T08:48:08.191Z Last Updated: 2024-08-02T03:50:56.095Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: Groundhogg Inc. Products: Groundhogg Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Groundhogg Inc. Groundhogg allows Reflected XSS.This issue affects Groundhogg: from n/a through 3.4.2.3. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/groundhogg/wordpress-groundhogg-plugin-3-4-2-3-reflected-cross-site-scripting-xss-v
atchstack.com/database/vulnerability/groundhogg/wordpress-groundhogg-plugin-3-4-2-3-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2024-37265 State: PUBLISHED Published: 2024-07-22T08:47:02.438Z Last Updated: 2024-08-02T03:50:55.860Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: Martin Gibson Products: IdeaPush Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Martin Gibson IdeaPush allows Stored XSS.This issue affects IdeaPush: from n/a through 8.60. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/ideapush/wordpress-ideapush-plugin-8-60-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2024-37266 State: PUBLISHED Published: 2024-07-09T10:08:37.139Z Last Updated: 2024-08-02T03:50:55.711Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) Vendors: Themeum Products: Tutor LMS Problem Types: CWE-22 Description: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Themeum Tutor LMS allows Path Traversal.This issue affects Tutor LMS: from n/a through 2.7.1. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/tutor/wordpress-tutor-lms-plugin-2-7-1-path-traversal-vulnerability?_s_id=cve
CVE ID: CVE-2024-37267 State: PUBLISHED Published: 2024-07-22T08:45:58.641Z Last Updated: 2024-08-02T03:50:55.700Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: kaptinlin Products: Striking Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in kaptinlin Striking allows Reflected XSS.This issue affects Striking: from n/a through 2.3.4. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/striking-r/wordpress-striking-theme-2-3-4-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2024-37268 State: PUBLISHED Published: 2024-07-09T10:10:11.290Z Last Updated: 2024-08-02T03:50:56.073Z Severity: HIGH (CVSS 8.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: kaptinlin Products: Striking Problem Types: CWE-22 Description: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in kaptinlin Striking allows Path Traversal.This issue affects Striking: from n/a through 2.3.4. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/striking-r/wordpress-striking-theme-2-3-4-local-file-inclusion-vulnerability?_s_id=cve
CVE ID: CVE-2024-37269 State: PUBLISHED Published: 2024-11-01T14:18:28.070Z Last Updated: 2024-11-01T18:13:36.939Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: StylemixThemes Products: Masterstudy Elementor Widgets Problem Types: CWE-862 Description: Missing Authorization vulnerability in StylemixThemes Masterstudy Elementor Widgets allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Masterstudy Elementor Widgets: from n/a through 1.2.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/masterstudy-elementor-widgets/wordpress-masterstudy-elementor-widgets-p
- https://patchstack.com/database/vulnerability/masterstudy-elementor-widgets/wordpress-masterstudy-elementor-widgets-plugin-1-2-2-unauthenticated-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2024-37270 State: PUBLISHED Published: 2024-07-10T17:49:24.457Z Last Updated: 2024-08-02T03:50:56.096Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: TrustedLogin Products: TrustedLogin Vendor Problem Types: CWE-532 Description: Insertion of Sensitive Information into Log File vulnerability in TrustedLogin TrustedLogin Vendor.This issue affects TrustedLogin Vendor: from n/a before 1.1.1. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/vendor/wordpress-trustedlogin-vendor-plugin-1-1-1-sensitive-data-exposure-vulnerability?_s_id=cve
CVE ID: CVE-2024-37271 State: PUBLISHED Published: 2024-07-22T08:44:48.776Z Last Updated: 2024-08-02T03:50:55.963Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: Michael Nelson Products: Print My Blog Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Michael Nelson Print My Blog allows Stored XSS.This issue affects Print My Blog: from n/a through 3.27.0. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/print-my-blog/wordpress-print-my-blog-plugin-3-27-0-cross-site-scripting-xss-v
s://patchstack.com/database/vulnerability/print-my-blog/wordpress-print-my-blog-plugin-3-27-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2024-37272 State: PUBLISHED Published: 2025-01-02T12:00:46.032Z Last Updated: 2025-01-02T14:52:06.678Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: WP Travel Engine Products: Travel Monster Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in WP Travel Engine Travel Monster allows Cross Site Request Forgery.This issue affects Travel Monster: from n/a through 1.1.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/theme/travel-monster/vulnerability/wordpress-travel-monster-theme-1-1-2-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2024-37273 State: PUBLISHED Published: 2024-06-04T18:26:07.231Z Last Updated: 2025-02-13T15:59:48.602Z Vendors: n/a Products: n/a Problem Types: n/a Description: An arbitrary file upload vulnerability in the /v1/app/appendFileSync interface of Jan v0.4.12 allows attackers to execute arbitrary code via uploading a crafted file. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/HackAllSec/CVEs/tree/main/Jan%20Arbitrary%20File%20Upload%20vulnerability
CVE ID: CVE-2024-37274 State: PUBLISHED Published: 2025-01-02T12:00:46.649Z Last Updated: 2025-01-02T14:52:06.551Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: Freshlight Lab Products: WP Mobile Menu Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Freshlight Lab WP Mobile Menu allows Cross Site Request Forgery.This issue affects WP Mobile Menu: from n/a through 2.8.4.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/mobile-menu/vulnerability/wordpress-wp-mobile-menu-the-mobile-friendly-responsive-menu-plugin-2-8-4-3-cross-site-request-forgery-csrf-vul
rability/wordpress-wp-mobile-menu-the-mobile-friendly-responsive-menu-plugin-2-8-4-3-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2024-37275 State: PUBLISHED Published: 2024-07-22T08:43:31.809Z Last Updated: 2024-08-02T03:50:55.954Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: NextScripts Products: NextScripts Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in NextScripts allows Reflected XSS.This issue affects NextScripts: from n/a through 4.4.6. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/social-networks-auto-poster-facebook-twitter-g/wordpress-nextscripts-plugin-4-4-6-reflected-cross-site
ase/vulnerability/social-networks-auto-poster-facebook-twitter-g/wordpress-nextscripts-plugin-4-4-6-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2024-37276 State: PUBLISHED Published: 2024-11-01T14:18:27.403Z Last Updated: 2024-11-01T17:27:52.714Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: fifu.app Products: Featured Image from URL Problem Types: CWE-862 Description: Missing Authorization vulnerability in fifu.App Featured Image from URL allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Featured Image from URL: from n/a through 4.8.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/featured-image-from-url/wordpress-featured-image-from-url-fifu-plugin-4-8-1-broken-access-control-vul
base/vulnerability/featured-image-from-url/wordpress-featured-image-from-url-fifu-plugin-4-8-1-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2024-37277 State: PUBLISHED Published: 2024-11-01T14:18:26.766Z Last Updated: 2024-11-01T18:01:58.224Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) Vendors: Paid Memberships Pro Products: Paid Memberships Pro Problem Types: CWE-639 Description: Authorization Bypass Through User-Controlled Key vulnerability in Paid Memberships Pro allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Paid Memberships Pro: from n/a through 3.0.4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/paid-memberships-pro/wordpress-paid-memberships-pro-plugin-3-0-4-insecure-direct-object-re
ck.com/database/vulnerability/paid-memberships-pro/wordpress-paid-memberships-pro-plugin-3-0-4-insecure-direct-object-references-idor-vulnerability?_s_id=cve
CVE ID: CVE-2024-37278 State: PUBLISHED Published: 2024-07-22T08:41:29.176Z Last Updated: 2024-08-02T03:50:56.104Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: Pratik Chaskar Products: Cards for Beaver Builder Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Pratik Chaskar Cards for Beaver Builder.This issue affects Cards for Beaver Builder: from n/a through 1.1.4. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/bb-bootstrap-cards/wordpress-cards-for-beaver-builder-plugin-1-1
rences: - https://patchstack.com/database/vulnerability/bb-bootstrap-cards/wordpress-cards-for-beaver-builder-plugin-1-1-4-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2024-37279 State: PUBLISHED Published: 2024-06-13T17:04:41.737Z Last Updated: 2025-03-13T15:59:46.351Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: Elastic Products: Kibana Description: A flaw was discovered in Kibana, allowing view-only users of alerting to use the run_soon API making the alerting rule run continuously, potentially affecting the system availability if the alerting rule is running complex queries. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://discuss.elastic.co/t/kibana-8-14-0-security-update-esa-2024-15/360887
CVE ID: CVE-2024-37280 State: PUBLISHED Published: 2024-06-13T16:26:57.983Z Last Updated: 2024-08-16T17:02:41.347Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H) Vendors: Elastic Products: Elasticsearch Problem Types: CWE-122 Description: A flaw was discovered in Elasticsearch, affecting document ingestion when an index template contains a dynamic field mapping of “passthrough” type. Under certain circumstances, ingesting documents in this index would cause a StackOverflow exception to be thrown and ultimately lead to a Denial of Service. Note that passthrough fields is an experimental feature. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Contain
passthrough fields is an experimental feature. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://discuss.elastic.co/t/elasticsearch-8-14-0-security-update-esa-2024-14/361007
CVE ID: CVE-2024-37281 State: PUBLISHED Published: 2024-07-30T21:45:36.488Z Last Updated: 2024-08-02T03:50:55.963Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: Elastic Products: Kibana Problem Types: CWE-400 Description: An issue was discovered in Kibana where a user with Viewer role could cause a Kibana instance to crash by sending a large number of maliciously crafted requests to a specific endpoint. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://discuss.elastic.co/t/kibana-7-17-23-8-14-0-security-update-esa-2024-16/364094
CVE ID: CVE-2024-37282 State: PUBLISHED Published: 2024-06-28T04:58:18.200Z Last Updated: 2024-08-02T03:50:55.693Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Elastic Products: Elastic Cloud Enterprise Problem Types: CWE-285 Description: It was identified that under certain specific preconditions, an API key that was originally created with a specific privileges could be subsequently used to create new API keys that have elevated privileges. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://discuss.elastic.co/t/elastic-cloud-enterprise-3-7-2-security-update-esa-2024-18/362181
CVE ID: CVE-2024-37283 State: PUBLISHED Published: 2024-08-08T23:34:22.070Z Last Updated: 2024-08-09T15:34:02.839Z Vendors: Elastic Products: Elastic Agent Problem Types: CWE-532 Description: An issue was discovered whereby Elastic Agent will leak secrets from the agent policy elastic-agent.yml only when the log level is configured to debug. By default the log level is set to info, where no leak occurs. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://discuss.elastic.co/t/elastic-agent-8-15-0-security-update-esa-2024-23/364635
CVE ID: CVE-2024-37284 State: PUBLISHED Published: 2025-01-21T10:56:14.762Z Last Updated: 2025-01-21T16:32:03.006Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) Vendors: Elastic Products: Elastic Defend Problem Types: CWE-755 Description: Improper handling of alternate encoding occurs when Elastic Defend on Windows systems attempts to scan a file or process encoded as a multibyte character. This leads to an uncaught exception causing Elastic Defend to crash which in turn will prevent it from quarantining the file and/or killing the process. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://discuss.elastic.co/t/elastic-defend-8-13-3-security-u
onal Analyst Notes: - CISA ADP Vulnrichment: References: - https://discuss.elastic.co/t/elastic-defend-8-13-3-security-update-esa-2024-24/373441
CVE ID: CVE-2024-37285 State: PUBLISHED Published: 2024-11-14T16:49:16.594Z Last Updated: 2024-11-14T18:48:27.837Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: Elastic Products: Kibana Problem Types: CWE-502 Description: A deserialization issue in Kibana can lead to arbitrary code execution when Kibana attempts to parse a YAML document containing a crafted payload. A successful attack requires a malicious user to have a combination of both specific Elasticsearch indices privileges https://www.elastic.co/guide/en/elasticsearch/reference/current/defining-roles.html#roles-indices-priv and Kibana privileges https://www.elastic.co/guide/en/fleet/current/flee
/current/defining-roles.html#roles-indices-priv and Kibana privileges https://www.elastic.co/guide/en/fleet/current/fleet-roles-and-privileges.html assigned to them. The following Elasticsearch indices permissions are required * write privilege on the system indices .kibana_ingest* * The allow_restricted_indices flag is set to true Any of the following Kibana privileges are additionally required * Under Fleet the All privilege is granted * Under Integration the Read or All privilege is granted * Access to the fleet-setup privilege is gained through the Fleet Server’s service account token Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://discuss.elastic.co/t/kibana-8-1
e account token Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://discuss.elastic.co/t/kibana-8-15-1-security-update-esa-2024-27-esa-2024-28/366119
CVE ID: CVE-2024-37286 State: PUBLISHED Published: 2024-08-03T15:16:22.700Z Last Updated: 2024-09-03T15:36:33.784Z Severity: MEDIUM (CVSS 5.7 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: Elastic Products: APM Server Problem Types: CWE-532 Description: APM server logs contain document body from a partially failed bulk index request. For example, in case of unavailable_shards_exception for a specific document, since the ES response line contains the document body, and that APM server logs the ES response line on error, the document is effectively logged. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://discuss.elastic.co/t/apm-server-8-14-0-security-update-esa
Analyst Notes: - CISA ADP Vulnrichment: References: - https://discuss.elastic.co/t/apm-server-8-14-0-security-update-esa-2024-19/364289
CVE ID: CVE-2024-37287 State: PUBLISHED Published: 2024-08-13T11:33:45.520Z Last Updated: 2024-08-13T13:35:02.988Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: Elastic Products: Kibana Problem Types: CWE-94 Description: A flaw allowing arbitrary code execution was discovered in Kibana. An attacker with access to ML and Alerting connector features, as well as write access to internal ML indices can trigger a prototype pollution vulnerability, ultimately leading to arbitrary code execution. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://discuss.elastic.co/t/kibana-8-14-2-7-17-23-security-update-esa-2024-22/
CVE ID: CVE-2024-37288 State: PUBLISHED Published: 2024-09-09T08:29:51.918Z Last Updated: 2024-09-17T13:04:21.866Z Severity: CRITICAL (CVSS 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: Elastic Products: Kibana Problem Types: CWE-502 Description: A deserialization issue in Kibana can lead to arbitrary code execution when Kibana attempts to parse a YAML document containing a crafted payload. This issue only affects users that use Elastic Security’s built-in AI tools https://www.elastic.co/guide/en/security/current/ai-for-security.html and have configured an Amazon Bedrock connector https://www.elastic.co/guide/en/security/current/assistant-connect-to-bedrock.html . Additional Ana
on Bedrock connector https://www.elastic.co/guide/en/security/current/assistant-connect-to-bedrock.html . Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://discuss.elastic.co/t/kibana-8-15-1-security-update-esa-2024-27-esa-2024-28/366119
CVE ID: CVE-2024-37289 State: PUBLISHED Published: 2024-06-10T21:22:34.551Z Last Updated: 2025-03-14T19:24:42.697Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Trend Micro, Inc. Products: Trend Micro Apex One, Trend Micro Apex One as a Service Description: An improper access control vulnerability in Trend Micro Apex One could allow a local attacker to escalate privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://success.trendmicro.
y. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://success.trendmicro.com/dcx/s/solution/000298063 - https://www.zerodayinitiative.com/advisories/ZDI-24-577/
CVE ID: CVE-2024-37293 State: PUBLISHED Published: 2024-06-11T16:49:33.651Z Last Updated: 2024-08-02T03:50:55.744Z Severity: HIGH (CVSS 7.6 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: awslabs Products: aws-deployment-framework Problem Types: CWE-266 Description: The AWS Deployment Framework (ADF) is a framework to manage and deploy resources across multiple AWS accounts and regions within an AWS Organization. ADF allows for staged, parallel, multi-account, cross-region deployments of applications or resources via the structure defined in AWS Organizations while taking advantage of services such as AWS CodePipeline, AWS CodeBuild, and AWS CodeCommit to alleviate the heavy lifting a
aking advantage of services such as AWS CodePipeline, AWS CodeBuild, and AWS CodeCommit to alleviate the heavy lifting and management compared to a traditional CI/CD setup. ADF contains a bootstrap process that is responsible to deploy ADF's bootstrap stacks to facilitate multi-account cross-region deployments. The ADF bootstrap process relies on elevated privileges to perform this task. Two versions of the bootstrap process exist; a code-change driven pipeline using AWS CodeBuild and an event-driven state machine using AWS Lambda. If an actor has permissions to change the behavior of the CodeBuild project or the Lambda function, they would be able to escalate their privileges. Prior to vers