Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-9367 State: PUBLISHED Published: 2024-12-12T12:02:44.837Z Last Updated: 2024-12-12T15:44:25.438Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: GitLab Products: GitLab Problem Types: CWE-770 Description: An issue was discovered in GitLab CE/EE affecting all versions starting from 13.9 before 17.4.6, 17.5 before 17.5.4, and 17.6 before 17.6.2, that allows an attacker to cause uncontrolled CPU consumption, potentially leading to a Denial of Service (DoS) condition while parsing templates to generate changelogs. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/496631 - https://hacke
alyst Notes: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/496631 - https://hackerone.com/reports/2735311
CVE ID: CVE-2024-9368 State: PUBLISHED Published: 2024-10-04T02:04:53.667Z Last Updated: 2024-10-04T14:00:05.161Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: migumello Products: Aggregator Advanced Settings Problem Types: CWE-79 Description: The Aggregator Advanced Settings plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.2.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file. Additional
and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/838bfa4c-2eb7-4f76-a6c3-ab4684f3913c?source=cve - https://wordpress.org/plugins/aggregator-advanced-settings/#developers
CVE ID: CVE-2024-9369 State: PUBLISHED Published: 2024-11-27T17:50:45.349Z Last Updated: 2025-11-20T18:45:56.864Z Vendors: Google Products: Chrome Problem Types: Insufficient data validation Description: Insufficient data validation in Mojo in Google Chrome prior to 129.0.6668.89 allowed a remote attacker who had compromised the renderer process to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: High) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2024/10/stable-channel-update-for-desktop.html - https://issues.chromium.org/issues/368208152
CVE ID: CVE-2024-9371 State: PUBLISHED Published: 2024-11-21T04:24:27.099Z Last Updated: 2024-11-21T11:30:09.182Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: wpmudev Products: Branda – Branda – White Label & Branding, Custom Login Page Customizer Problem Types: CWE-79 Description: The Branda – White Label & Branding, Custom Login Page Customizer plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of remove_query_arg without appropriate escaping on the URL in all versions up to, and including, 3.4.19. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can succe
makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/eb60e5c8-cbda-4488-816c-a7fdf2b39fd6?source=cve - https://plugins.trac.wordpress.org/browser/branda-white-labeling/tags/3.4.19/inc/class-branda-admin.php#L1871 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3191895%40branda-white-labeling&new=3191895%40branda-white-labeling&sfp_email=&sfph_mail=
CVE ID: CVE-2024-9372 State: PUBLISHED Published: 2024-10-04T02:04:52.036Z Last Updated: 2024-10-04T14:00:37.227Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: wpblockshub Products: WP Blocks Hub Problem Types: CWE-79 Description: The WP Blocks Hub plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.0.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file. Additional Analyst Notes: - CISA ADP V
ary web scripts in pages that will execute whenever a user accesses the SVG file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/7d32b2cc-9336-432e-9d2e-67db8b0e3f90?source=cve - https://wordpress.org/plugins/wp-blocks-hub/#developers
CVE ID: CVE-2024-9373 State: PUBLISHED Published: 2024-10-18T04:32:52.694Z Last Updated: 2024-10-18T14:03:29.314Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: themeid Products: Elemenda Problem Types: CWE-79 Description: The Elemenda plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 0.0.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file. Additional Analyst Notes: - CISA ADP Vulnrichment: R
s in pages that will execute whenever a user accesses the SVG file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/4a8ac027-f376-4f02-a085-f05f1fa749f0?source=cve - https://wordpress.org/plugins/elemenda/#developers
CVE ID: CVE-2024-9374 State: PUBLISHED Published: 2024-10-24T04:32:25.907Z Last Updated: 2024-10-24T13:44:27.068Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: vladimirs Products: Terms descriptions Problem Types: CWE-79 Description: The Terms descriptions plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 3.4.6. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Not
ecute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/fa977e6c-6b9d-4fa8-99f3-566d6a71424f?source=cve - https://plugins.trac.wordpress.org/browser/terms-descriptions/trunk/includes/td_admin_terms.php#L520
CVE ID: CVE-2024-9375 State: PUBLISHED Published: 2024-10-04T02:04:56.100Z Last Updated: 2024-10-04T13:59:17.636Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: contact-banker Products: WordPress Captcha Plugin by Captcha Bank Problem Types: CWE-79 Description: The WordPress Captcha Plugin by Captcha Bank plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 4.0.36. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action
s to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/ba796adc-db76-4b9d-a6f9-f0f51f070240?source=cve - https://plugins.trac.wordpress.org/browser/captcha-bank/trunk/captcha-bank.php#L1297
CVE ID: CVE-2024-9376 State: PUBLISHED Published: 2024-10-29T09:31:29.088Z Last Updated: 2024-10-29T14:51:37.279Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: climaxthemes Products: Kata Plus – Addons for Elementor – Widgets, Extensions and Templates Problem Types: CWE-79 Description: The Kata Plus – Addons for Elementor – Widgets, Extensions and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.4.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web s
aping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/05c7267e-2e0c-48e9-bdaa-c8bc0b9ec8a6?source=cve - https://wordpress.org/plugins/kata-plus/#developers - https://plugins.trac.wordpress.org/changeset/3174359/ - https://climaxthemes.com/kata/documentation/changelog/
CVE ID: CVE-2024-9377 State: PUBLISHED Published: 2024-10-10T02:06:08.702Z Last Updated: 2024-10-10T13:12:29.969Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: omardabbas Products: Products, Order & Customers Export for WooCommerce Problem Types: CWE-79 Description: The Products, Order & Customers Export for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg & remove_query_arg without appropriate escaping on the URL in all versions up to, and including, 2.0.15. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully tric
ssible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/67d2e1c7-dbd3-4195-8bdb-3b85b25bfa52?source=cve - https://plugins.trac.wordpress.org/changeset/3164996/ - https://plugins.trac.wordpress.org/browser/export-woocommerce/tags/2.0.15/includes/class-alg-wc-export-core.php#L220 - https://plugins.trac.wordpress.org/browser/export-woocommerce/tags/2.0.15/includes/class-alg-wc-export-core.php#L216
CVE ID: CVE-2024-9378 State: PUBLISHED Published: 2024-10-02T08:31:50.499Z Last Updated: 2024-10-02T17:38:34.333Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: icopydoc Products: YML for Yandex Market Problem Types: CWE-79 Description: The YML for Yandex Market plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'page' parameter in all versions up to, and including, 4.7.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Addit
in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/a463c5be-13d9-45d8-b43e-54ab188c151a?source=cve - https://plugins.trac.wordpress.org/browser/yml-for-yandex-market/tags/4.7.2/classes/system/pages/settings-page/class-y4ym-settings-page-feeds-wp-list-table.php#L311 - https://plugins.trac.wordpress.org/changeset/3160483/yml-for-yandex-market/trunk/classes/system/pages/settings-page/class-y4ym-settings-page-feeds-wp-list-table.php
CVE ID: CVE-2024-9379 State: PUBLISHED Published: 2024-10-08T16:23:13.310Z Last Updated: 2025-10-21T22:55:43.655Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H) Vendors: Ivanti Products: CSA (Cloud Services Appliance) Problem Types: CWE-89 Description: SQL injection in the admin web console of Ivanti CSA before version 5.0.2 allows a remote authenticated attacker with admin privileges to run arbitrary SQL statements. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-CSA-Cloud-Services-Appliance-CVE-2024-9379-CVE-2024-9380-CVE-2024-9381
CVE ID: CVE-2024-9380 State: PUBLISHED Published: 2024-10-08T16:23:49.949Z Last Updated: 2025-10-21T22:55:43.528Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Ivanti Products: CSA (Cloud Services Appliance) Problem Types: CWE-77 Description: An OS command injection vulnerability in the admin web console of Ivanti CSA before version 5.0.2 allows a remote authenticated attacker with admin privileges to obtain remote code execution. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-CSA-Cloud-Services-Appliance-CVE-2024-9379-CVE-2024-9380-CVE-2024-9381
CVE ID: CVE-2024-9381 State: PUBLISHED Published: 2024-10-08T16:25:27.092Z Last Updated: 2024-10-08T19:23:27.864Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Ivanti Products: CSA (Cloud Services Appliance) Problem Types: CWE-22 Description: Path traversal in Ivanti CSA before version 5.0.2 allows a remote authenticated attacker with admin privileges to bypass restrictions. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-CSA-Cloud-Services-Appliance-CVE-2024-9379-CVE-2024-9380-CVE-2024-9381
CVE ID: CVE-2024-9382 State: PUBLISHED Published: 2024-10-18T04:32:56.291Z Last Updated: 2024-10-18T16:36:14.191Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: gantry Products: Gantry 4 Framework Problem Types: CWE-79 Description: The Gantry 4 Framework plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'override_id' parameter in all versions up to, and including, 4.1.21 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Addit
in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/d539a066-6b59-4235-868e-f3085436e9f4?source=cve - https://plugins.trac.wordpress.org/browser/gantry/trunk/admin_functions.php#L677
CVE ID: CVE-2024-9383 State: PUBLISHED Published: 2024-10-18T04:32:54.715Z Last Updated: 2024-10-18T14:12:25.181Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: parcelpro Products: Parcel Pro Problem Types: CWE-79 Description: The Parcel Pro plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'action' parameter in all versions up to, and including, 1.8.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes
ute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/8e8fe6f4-7e41-44d3-9980-b5e7f43aa849?source=cve - https://plugins.trac.wordpress.org/browser/woo-parcel-pro/trunk/admin/class-parcelpro-admin.php#L274
CVE ID: CVE-2024-9384 State: PUBLISHED Published: 2024-10-04T02:04:57.459Z Last Updated: 2024-10-04T13:58:45.844Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: algoritmika Products: Quantity Dynamic Pricing & Bulk Discounts for WooCommerce Problem Types: CWE-79 Description: The Quantity Dynamic Pricing & Bulk Discounts for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 3.8.0. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a u
e for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/e84ee2b5-96b5-427c-ac66-7f80418ae02f?source=cve - https://plugins.trac.wordpress.org/browser/wholesale-pricing-woocommerce/tags/3.8.0/includes/settings/class-alg-wc-wholesale-pricing-settings-per-product.php#L126 - https://plugins.trac.wordpress.org/changeset/3161269/wholesale-pricing-woocommerce/tags/3.8.1/includes/settings/class-alg-wc-wholesale-pricing-settings-per-product.php
CVE ID: CVE-2024-9385 State: PUBLISHED Published: 2024-10-05T01:59:41.325Z Last Updated: 2024-10-07T14:20:12.680Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: themifyme Products: Themify Builder Problem Types: CWE-79 Description: The Themify Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 7.6.2. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: -
if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/a83e68e0-1b5b-4fd5-be00-37b8f11144c4?source=cve - https://plugins.trac.wordpress.org/browser/themify-builder/tags/7.6.2/classes/class-themify-builder-model.php#L1121 - https://plugins.trac.wordpress.org/changeset/3162399/themify-builder/trunk/classes/class-themify-builder-model.php
CVE ID: CVE-2024-9386 State: PUBLISHED Published: 2024-11-16T03:20:48.606Z Last Updated: 2024-11-16T15:10:21.676Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: wpmariocom Products: Exclusive Divi – Divi Preloader, Modules for Divi & Extra Theme Problem Types: CWE-79 Description: The Exclusive Divi – Divi Preloader, Modules for Divi & Extra Theme plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in page
kes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/7bf68565-ea30-4caf-8323-b0b88561e89f?source=cve - https://wordpress.org/plugins/exclusive-divi/#developers - https://plugins.trac.wordpress.org/browser/exclusive-divi/trunk/public/script-handler.php#L62
CVE ID: CVE-2024-9387 State: PUBLISHED Published: 2024-12-12T12:02:39.825Z Last Updated: 2024-12-17T04:56:10.278Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N) Vendors: GitLab Products: GitLab Problem Types: CWE-601 Description: An issue was discovered in GitLab CE/EE affecting all versions from 11.8 before 17.4.6, 17.5 before 17.5.4, and 17.6 before 17.6.2. An attacker could potentially perform an open redirect against a given releases API endpoint. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/496659 - https://hackerone.com/reports/2732235
CVE ID: CVE-2024-9388 State: PUBLISHED Published: 2024-10-30T11:01:03.354Z Last Updated: 2024-10-31T13:01:36.345Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: modernaweb Products: Black Widgets For Elementor Problem Types: CWE-79 Description: The Black Widgets For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.3.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file. Additional
and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/618c72b1-363b-41ad-939d-ab2a3b4d579c?source=cve - https://wordpress.org/plugins/black-widgets/#developers - https://plugins.trac.wordpress.org/browser/black-widgets/trunk/includes/class-bw.php#L95 - https://plugins.trac.wordpress.org/changeset/3178366/
CVE ID: CVE-2024-9390 State: PUBLISHED Published: 2025-05-15T20:07:20.748Z Last Updated: 2025-05-17T02:54:05.914Z Vendors: Unknown Products: RegistrationMagic Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The RegistrationMagic WordPress plugin before 6.0.2.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/6a5308fb-83bf-4f6a-a7ef-e3e1b69aa80f/
CVE ID: CVE-2024-9391 State: PUBLISHED Published: 2024-10-01T15:13:22.291Z Last Updated: 2024-11-22T19:10:35.672Z Vendors: Mozilla Products: Firefox Problem Types: Prevent users from exiting full-screen mode in Firefox Focus for Android Description: A user who enables full-screen mode on a specially crafted web page could potentially be prevented from exiting full screen mode. This may allow spoofing of other sites as the address bar is no longer visible. *This bug only affects Firefox Focus for Android. Other versions of Firefox are unaffected.* This vulnerability affects Firefox < 131. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://bugzilla.mozilla.org/show_bug.cg
Firefox < 131. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1892407 - https://www.mozilla.org/security/advisories/mfsa2024-46/
CVE ID: CVE-2024-9392 State: PUBLISHED Published: 2024-10-01T15:13:18.862Z Last Updated: 2025-11-03T22:33:24.026Z Vendors: Mozilla Products: Firefox, Firefox ESR, Thunderbird Problem Types: Compromised content process can bypass site isolation Description: A compromised content process could have allowed for the arbitrary loading of cross-origin pages. This vulnerability affects Firefox < 131, Firefox ESR < 128.3, Firefox ESR < 115.16, Thunderbird < 128.3, and Thunderbird < 131. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1899154 - https://bugzilla.mozilla.org/show_bug.cgi?id=1905843 - https://www.mozi
//bugzilla.mozilla.org/show_bug.cgi?id=1899154 - https://bugzilla.mozilla.org/show_bug.cgi?id=1905843 - https://www.mozilla.org/security/advisories/mfsa2024-46/ - https://www.mozilla.org/security/advisories/mfsa2024-47/ - https://www.mozilla.org/security/advisories/mfsa2024-48/ - https://www.mozilla.org/security/advisories/mfsa2024-49/ - https://www.mozilla.org/security/advisories/mfsa2024-50/