Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
ser supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/afb3e68e-6f79-4c46-b41e-8fd6eb43c755?source=cve - https://plugins.trac.wordpress.org/changeset?old_path=/knight-lab-timelinejs/tags/3.9.3.3&old=3051910&new_path=/knight-lab-timelinejs/tags/3.9.3.4&new=3051910&sfp_email=&sfph_mail=
CVE ID: CVE-2024-2288 State: PUBLISHED Published: 2024-06-06T18:24:08.214Z Last Updated: 2025-10-15T12:50:21.397Z Severity: HIGH (CVSS 8.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:H) Vendors: parisneo Products: parisneo/lollms-webui Problem Types: CWE-352 Description: A Cross-Site Request Forgery (CSRF) vulnerability exists in the profile picture upload functionality of the Lollms application, specifically in the parisneo/lollms-webui repository, affecting versions up to 7.3.0. This vulnerability allows attackers to change a victim's profile picture without their consent, potentially leading to a denial of service by overloading the filesystem with files. Additionally, this flaw can be exp
potentially leading to a denial of service by overloading the filesystem with files. Additionally, this flaw can be exploited to perform a stored cross-site scripting (XSS) attack, enabling attackers to execute arbitrary JavaScript in the context of the victim's browser session. The issue is resolved in version 9.3. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://huntr.com/bounties/2a37ae0c-890a-401a-8f3c-a261f3006290 - https://github.com/parisneo/lollms-webui/commit/ed085e6effab2b1e25ba2b00366a16ff67d8551b
CVE ID: CVE-2024-2289 State: PUBLISHED Published: 2024-04-09T18:59:10.873Z Last Updated: 2024-08-01T19:11:53.295Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: ideaboxcreations Products: PowerPack Lite for Beaver Builder Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The PowerPack Lite for Beaver Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the link in multiple elements in all versions up to, and including, 1.3.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers wi
nput sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/a22c7b45-752c-482d-8812-888d5bc3d630?source=cve - https://plugins.trac.wordpress.org/changeset/3051551/
CVE ID: CVE-2024-2290 State: PUBLISHED Published: 2024-05-09T20:03:42.474Z Last Updated: 2024-08-21T20:49:47.052Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: monetizemore Products: Advanced Ads – Ad Manager & AdSense Problem Types: CWE-502 Deserialization of Untrusted Data Description: The Advanced Ads plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.52.1 via deserialization of untrusted input in the 'placement_slug' parameter. This makes it possible for authenticated attackers to inject a PHP Object. No POP chain is present in the vulnerable plugin. If a POP chain is present via an additional plugin or the
PHP Object. No POP chain is present in the vulnerable plugin. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/f64336f7-ab2a-4e22-a76f-d077c51f9c57?source=cve - https://plugins.trac.wordpress.org/browser/advanced-ads/trunk/modules/import-export/classes/import.php#L155 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3081914%40advanced-ads&new=3081914%40advanced-ads&sfp_email
.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3081914%40advanced-ads&new=3081914%40advanced-ads&sfp_email=&sfph_mail=
CVE ID: CVE-2024-2291 State: PUBLISHED Published: 2024-03-20T14:46:59.040Z Last Updated: 2024-08-01T19:11:53.265Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: Progress Software Products: MOVEit Transfer Problem Types: CWE-778 Description: In Progress MOVEit Transfer versions released before 2022.0.11 (14.0.11), 2022.1.12 (14.1.12), 2023.0.9 (15.0.9), 2023.1.4 (15.1.4), a logging bypass vulnerability has been discovered. An authenticated user could manipulate a request to bypass the logging mechanism within the web application which results in user activity not being logged properly. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Containe
ts in user activity not being logged properly. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.progress.com/moveit - https://community.progress.com/s/article/MOVEit-Transfer-Service-Pack-March-2024
CVE ID: CVE-2024-2292 State: PUBLISHED Published: 2025-03-20T10:09:07.851Z Last Updated: 2025-10-15T12:49:36.667Z Severity: HIGH (CVSS 7.1 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N) Vendors: changeweb Products: changeweb/unifiedtransform Problem Types: CWE-862 Description: Due to a lack of access control, unauthorized users are able to view and modify information pertaining to other users. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/90a7299e-9233-43fd-b666-7375c4fdbb3c
CVE ID: CVE-2024-2293 State: PUBLISHED Published: 2024-03-13T15:27:00.223Z Last Updated: 2024-08-01T19:11:52.472Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: geminilabs Products: Site Reviews Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Site Reviews plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the user display name in all versions up to, and including, 6.11.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber access and above, to inject arbitrary web scripts in pages that will
ssible for authenticated attackers, with subscriber access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/823418d9-a231-4306-8575-2937a491509f?source=cve - https://plugins.trac.wordpress.org/browser/site-reviews/trunk/views/partials/listtable/filter.php#L5 - https://plugins.trac.wordpress.org/changeset?old_path=/site-reviews/tags/6.11.4&old=3049214&new_path=/site-reviews/tags/6.11.7&new=3049214&sfp_email=&sfph_mail=
CVE ID: CVE-2024-2294 State: PUBLISHED Published: 2024-03-16T01:55:44.198Z Last Updated: 2024-08-01T19:11:52.407Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) Vendors: softaculous Products: Backuply – Backup, Restore, Migrate and Clone Problem Types: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Description: The Backuply – Backup, Restore, Migrate and Clone plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.2.7 via the backup_name parameter in the backuply_download_backup function. This makes it possible for attackers to have an account with only activate_plugins capability to a
load_backup function. This makes it possible for attackers to have an account with only activate_plugins capability to access arbitrary files on the server, which can contain sensitive information. This only impacts sites hosted on Windows servers. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/be3bd1f2-092c-47c4-a4e4-3365e107c57f?source=cve - https://plugins.trac.wordpress.org/browser/backuply/trunk/main/ajax.php#L78 - https://plugins.trac.wordpress.org/browser/backuply/trunk/functions.php#L1615 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3050547%40back
nk/functions.php#L1615 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3050547%40backuply&new=3050547%40backuply&sfp_email=&sfph_mail=
CVE ID: CVE-2024-2295 State: PUBLISHED Published: 2024-06-01T07:35:55.953Z Last Updated: 2024-08-01T19:11:53.465Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: f1logic Products: Contact Form Manager Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Contact Form Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's [xyz-cfm-form] shortcode in all versions up to, and including, 1.6.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and ab
t escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/1cda411b-b277-4b4d-9087-dadede4b67dd?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3095454%40contact-form-manager&new=3095454%40contact-form-manager&sfp_email=&sfph_mail=
CVE ID: CVE-2024-2296 State: PUBLISHED Published: 2024-04-06T08:38:53.976Z Last Updated: 2024-08-01T19:11:53.298Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N) Vendors: 10web Products: Photo Gallery by 10Web – Mobile-Friendly Image Gallery Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG file uploads in all versions up to, and including, 1.8.21 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with admin
e to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/994a044d-db69-4f2d-9027-cf3665446ed3?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3058445%40photo-gallery&new=3058445%40photo-gallery&sfp_email=&sfph_mail=
CVE ID: CVE-2024-2297 State: PUBLISHED Published: 2025-02-27T05:23:05.572Z Last Updated: 2025-02-27T18:41:18.031Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: Bricks Builder Products: Bricks Problem Types: CWE-269 Description: The Bricks theme for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.9.6.1. This is due to insufficient validation checks placed on the create_autosave AJAX function. This makes it possible for authenticated attackers, with contributor-level access and above, to execute arbitrary PHP code with elevated (administrator-level) privileges. NOTE: Successful exploitation requires (1) the Bricks Builde
ry PHP code with elevated (administrator-level) privileges. NOTE: Successful exploitation requires (1) the Bricks Builder to be enabled for posts (2) Builder access to be enabled for contributor-level users, and (3) "Code Execution" to be enabled for administrator-level users within the theme's settings. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/cb075e85-75fc-4008-8270-4d1064ace29e?source=cve - https://bricksbuilder.io/release/bricks-1-9-7/
CVE ID: CVE-2024-2298 State: PUBLISHED Published: 2024-03-08T06:58:06.089Z Last Updated: 2024-08-01T19:11:52.483Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: cservit Products: affiliate-toolkit – WordPress Affiliate Plugin Problem Types: CWE-862 Missing Authorization Description: The affiliate-toolkit – WordPress Affiliate Plugin plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the atkp_import_product() function in all versions up to, and including, 3.5.4. This makes it possible for authenticated attackers, with subscriber-level access and above, to to perform unauthorized actions such as creating importing p
cated attackers, with subscriber-level access and above, to to perform unauthorized actions such as creating importing products. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/4d4d0176-3b7d-4de5-95ec-365873e6f13b?source=cve - https://plugins.trac.wordpress.org/changeset/3045821/affiliate-toolkit-starter/trunk/includes/atkp_endpoints.php
CVE ID: CVE-2024-2299 State: PUBLISHED Published: 2024-05-12T20:27:55.262Z Last Updated: 2024-08-01T19:11:53.384Z Severity: HIGH (CVSS 7.4 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N) Vendors: parisneo Products: parisneo/lollms-webui Problem Types: CWE-79 Description: A stored Cross-Site Scripting (XSS) vulnerability exists in the parisneo/lollms-webui application due to improper validation of uploaded files in the profile picture upload functionality. Attackers can exploit this vulnerability by uploading malicious HTML files containing JavaScript code, which is executed when the file is accessed. This vulnerability is remotely exploitable via Cross-Site Request Forgery (CSRF), allowing att
hen the file is accessed. This vulnerability is remotely exploitable via Cross-Site Request Forgery (CSRF), allowing attackers to perform actions on behalf of authenticated users and potentially leading to unauthorized access to sensitive information within the Lollms-webui application. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://huntr.com/bounties/f1adaac0-b9ed-4093-a0f3-2d0a4ecba398
CVE ID: CVE-2024-2300 State: PUBLISHED Published: 2024-06-12T15:00:23.548Z Last Updated: 2024-10-27T15:04:29.174Z Vendors: HP Inc. Products: HP Advance Mobile Application Description: HP Advance Mobile Applications for iOS and Android are potentially vulnerable to information disclosure when using an outdated version of the application via mobile devices. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://support.hp.com/us-en/document/ish_10737234-10737262-16/hpsbgn03921
CVE ID: CVE-2024-2301 State: PUBLISHED Published: 2024-05-23T16:53:24.873Z Last Updated: 2025-03-14T00:42:36.618Z Vendors: HP Inc. Products: Certain HP LaserJet Pro Devices Description: Certain HP LaserJet Pro devices are potentially vulnerable to a Cross-Site Scripting (XSS) attack via the web management interface of the device. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://support.hp.com/us-en/document/ish_10617756-10617781-16/hpsbpi03940
CVE ID: CVE-2024-2302 State: PUBLISHED Published: 2024-04-09T18:58:30.328Z Last Updated: 2024-08-01T19:11:52.679Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: smub Products: Easy Digital Downloads – Sell Digital Files & Subscriptions (eCommerce Store + Payments Made Easy) Problem Types: CWE-532 Information Exposure Through Log Files Description: The Easy Digital Downloads – Sell Digital Files & Subscriptions (eCommerce Store + Payments Made Easy) plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.2.9. This makes it possible for unauthenticated attackers to download the debug log via Directory Listi
and including, 3.2.9. This makes it possible for unauthenticated attackers to download the debug log via Directory Listing. This file may include PII. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/0837ba20-4b47-4cc8-9eb3-322289513d79?source=cve - https://plugins.trac.wordpress.org/browser/easy-digital-downloads/trunk/includes/class-edd-logging.php#L621 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3060808%40easy-digital-downloads%2Ftrunk&old=3042139%40easy-digital-downloads%2Ftrunk&sfp_email=&sfph_mail=
CVE ID: CVE-2024-2303 State: PUBLISHED Published: 2024-03-26T05:32:33.379Z Last Updated: 2024-08-02T16:12:01.543Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: flector Products: Easy Textillate Problem Types: CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) Description: The Easy Textillate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'textillate' shortcode in all versions up to, and including, 2.01 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to i
upplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/66529116-7b0e-4e2f-96f1-a4d91fa7f956?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3050231%40easy-textillate&new=3050231%40easy-textillate&sfp_email=&sfph_mail=
CVE ID: CVE-2024-2304 State: PUBLISHED Published: 2024-03-20T06:48:26.353Z Last Updated: 2024-08-05T19:32:31.920Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: anshuln90 Products: Animated Headline Problem Types: CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) Description: The Animated Headline plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'animated-headline' shortcode in all versions up to, and including, 4.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above perm
ng on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/6f589b5d-9cdb-4521-bc60-c8f19d0ef982?source=cve - https://wordpress.org/plugins/animated-headline/
CVE ID: CVE-2024-2305 State: PUBLISHED Published: 2024-04-09T18:59:12.773Z Last Updated: 2024-08-01T19:11:53.361Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: brainstormforce Products: Cards for Beaver Builder Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Cards for Beaver Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the BootstrapCard link in all versions up to, and including, 1.1.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and a
ut escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/ac0dfaac-cce6-45f7-ad5b-d7dcb66453bd?source=cve - https://plugins.trac.wordpress.org/changeset?old_path=/bb-bootstrap-cards/tags/1.1.2&old=3056277&new_path=/bb-bootstrap-cards/tags/1.1.3&new=3056277&sfp_email=&sfph_mail=
CVE ID: CVE-2024-2306 State: PUBLISHED Published: 2024-04-09T18:59:34.799Z Last Updated: 2024-08-01T19:11:53.341Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: Revolution Slider Products: Slider Revolution Problem Types: CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) Description: The Revslider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via svg upload in all versions up to, and including, 6.6.20 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injecte
r authenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. By default, this can only be exploited by administrators, but the ability to use and configure revslider can be extended to authors. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/f6af1e90-9bad-470b-9e00-137000c0450c?source=cve - https://www.sliderrevolution.com/documentation/changelog/
CVE ID: CVE-2024-2307 State: PUBLISHED Published: 2024-03-19T16:16:31.902Z Last Updated: 2025-11-20T18:18:14.904Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:L) Vendors: Red Hat Products: Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9 Problem Types: CWE-347 Description: A flaw was found in osbuild-composer. A condition can be triggered that disables GPG verification for package repositories, which can expose the build phase to a Man-in-the-Middle attack, allowing untrusted code to be installed into an image being built. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2024:2119 -
otes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2024:2119 - https://access.redhat.com/errata/RHSA-2024:2961 - https://access.redhat.com/security/cve/CVE-2024-2307 - https://bugzilla.redhat.com/show_bug.cgi?id=2268513
CVE ID: CVE-2024-2308 State: PUBLISHED Published: 2024-03-16T01:55:43.573Z Last Updated: 2024-08-01T19:11:53.390Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: elementinvader Products: ElementInvader Addons for Elementor Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The ElementInvader Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the button link in the EliSlider in all versions up to, and including, 1.2.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor access