Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-5668 State: PUBLISHED Published: 2024-08-08T04:31:33.255Z Last Updated: 2024-08-08T13:10:56.800Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: bradvin Products: Lightbox & Modal Popup WordPress Plugin – FooBox Problem Types: CWE-79 Description: The Lightbox & Modal Popup WordPress Plugin – FooBox plugin for WordPress is vulnerable to DOM-based Stored Cross-Site Scripting via HTML data attributes in all versions up to, and including, 2.7.28 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary we
tes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/923f9e66-2e26-4ec2-a4b3-439881a6ca10?source=cve - https://plugins.trac.wordpress.org/changeset/3130678/foobox-image-lightbox
CVE ID: CVE-2024-5669 State: PUBLISHED Published: 2024-07-09T08:33:11.511Z Last Updated: 2024-08-01T21:18:06.879Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: optemiz Products: XPlainer – WooCommerce Product FAQ [WooCommerce Accordion FAQ Plugin] Problem Types: CWE-862 Missing Authorization Description: The XPlainer – WooCommerce Product FAQ [WooCommerce Accordion FAQ Plugin] plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'ffw_activate_template' function in all versions up to, and including, 1.6.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, t
to, and including, 1.6.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to store cross-site scripting that will trigger when viewing the dashboard templates or accessing FAQs. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/c5a404de-ee26-44af-9e4f-f93694da7a77?source=cve - https://plugins.trac.wordpress.org/browser/faq-for-woocommerce/trunk/includes/admin/faq-woocommerce-admin-functions.php#L471
CVE ID: CVE-2024-5670 State: PUBLISHED Published: 2024-07-29T02:23:20.658Z Last Updated: 2024-08-01T21:18:06.849Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Softnext Products: SN OS 12.1, SN OS 12.3, SN OS 10.3 Problem Types: CWE-78 Description: The web services of Softnext's products, Mail SQR Expert and Mail Archiving Expert do not properly validate user input, allowing unauthenticated remote attackers to inject arbitrary OS commands and execute them on the remote server. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.twcert.org.tw/tw/cp-132-7958-817f4-1.html - https://www.twcert.org.tw/en/cp-13
gram Container: References: - https://www.twcert.org.tw/tw/cp-132-7958-817f4-1.html - https://www.twcert.org.tw/en/cp-139-7959-09d0e-2.html
CVE ID: CVE-2024-5671 State: PUBLISHED Published: 2024-06-14T13:52:33.937Z Last Updated: 2024-08-01T21:18:06.834Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Trellix Products: Intrusion Prevention System (IPS) Manager Problem Types: CWE-502 Description: Insecure Deserialization in some workflows of the IPS Manager allows unauthenticated remote attackers to perform arbitrary code execution and access to the vulnerable Trellix IPS Manager. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://thrive.trellix.com/s/article/000013623
CVE ID: CVE-2024-5672 State: PUBLISHED Published: 2024-07-03T12:26:44.599Z Last Updated: 2025-02-13T17:54:25.437Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Red Lion Europe, Helmholz Products: mbNET.mini, REX 100 Problem Types: CWE-78 Description: A high privileged remote attacker can execute arbitrary system commands via GET requests due to improper neutralization of special elements used in an OS command. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://cert.vde.com/en/advisories/VDE-2024-030 - https://cert.vde.com/en/advisories/VDE-2024-032 - http://seclists.org/fulldisclosure/2024/Jul/6
CVE ID: CVE-2024-5673 State: PUBLISHED Published: 2024-06-06T10:19:34.669Z Last Updated: 2024-08-01T21:18:06.988Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: Dulldusk Products: PHP File Manager Problem Types: CWE-79 Description: Vulnerability in Dulldusk's PHP File Manager affecting version 1.7.8. This vulnerability consists of an XSS through the fm_current_dir parameter of index.php. An attacker could send a specially crafted JavaScript payload to an authenticated user and partially hijack their browser session. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/cr
s: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/cross-site-scripting-php-file-manager-dulldusk
CVE ID: CVE-2024-5674 State: PUBLISHED Published: 2024-06-12T11:05:09.214Z Last Updated: 2024-08-01T21:18:07.054Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) Vendors: The Newsletter Team Products: Newsletter - API v1 and v2 addon for Newsletter Problem Types: CWE-862 Missing Authorization Description: The Newsletter - API v1 and v2 addon plugin for WordPress is vulnerable to unauthorized subscribers management due to PHP type juggling issue on the check_api_key function in all versions up to, and including, 2.4.5. This makes it possible for unauthenticated attackers to list, create or delete newsletter subscribers. This issue affects only sites running the PHP ve
thenticated attackers to list, create or delete newsletter subscribers. This issue affects only sites running the PHP version below 8.0 Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/ecd9800e-ce0f-45f3-bb66-3690c51d885b?source=cve - https://www.thenewsletterplugin.com/documentation/developers/newsletter-api-2/
CVE ID: CVE-2024-5675 State: PUBLISHED Published: 2024-06-06T12:10:04.124Z Last Updated: 2024-08-01T21:18:06.901Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: Summar Software Products: Mentor – Employee Portal Problem Types: CWE-502 Description: Untrusted data deserialization vulnerability has been found in Mentor - Employee Portal, affecting version 3.83.35. This vulnerability could allow an attacker to execute arbitrary code, by injecting a malicious payload into the “ViewState” field. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/unreliable-data-deserializat
: - CVE Program Container: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/unreliable-data-deserialization-vulnerability-mentor
CVE ID: CVE-2024-5676 State: PUBLISHED Published: 2024-06-19T09:47:38.961Z Last Updated: 2025-02-13T17:54:26.071Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H) Vendors: Paradox Security Systems (Bahamas) Ltd. Products: IP150 Internet Module Problem Types: CWE-352 Description: The Paradox IP150 Internet Module in version 1.40.00 is vulnerable to Cross-Site Request Forgery (CSRF) attacks due to a lack of countermeasures and the use of the HTTP method `GET` to introduce changes in the system. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/sbaresearch/advisories/tree/public/2024/SBA-ADV-20240321-01_Paradox_C
rogram Container: References: - https://github.com/sbaresearch/advisories/tree/public/2024/SBA-ADV-20240321-01_Paradox_Cross_Site_Request_Forgery - https://www.paradox.com/Products/default.asp?CATID=3&SUBCATID=38&PRD=563 - http://seclists.org/fulldisclosure/2024/Jun/8
CVE ID: CVE-2024-5677 State: PUBLISHED Published: 2024-07-10T02:02:45.594Z Last Updated: 2024-08-01T21:18:06.839Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: aumkub Products: Featured Image Generator Problem Types: CWE-862 Missing Authorization Description: The Featured Image Generator plugin for WordPress is vulnerable to unauthorized image upload due to a missing capability check on the fig_save_after_generate_image function in all versions up to, and including, 1.3.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload arbitrary images to a post-related gallery. Additional Analyst Notes: - CISA ADP Vul
r-level access and above, to upload arbitrary images to a post-related gallery. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/56161d67-7378-4349-8fe5-da73da36afa0?source=cve - https://plugins.trac.wordpress.org/browser/featured-image-generator/tags/1.3.1/admin/class-featured-image-generator-admin.php#L575
CVE ID: CVE-2024-5678 State: PUBLISHED Published: 2024-08-01T06:54:25.601Z Last Updated: 2024-08-02T15:40:34.779Z Severity: MEDIUM (CVSS 4.7 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L) Vendors: ManageEngine Products: Applications Manager Problem Types: CWE-89 Description: Zohocorp ManageEngine Applications Manager versions 170900 and below are vulnerable to the authenticated admin-only SQL Injection in the Create Monitor feature. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.manageengine.com/products/applications_manager/security-updates/security-updates-cve-2024-5678.html
CVE ID: CVE-2024-5679 State: PUBLISHED Published: 2024-07-11T08:18:23.853Z Last Updated: 2024-08-01T21:18:06.706Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H) Vendors: Schneider Electric Products: EcoStruxure Foxboro DCS Core Control Services Problem Types: CWE-787 Description: CWE-787: Out-of-Bounds Write vulnerability exists that could cause local denial-of-service, or kernel memory leak when a malicious actor with local user access crafts a script/program using an IOCTL call in the Foxboro.sys driver. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2024-191-02&p
hment: - CVE Program Container: References: - https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2024-191-02&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2024-191-02.pdf
CVE ID: CVE-2024-5680 State: PUBLISHED Published: 2024-07-11T08:25:45.578Z Last Updated: 2024-08-01T21:18:06.841Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H) Vendors: Schneider Electric Products: EcoStruxure Foxboro DCS Core Control Services Problem Types: CWE-129 Description: CWE-129: Improper Validation of Array Index vulnerability exists that could cause local denial-of-service when a malicious actor with local user access crafts a script/program using an IOCTL call in the Foxboro.sys driver. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2024-191-02&p_enDocTy
CVE Program Container: References: - https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2024-191-02&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2024-191-02.pdf
CVE ID: CVE-2024-5681 State: PUBLISHED Published: 2024-07-11T08:27:49.614Z Last Updated: 2025-08-27T21:33:27.004Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Schneider Electric Products: EcoStruxure Foxboro DCS Core Control Services Problem Types: CWE-20 Description: CWE-20: Improper Input Validation vulnerability exists that could cause local denial-of-service, privilege escalation, and potentially kernel execution when a malicious actor with local user access crafts a script/program using an IOCTL call in the Foxboro.sys driver. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://download.schneider-electric.c
nal Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2024-191-02&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2024-191-02.pdf
CVE ID: CVE-2024-5682 State: PUBLISHED Published: 2024-09-18T11:52:42.238Z Last Updated: 2024-09-18T13:21:59.578Z Vendors: Yordam Information Technology Products: Yordam Library Automation System Problem Types: CWE-307 Description: Improper Restriction of Excessive Authentication Attempts vulnerability in Yordam Information Technology Yordam Library Automation System allows Interface Manipulation.This issue affects Yordam Library Automation System: before 20.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.usom.gov.tr/bildirim/tr-24-1496
CVE ID: CVE-2024-5683 State: PUBLISHED Published: 2024-06-24T08:54:32.424Z Last Updated: 2024-08-01T21:18:06.780Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Next4Biz CRM & BPM Software Products: Business Process Manangement (BPM) Problem Types: CWE-94 Description: Improper Control of Generation of Code ('Code Injection') vulnerability in Next4Biz CRM & BPM Software Business Process Manangement (BPM) allows Remote Code Inclusion.This issue affects Business Process Manangement (BPM): from 6.6.4.4 before 6.6.4.5. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.usom.gov.tr/bildirim/tr-24-0739
CVE ID: CVE-2024-5684 State: PUBLISHED Published: 2024-06-06T12:54:09.480Z Last Updated: 2024-08-01T21:18:06.963Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: Volkswagen Group Charging GmbH - Elli, EVBox Products: ID Charger Connect & Pro Problem Types: CWE-345 Description: An attacker with access to the private network (the charger is connected to) or local access to the Ethernet-Interface can exploit a faulty implementation of the JWT-library in order to bypass the password authentication to the web configuration interface and then has full access as the user would have. However, an attacker will not have developer or admin rights. If the implementation
full access as the user would have. However, an attacker will not have developer or admin rights. If the implementation of the JWT-library is wrongly configured to accept "none"-algorithms, the server will pass insecure JWT. A local, unauthenticated attacker can exploit this vulnerability to bypass the authentication mechanism. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://asrg.io/security-advisories/vulnerability-in-id-charger-connect-and-pro-from-volkswagen-group-charging-gmbh-elli-evbox-versions-spr3-2b-spr3-51-and-spr3-52/
CVE ID: CVE-2024-5685 State: PUBLISHED Published: 2024-06-14T09:54:41.433Z Last Updated: 2024-08-01T21:18:06.834Z Severity: HIGH (CVSS 7.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L) Vendors: snipe Products: snipe-it Problem Types: CWE-862 Description: Users with "User:edit" and "Self:api" permissions can promote or demote themselves or other users by performing changes to the group's memberships via API call.This issue affects snipe-it: from v4.6.17 through v6.4.1. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/snipe/snipe-it/pull/14745 - https://github.com/snipe/snipe-it/commit/34f1ea1c0ecd403047cd1327569ee391a7201cc1 - https:
m/snipe/snipe-it/pull/14745 - https://github.com/snipe/snipe-it/commit/34f1ea1c0ecd403047cd1327569ee391a7201cc1 - https://github.com/snipe/snipe-it/releases/tag/v6.4.2 - https://devhub.checkmarx.com/cve-details/CVE-2024-5685/ - https://advisory.checkmarx.net/?search=CVE-2024-5685
CVE ID: CVE-2024-5686 State: PUBLISHED Published: 2024-06-20T03:37:23.231Z Last Updated: 2024-08-01T21:18:06.849Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: wpzoom Products: WPZOOM Addons for Elementor (Templates, Widgets) Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The WPZOOM Addons for Elementor (Templates, Widgets) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘url’ attribute within the plugin's Team Members widget in all versions up to, and including, 1.1.38 due to insufficient input sanitization and output escaping. This makes it possible for aut
up to, and including, 1.1.38 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/f972ab72-8e68-4ab3-aa7f-e2816de33554?source=cve - https://plugins.trac.wordpress.org/browser/wpzoom-elementor-addons/tags/1.1.38/includes/widgets/team-members/team-members.php#L1452 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=31
eam-members/team-members.php#L1452 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3104212%40wpzoom-elementor-addons&new=3104212%40wpzoom-elementor-addons&sfp_email=&sfph_mail=
CVE ID: CVE-2024-5687 State: PUBLISHED Published: 2024-06-11T12:40:16.865Z Last Updated: 2024-08-01T21:18:06.882Z Vendors: Mozilla Products: Firefox Problem Types: An incorrect principal could have been used when opening new tabs Description: If a specific sequence of actions is performed when opening a new tab, the triggering principal associated with the new tab may have been incorrect. The triggering principal is used to calculate many values, including the `Referer` and `Sec-*` headers, meaning there is the potential for incorrect security checks within the browser in addition to incorrect or misleading information sent to remote websites. *This bug only affects Firefox for Android. Othe
ddition to incorrect or misleading information sent to remote websites. *This bug only affects Firefox for Android. Other versions of Firefox are unaffected.* This vulnerability affects Firefox < 127. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1889066 - https://www.mozilla.org/security/advisories/mfsa2024-25/
CVE ID: CVE-2024-5688 State: PUBLISHED Published: 2024-06-11T12:40:12.457Z Last Updated: 2024-08-01T21:18:07.039Z Vendors: Mozilla Products: Firefox, Firefox ESR, Thunderbird Problem Types: Use-after-free in JavaScript object transplant Description: If a garbage collection was triggered at the right time, a use-after-free could have occurred during object transplant. This vulnerability affects Firefox < 127, Firefox ESR < 115.12, and Thunderbird < 115.12. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1895086 - https://lists.debian.org/debian-lts-announce/2024/06/msg00000.html - https://lists.debian.org/d
how_bug.cgi?id=1895086 - https://lists.debian.org/debian-lts-announce/2024/06/msg00000.html - https://lists.debian.org/debian-lts-announce/2024/06/msg00010.html - https://www.mozilla.org/security/advisories/mfsa2024-25/ - https://www.mozilla.org/security/advisories/mfsa2024-26/ - https://www.mozilla.org/security/advisories/mfsa2024-28/
CVE ID: CVE-2024-5689 State: PUBLISHED Published: 2024-06-11T12:40:17.163Z Last Updated: 2024-10-28T19:54:04.120Z Vendors: Mozilla Products: Firefox Problem Types: User confusion and possible phishing vector via Firefox Screenshots Description: In addition to detecting when a user was taking a screenshot (XXX), a website was able to overlay the 'My Shots' button that appeared, and direct the user to a replica Firefox Screenshots page that could be used for phishing. This vulnerability affects Firefox < 127. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1389707 - https://www.mozilla.org/security/advisorie
ntainer: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1389707 - https://www.mozilla.org/security/advisories/mfsa2024-25/
CVE ID: CVE-2024-5690 State: PUBLISHED Published: 2024-06-11T12:40:12.752Z Last Updated: 2025-03-26T14:05:22.811Z Vendors: Mozilla Products: Firefox, Firefox ESR, Thunderbird Problem Types: External protocol handlers leaked by timing attack Description: By monitoring the time certain operations take, an attacker could have guessed which external protocol handlers were functional on a user's system. This vulnerability affects Firefox < 127, Firefox ESR < 115.12, and Thunderbird < 115.12. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1883693 - https://lists.debian.org/debian-lts-announce/2024/06/msg00000.h
- https://bugzilla.mozilla.org/show_bug.cgi?id=1883693 - https://lists.debian.org/debian-lts-announce/2024/06/msg00000.html - https://lists.debian.org/debian-lts-announce/2024/06/msg00010.html - https://www.mozilla.org/security/advisories/mfsa2024-25/ - https://www.mozilla.org/security/advisories/mfsa2024-26/ - https://www.mozilla.org/security/advisories/mfsa2024-28/
CVE ID: CVE-2024-5691 State: PUBLISHED Published: 2024-06-11T12:40:13.093Z Last Updated: 2025-03-19T20:14:10.204Z Vendors: Mozilla Products: Firefox, Firefox ESR, Thunderbird Problem Types: Sandboxed iframes were able to bypass sandbox restrictions to open a new window Description: By tricking the browser with a `X-Frame-Options` header, a sandboxed iframe could have presented a button that, if clicked by a user, would bypass restrictions to open a new window. This vulnerability affects Firefox < 127, Firefox ESR < 115.12, and Thunderbird < 115.12. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1888695 -
- CISA ADP Vulnrichment: - CVE Program Container: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1888695 - https://lists.debian.org/debian-lts-announce/2024/06/msg00000.html - https://lists.debian.org/debian-lts-announce/2024/06/msg00010.html - https://www.mozilla.org/security/advisories/mfsa2024-25/ - https://www.mozilla.org/security/advisories/mfsa2024-26/ - https://www.mozilla.org/security/advisories/mfsa2024-28/
CVE ID: CVE-2024-5692 State: PUBLISHED Published: 2024-06-11T12:40:13.370Z Last Updated: 2025-03-13T18:19:17.795Z Vendors: Mozilla Products: Firefox, Firefox ESR, Thunderbird Problem Types: Bypass of file name restrictions during saving Description: On Windows 10, when using the 'Save As' functionality, an attacker could have tricked the browser into saving the file with a disallowed extension such as `.url` by including an invalid character in the extension. *Note:* This issue only affected Windows operating systems. Other operating systems are unaffected. This vulnerability affects Firefox < 127, Firefox ESR < 115.12, and Thunderbird < 115.12. Additional Analyst Notes: - CISA ADP Vulnrichm
ty affects Firefox < 127, Firefox ESR < 115.12, and Thunderbird < 115.12. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1891234 - https://www.mozilla.org/security/advisories/mfsa2024-25/ - https://www.mozilla.org/security/advisories/mfsa2024-26/ - https://www.mozilla.org/security/advisories/mfsa2024-28/