Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-56174 State: PUBLISHED Published: 2024-12-18T00:00:00 Last Updated: 2024-12-18T16:46:48.316Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Optimizely Configured Commerce before 5.2.2408, malicious payloads can be stored and subsequently executed in users' browsers under specific conditions: XSS from client-side template injection in search history. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.optimizely.com/hc/en-us/articles/32344323720973-Configured-Commerce-Security-Advisory-COM-2024-01
CVE ID: CVE-2024-56175 State: PUBLISHED Published: 2024-12-18T00:00:00 Last Updated: 2024-12-18T15:09:37.534Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Optimizely Configured Commerce before 5.2.2408, malicious payloads can be stored and subsequently executed in users' browsers under specific conditions: XSS from client-side template injection in list item names. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.optimizely.com/hc/en-us/articles/32344323720973-Configured-Commerce-Security-Advisory-COM-2024-01
CVE ID: CVE-2024-56178 State: PUBLISHED Published: 2025-01-27T00:00:00.000Z Last Updated: 2025-01-28T19:38:36.972Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Couchbase Server 7.6.x through 7.6.3. A user with the security_admin_local role can create a new user in a group that has the admin role. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.couchbase.com/alerts/
CVE ID: CVE-2024-56179 State: PUBLISHED Published: 2025-08-22T00:00:00.000Z Last Updated: 2025-08-22T14:51:36.166Z Vendors: n/a Products: n/a Problem Types: n/a Description: In MindManager Windows versions prior to 24.1.150, attackers could potentially write to unexpected directories in victims' machines via directory traversal if victims opened file attachments located in malicious mmap files. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://alludo.com - https://pastebin.com/Ax078JVF
CVE ID: CVE-2024-56180 State: PUBLISHED Published: 2025-02-14T13:34:26.600Z Last Updated: 2025-02-18T15:10:16.650Z Vendors: Apache Software Foundation Products: Apache EventMesh Problem Types: CWE-502 Description: CWE-502 Deserialization of Untrusted Data at the eventmesh-meta-raft plugin module in Apache EventMesh master branch without release version on windows\linux\mac os e.g. platforms allows attackers to send controlled message and remote code execute via hessian deserialization rpc protocol. Users can use the code under the master branch in project repo or version 1.11.0 to fix this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https:
11.0 to fix this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://lists.apache.org/thread/k9fw0t5r7t1vbx53gs8d1r8c54rhx0wd
CVE ID: CVE-2024-56181 State: PUBLISHED Published: 2025-03-11T09:48:03.703Z Last Updated: 2025-11-11T20:20:26.052Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: Siemens Products: SIMATIC Field PG M5, SIMATIC IPC BX-21A, SIMATIC IPC BX-32A, SIMATIC IPC BX-39A, SIMATIC IPC BX-59A, SIMATIC IPC PX-32A, SIMATIC IPC PX-39A, SIMATIC IPC PX-39A PRO, SIMATIC IPC RC-543A, SIMATIC IPC RC-543B, SIMATIC IPC RW-543A, SIMATIC IPC RW-543B, SIMATIC IPC127E, SIMATIC IPC227E, SIMATIC IPC227G, SIMATIC IPC277E, SIMATIC IPC277G, SIMATIC IPC277G PRO, SIMATIC IPC3000 SMART V3, SIMATIC IPC327G, SIMATIC IPC347G, SIMATIC IPC377G, SIMATIC IPC427E, SIMATIC IPC477E, SIMATIC IPC477E PRO,
000 SMART V3, SIMATIC IPC327G, SIMATIC IPC347G, SIMATIC IPC377G, SIMATIC IPC427E, SIMATIC IPC477E, SIMATIC IPC477E PRO, SIMATIC IPC527G, SIMATIC IPC627E, SIMATIC IPC647E, SIMATIC IPC677E, SIMATIC IPC847E, SIMATIC ITP1000 Problem Types: CWE-693 Description: A vulnerability has been identified in SIMATIC Field PG M5 (All versions), SIMATIC IPC BX-21A (All versions < V31.01.07), SIMATIC IPC BX-32A (All versions < V29.01.07), SIMATIC IPC BX-39A (All versions < V29.01.07), SIMATIC IPC BX-59A (All versions < V32.01.04), SIMATIC IPC PX-32A (All versions < V29.01.07), SIMATIC IPC PX-39A (All versions < V29.01.07), SIMATIC IPC PX-39A PRO (All versions < V29.01.07), SIMATIC IPC RC-543A (All versions),
X-39A (All versions < V29.01.07), SIMATIC IPC PX-39A PRO (All versions < V29.01.07), SIMATIC IPC RC-543A (All versions), SIMATIC IPC RC-543B (All versions), SIMATIC IPC RW-543A (All versions), SIMATIC IPC RW-543B (All versions), SIMATIC IPC127E (All versions), SIMATIC IPC227E (All versions), SIMATIC IPC227G (All versions < V28.01.14), SIMATIC IPC277E (All versions), SIMATIC IPC277G (All versions < V28.01.14), SIMATIC IPC277G PRO (All versions < V28.01.14), SIMATIC IPC3000 SMART V3 (All versions), SIMATIC IPC327G (All versions < V28.01.14), SIMATIC IPC347G (All versions), SIMATIC IPC377G (All versions < V28.01.14), SIMATIC IPC427E (All versions), SIMATIC IPC477E (All versions), SIMATIC IPC477
MATIC IPC377G (All versions < V28.01.14), SIMATIC IPC427E (All versions), SIMATIC IPC477E (All versions), SIMATIC IPC477E PRO (All versions), SIMATIC IPC527G (All versions), SIMATIC IPC627E (All versions < V25.02.15), SIMATIC IPC647E (All versions < V25.02.15), SIMATIC IPC677E (All versions < V25.02.15), SIMATIC IPC847E (All versions < V25.02.15), SIMATIC ITP1000 (All versions). The affected devices have insufficient protection mechanism for the EFI(Extensible Firmware Interface) variables stored on the device. This could allow an authenticated attacker to alter the secure boot configuration without proper authorization by directly communicate with the flash controller. Additional Analyst No
boot configuration without proper authorization by directly communicate with the flash controller. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/html/ssa-216014.html
CVE ID: CVE-2024-56182 State: PUBLISHED Published: 2025-03-11T09:48:05.319Z Last Updated: 2025-11-11T20:20:27.457Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: Siemens Products: SIMATIC Field PG M5, SIMATIC Field PG M6, SIMATIC IPC BX-21A, SIMATIC IPC BX-32A, SIMATIC IPC BX-39A, SIMATIC IPC BX-59A, SIMATIC IPC PX-32A, SIMATIC IPC PX-39A, SIMATIC IPC PX-39A PRO, SIMATIC IPC RC-543A, SIMATIC IPC RC-543B, SIMATIC IPC RW-543A, SIMATIC IPC RW-543B, SIMATIC IPC127E, SIMATIC IPC227E, SIMATIC IPC227G, SIMATIC IPC277E, SIMATIC IPC277G, SIMATIC IPC277G PRO, SIMATIC IPC3000 SMART V3, SIMATIC IPC327G, SIMATIC IPC347G, SIMATIC IPC377G, SIMATIC IPC427E, SIMATIC IPC477E,
77G PRO, SIMATIC IPC3000 SMART V3, SIMATIC IPC327G, SIMATIC IPC347G, SIMATIC IPC377G, SIMATIC IPC427E, SIMATIC IPC477E, SIMATIC IPC477E PRO, SIMATIC IPC527G, SIMATIC IPC627E, SIMATIC IPC647E, SIMATIC IPC677E, SIMATIC IPC847E, SIMATIC ITP1000 Problem Types: CWE-693 Description: A vulnerability has been identified in SIMATIC Field PG M5 (All versions), SIMATIC Field PG M6 (All versions < V26.01.12), SIMATIC IPC BX-21A (All versions < V31.01.07), SIMATIC IPC BX-32A (All versions < V29.01.07), SIMATIC IPC BX-39A (All versions < V29.01.07), SIMATIC IPC BX-59A (All versions < V32.01.04), SIMATIC IPC PX-32A (All versions < V29.01.07), SIMATIC IPC PX-39A (All versions < V29.01.07), SIMATIC IPC PX-39
.01.04), SIMATIC IPC PX-32A (All versions < V29.01.07), SIMATIC IPC PX-39A (All versions < V29.01.07), SIMATIC IPC PX-39A PRO (All versions < V29.01.07), SIMATIC IPC RC-543A (All versions), SIMATIC IPC RC-543B (All versions), SIMATIC IPC RW-543A (All versions), SIMATIC IPC RW-543B (All versions), SIMATIC IPC127E (All versions), SIMATIC IPC227E (All versions), SIMATIC IPC227G (All versions < V28.01.14), SIMATIC IPC277E (All versions), SIMATIC IPC277G (All versions < V28.01.14), SIMATIC IPC277G PRO (All versions < V28.01.14), SIMATIC IPC3000 SMART V3 (All versions), SIMATIC IPC327G (All versions < V28.01.14), SIMATIC IPC347G (All versions), SIMATIC IPC377G (All versions < V28.01.14), SIMATIC I
PC327G (All versions < V28.01.14), SIMATIC IPC347G (All versions), SIMATIC IPC377G (All versions < V28.01.14), SIMATIC IPC427E (All versions), SIMATIC IPC477E (All versions), SIMATIC IPC477E PRO (All versions), SIMATIC IPC527G (All versions), SIMATIC IPC627E (All versions < V25.02.15), SIMATIC IPC647E (All versions < V25.02.15), SIMATIC IPC677E (All versions < V25.02.15), SIMATIC IPC847E (All versions < V25.02.15), SIMATIC ITP1000 (All versions). The affected devices have insufficient protection mechanism for the EFI(Extensible Firmware Interface) variables stored on the device. This could allow an authenticated attacker to disable the BIOS password without proper authorization by directly c
vice. This could allow an authenticated attacker to disable the BIOS password without proper authorization by directly communicate with the flash controller. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/html/ssa-216014.html
CVE ID: CVE-2024-56184 State: PUBLISHED Published: 2025-03-10T18:19:48.793Z Last Updated: 2025-03-11T20:26:59.078Z Vendors: Google Products: Android Problem Types: Information disclosure Description: In static long dev_send of tipc_dev_ql, there is a possible out of bounds read due to an incorrect bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://source.android.com/security/bulletin/pixel/2025-03-01
CVE ID: CVE-2024-56185 State: PUBLISHED Published: 2025-03-10T18:19:48.977Z Last Updated: 2025-03-11T20:28:14.260Z Vendors: Google Products: Android Problem Types: Information disclosure Description: In ProtocolUnsolOnSSAdapter::GetServiceClass() of protocolcalladapter.cpp, there is a possible out-of-bounds read due to a missing bounds check. This could lead to local information disclosure with baseband firmware compromise required. User Interaction is not needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://source.android.com/security/bulletin/pixel/2025-03-01
CVE ID: CVE-2024-56186 State: PUBLISHED Published: 2025-03-10T18:19:49.138Z Last Updated: 2025-03-11T20:29:07.820Z Vendors: Google Products: Android Problem Types: Information disclosure Description: In closeChannel of secureelementimpl.cpp, there is a possible out of bounds read due to an incorrect bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://source.android.com/security/bulletin/pixel/2025-03-01
CVE ID: CVE-2024-56187 State: PUBLISHED Published: 2025-03-10T18:19:49.296Z Last Updated: 2025-03-11T20:30:28.848Z Vendors: Google Products: Android Problem Types: Information disclosure Description: In ppcfw_deny_sec_dram_access of ppcfw.c, there is a possible arbitrary read from TEE memory due to a logic error in the code. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://source.android.com/security/bulletin/pixel/2025-03-01
CVE ID: CVE-2024-56188 State: PUBLISHED Published: 2025-03-10T18:19:49.450Z Last Updated: 2025-03-11T20:32:10.132Z Vendors: Google Products: Android Problem Types: Denial of service Description: there is a possible way to crash the modem due to a missing null check. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://source.android.com/security/bulletin/pixel/2025-03-01
CVE ID: CVE-2024-56189 State: PUBLISHED Published: 2025-09-04T05:10:07.134Z Last Updated: 2025-09-08T17:25:07.571Z Vendors: Google Products: Android Problem Types: Information disclosure Description: In SAEMM_DiscloseMsId of SAEMM_RadioMessageCodec.c, there is a possible out of bounds read due to a missing bounds check. This could lead to remote information disclosure post authentication with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://source.android.com/security/bulletin/pixel/2025-04-01
CVE ID: CVE-2024-56190 State: PUBLISHED Published: 2025-09-04T05:10:34.652Z Last Updated: 2025-09-05T03:55:33.758Z Vendors: Google Products: Android Problem Types: Elevation of privilege Description: In wl_update_hidden_ap_ie() of wl_cfgscan.c, there is a possible out of bounds write due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://source.android.com/security/bulletin/pixel/2025-04-01
CVE ID: CVE-2024-56191 State: PUBLISHED Published: 2025-03-10T20:50:38.158Z Last Updated: 2025-09-04T05:13:37.621Z Vendors: Google Products: Android Problem Types: Elevation of privilege Description: In dhd_process_full_gscan_result of dhd_pno.c, there is a possible EoP due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://source.android.com/docs/security/bulletin/pixel-watch/2025/2025-03-01
CVE ID: CVE-2024-56192 State: PUBLISHED Published: 2025-03-10T20:50:38.419Z Last Updated: 2025-09-04T05:13:55.992Z Vendors: Google Products: Android Problem Types: Elevation of privilege Description: In wl_notify_gscan_event of wl_cfgscan.c, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://source.android.com/docs/security/bulletin/pixel-watch/2025/2025-03-01
CVE ID: CVE-2024-56193 State: PUBLISHED Published: 2025-05-27T15:41:27.429Z Last Updated: 2025-09-04T05:15:17.328Z Vendors: Google Products: Android Problem Types: Information disclosure Description: There is a possible disclosure of Bluetooth adapter details due to a permissions bypass. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://source.android.com/security/bulletin/pixel/2025-05-01
CVE ID: CVE-2024-56195 State: PUBLISHED Published: 2025-03-06T11:23:37.067Z Last Updated: 2025-03-06T15:37:24.745Z Vendors: Apache Software Foundation Products: Apache Traffic Server Problem Types: CWE-284 Description: Improper Access Control vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 9.2.0 through 9.2.8, from 10.0.0 through 10.0.3. Users are recommended to upgrade to version 9.2.9 or 10.0.4, which fixes the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://lists.apache.org/thread/btofzws2yqskk2n7f01r3l1819x01023
CVE ID: CVE-2024-56196 State: PUBLISHED Published: 2025-03-06T11:21:49.763Z Last Updated: 2025-03-06T15:37:59.338Z Vendors: Apache Software Foundation Products: Apache Traffic Server Problem Types: CWE-284 Description: Improper Access Control vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 10.0.0 through 10.0.3. Users are recommended to upgrade to version 10.0.4, which fixes the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://lists.apache.org/thread/btofzws2yqskk2n7f01r3l1819x01023
CVE ID: CVE-2024-56197 State: PUBLISHED Published: 2025-02-04T20:59:13.464Z Last Updated: 2025-02-05T15:06:02.360Z Severity: LOW (CVSS 2.2 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N) Vendors: discourse Products: discourse Problem Types: CWE-200 Description: Discourse is an open source platform for community discussion. PM titles and metadata can be read by other users when the "PM tags allowed for groups" option is enabled, the other user is a member of a group added to this option, and the PM has been tagged. This issue has been patched in the latest `stable`, `beta` and `tests-passed` versions of Discourse. Users are advised to upgrade. Users unable to upgrade should remove all groups fr
`tests-passed` versions of Discourse. Users are advised to upgrade. Users unable to upgrade should remove all groups from the the "PM tags allowed for groups" option. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/discourse/discourse/security/advisories/GHSA-xmgr-g9cp-v239
CVE ID: CVE-2024-56198 State: PUBLISHED Published: 2024-12-31T15:18:12.330Z Last Updated: 2024-12-31T15:50:50.732Z Vendors: cabraviva Products: path-sanitizer Problem Types: CWE-22 Description: path-sanitizer is a simple lightweight npm package for sanitizing paths to prevent Path Traversal. Prior to 3.1.0, the filters can be bypassed using .=%5c which results in a path traversal. This vulnerability is fixed in 3.1.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/cabraviva/path-sanitizer/security/advisories/GHSA-94p5-r7cc-3rpr - https://github.com/cabraviva/path-sanitizer/commit/b6d2319eac910dffdfacc8460f5b5cc5a1518ead - https://www.loom.com/share/b766ec
/github.com/cabraviva/path-sanitizer/commit/b6d2319eac910dffdfacc8460f5b5cc5a1518ead - https://www.loom.com/share/b766ece5193842848ce7562fcd559256?sid=fd826eb6-0eee-4601-bf0e-9cfee5c56e9d
CVE ID: CVE-2024-56199 State: PUBLISHED Published: 2025-01-02T17:27:08.690Z Last Updated: 2025-01-02T17:42:19.122Z Severity: MEDIUM (CVSS 5.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:L) Vendors: thorsten Products: phpMyFAQ Problem Types: CWE-79, CWE-80 Description: phpMyFAQ is an open source FAQ web application. Starting no later than version 3.2.10 and prior to version 4.0.2, an attacker can inject malicious HTML content into the FAQ editor at `http[:]//localhost/admin/index[.]php?action=editentry`, resulting in a complete disruption of the FAQ page's user interface. By injecting malformed HTML elements styled to cover the entire screen, an attacker can render the page unusable. This inje
injecting malformed HTML elements styled to cover the entire screen, an attacker can render the page unusable. This injection manipulates the page structure by introducing overlapping buttons, images, and iframes, breaking the intended layout and functionality. Exploiting this issue can lead to Denial of Service for legitimate users, damage to the user experience, and potential abuse in phishing or defacement attacks. Version 4.0.2 contains a patch for the vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-ww33-jppq-qfrp
CVE ID: CVE-2024-56200 State: PUBLISHED Published: 2024-12-19T18:43:06.397Z Last Updated: 2024-12-20T20:03:46.784Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H) Vendors: nexryai Products: altair Problem Types: CWE-400, CWE-405 Description: Altair is a fork of Misskey v12. Affected versions lack of request validation and lack of authentication in the image proxy for compressing and resizing remote files could allow attacks that could affect availability, such as by abnormally increasing the CPU usage of the server on which this software is running or placing a heavy load on the network it is using. This issue has been fixed in v12.24Q4.1. Users are advised to upgrade.
placing a heavy load on the network it is using. This issue has been fixed in v12.24Q4.1. Users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/nexryai/altair/security/advisories/GHSA-3pfm-hp96-pfgv - https://github.com/misskey-dev/misskey/security/advisories/GHSA-gq5q-c77c-v23600 - https://github.com/nexryai/altair/commit/20bad5155a8d73f8d807c6c1ae0f7b8041331be8
CVE ID: CVE-2024-56201 State: PUBLISHED Published: 2024-12-23T15:37:36.110Z Last Updated: 2025-02-18T21:47:42.763Z Vendors: pallets Products: jinja Problem Types: CWE-150 Description: Jinja is an extensible templating engine. In versions on the 3.x branch prior to 3.1.5, a bug in the Jinja compiler allows an attacker that controls both the content and filename of a template to execute arbitrary Python code, regardless of if Jinja's sandbox is used. To exploit the vulnerability, an attacker needs to control both the filename and the contents of a template. Whether that is the case depends on the type of application using Jinja. This vulnerability impacts users of applications which execute un
e case depends on the type of application using Jinja. This vulnerability impacts users of applications which execute untrusted templates where the template author can also choose the template filename. This vulnerability is fixed in 3.1.5. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/pallets/jinja/security/advisories/GHSA-gmj6-6f8f-6699 - https://github.com/pallets/jinja/issues/1792 - https://github.com/pallets/jinja/commit/767b23617628419ae3709ccfb02f9602ae9fe51f - https://github.com/pallets/jinja/releases/tag/3.1.5
CVE ID: CVE-2024-56202 State: PUBLISHED Published: 2025-03-06T11:09:11.632Z Last Updated: 2025-03-06T15:38:27.816Z Vendors: Apache Software Foundation Products: Apache Traffic Server Problem Types: CWE-440 Description: Expected Behavior Violation vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 9.0.0 through 9.2.8, from 10.0.0 through 10.0.3. Users are recommended to upgrade to versions 9.2.9 or 10.0.4 or newer, which fixes the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://lists.apache.org/thread/btofzws2yqskk2n7f01r3l1819x01023
CVE ID: CVE-2024-56203 State: PUBLISHED Published: 2024-12-31T13:21:19.145Z Last Updated: 2024-12-31T15:14:14.058Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: George Holmes II Products: Wayne Audio Player Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in George Holmes II Wayne Audio Player allows Privilege Escalation.This issue affects Wayne Audio Player: from n/a through 1.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/wayne-audio-player/vulnerability/wordpress-wayne-audio-player-plugin-1-0-csrf-to-privilege-escalation-vulnerability?_s_id=cve
CVE ID: CVE-2024-56204 State: PUBLISHED Published: 2024-12-31T13:26:42.658Z Last Updated: 2024-12-31T15:13:44.908Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Yonatan Reinberg of Social Ink Products: Sinking Dropdowns Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Yonatan Reinberg of Social Ink Sinking Dropdowns allows Privilege Escalation.This issue affects Sinking Dropdowns: from n/a through 1.25. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/sinking-dropdowns/vulnerability/wordpress-sinking-dropdowns-plugin-1-25-csrf-to-privilege-escalation-vulner
press/plugin/sinking-dropdowns/vulnerability/wordpress-sinking-dropdowns-plugin-1-25-csrf-to-privilege-escalation-vulnerability?_s_id=cve