Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
on the lines `L56-L62`. First, it sets the `CloneOptions`, specifying the url, the depth etc. It then validates the options. It then sets up an in-memory filesystem, to which it clones and Finally, it clones the repository. The `(g *Git) Clone()` method is vulnerable to a DoS attack: A Minder user can instruct Minder to clone a large repository which will exhaust memory and crash the Minder server. The root cause of this vulnerability is a combination of the following conditions: 1. Users can control the Git URL which Minder clones, 2. Minder does not enforce a size limit to the repository, 3. Minder clones the entire repository into memory. This issue has been addressed in commit `7979b43`
o the repository, 3. Minder clones the entire repository into memory. This issue has been addressed in commit `7979b43` which has been included in release version v0.0.52. Users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/stacklok/minder/security/advisories/GHSA-hpcg-xjq5-g666 - https://github.com/stacklok/minder/commit/7979b43 - https://github.com/stacklok/minder/blob/85985445c8ac3e51f03372e99c7b2f08a6d274aa/internal/providers/git/git.go#L55-L89 - https://github.com/stacklok/minder/blob/85985445c8ac3e51f03372e99c7b2f08a6d274aa/internal/providers/git
git.go#L55-L89 - https://github.com/stacklok/minder/blob/85985445c8ac3e51f03372e99c7b2f08a6d274aa/internal/providers/git/git.go#L56-L62
CVE ID: CVE-2024-37905 State: PUBLISHED Published: 2024-06-28T17:09:24.090Z Last Updated: 2024-08-02T04:04:23.359Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: goauthentik Products: authentik Problem Types: CWE-284, CWE-863 Description: authentik is an open-source Identity Provider that emphasizes flexibility and versatility. Authentik API-Access-Token mechanism can be exploited to gain admin user privileges. A successful exploit of the issue will result in a user gaining full admin access to the Authentik application, including resetting user passwords and more. This issue has been patched in version(s) 2024.2.4, 2024.4.2 and 2024.6.0. Additional Analyst N
user passwords and more. This issue has been patched in version(s) 2024.2.4, 2024.4.2 and 2024.6.0. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/goauthentik/authentik/security/advisories/GHSA-c78c-2r9w-p7x4 - https://github.com/goauthentik/authentik/releases/tag/version%2F2024.2.4 - https://github.com/goauthentik/authentik/releases/tag/version%2F2024.4.3 - https://github.com/goauthentik/authentik/releases/tag/version%2F2024.6.0
CVE ID: CVE-2024-37906 State: PUBLISHED Published: 2024-07-29T14:22:57.188Z Last Updated: 2024-08-02T04:04:23.431Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: Admidio Products: admidio Problem Types: CWE-89 Description: Admidio is a free, open source user management system for websites of organizations and groups. In Admidio before version 4.3.9, there is an SQL Injection in the `/adm_program/modules/ecards/ecard_send.php` source file of the Admidio Application. The SQL Injection results in a compromise of the application's database. The value of `ecard_recipients `POST parameter is being directly concatenated with the SQL query in the source code causi
he value of `ecard_recipients `POST parameter is being directly concatenated with the SQL query in the source code causing the SQL Injection. The SQL Injection can be exploited by a member user, using blind condition-based, time-based, and Out of band interaction SQL Injection payloads. This vulnerability is fixed in 4.3.9. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/Admidio/admidio/security/advisories/GHSA-69wx-xc6j-28v3 - https://github.com/Admidio/admidio/commit/3ff02b0c64a6911ab3e81cd61077f392c0b25248
CVE ID: CVE-2024-37917 State: PUBLISHED Published: 2025-04-02T00:00:00.000Z Last Updated: 2025-04-03T15:22:35.782Z Vendors: n/a Products: n/a Problem Types: n/a Description: Pexip Infinity before 35.0 has improper input validation that allows remote attackers to trigger a denial of service (software abort) via a crafted signalling message. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://docs.pexip.com/admin/security_bulletins.htm
CVE ID: CVE-2024-37918 State: PUBLISHED Published: 2024-07-20T09:01:48.790Z Last Updated: 2024-08-02T04:04:23.434Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: WPCone.com Products: ConeBlog – WordPress Blog Widgets Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WPCone.Com ConeBlog – WordPress Blog Widgets allows Stored XSS.This issue affects ConeBlog – WordPress Blog Widgets: from n/a through 1.4.8. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/coneblog-widgets/wordpress-
chment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/coneblog-widgets/wordpress-coneblog-plugin-1-4-8-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2024-37919 State: PUBLISHED Published: 2024-07-20T09:00:30.089Z Last Updated: 2024-08-02T04:04:23.405Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: Pratik Chaskar Products: Timeline Module for Beaver Builder Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Pratik Chaskar Timeline Module for Beaver Builder allows Stored XSS.This issue affects Timeline Module for Beaver Builder: from n/a through 1.1.3. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/timeline-for-bea
ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/timeline-for-beaver-builder/wordpress-timeline-module-for-beaver-builder-plugin-1-1-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2024-37920 State: PUBLISHED Published: 2024-07-20T08:58:54.431Z Last Updated: 2024-08-02T04:04:24.471Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: Repute InfoSystems Products: ARForms Form Builder Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Repute InfoSystems ARForms Form Builder allows Reflected XSS.This issue affects ARForms Form Builder: from n/a through 1.6.7. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/arforms-form-builder/wordpress-arforms-form-build
Container: References: - https://patchstack.com/database/vulnerability/arforms-form-builder/wordpress-arforms-form-builder-plugin-1-6-7-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2024-37921 State: PUBLISHED Published: 2024-11-01T14:18:11.253Z Last Updated: 2024-11-01T18:11:04.161Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: Kiboko Labs Products: Chained Quiz Problem Types: CWE-862 Description: Missing Authorization vulnerability in Kiboko Labs Chained Quiz allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Chained Quiz: from n/a through 1.3.2.8. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/chained-quiz/wordpress-chained-quiz-plugin-1-3-2-8-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2024-37922 State: PUBLISHED Published: 2024-07-20T08:57:56.380Z Last Updated: 2024-08-02T04:04:24.588Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: Leap13 Products: Premium Addons for Elementor Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Leap13 Premium Addons for Elementor allows Stored XSS.This issue affects Premium Addons for Elementor: from n/a through 4.10.34. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/premium-addons-for-elementor/wordpress-premium-a
Container: References: - https://patchstack.com/database/vulnerability/premium-addons-for-elementor/wordpress-premium-addons-for-elementor-plugin-4-10-34-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2024-37923 State: PUBLISHED Published: 2024-07-09T07:38:41.511Z Last Updated: 2024-08-02T04:04:24.342Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L) Products: Cliengo – Chatbot Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Cliengo – Chatbot.This issue affects Cliengo – Chatbot: from n/a through 3.0.1. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/cliengo/wordpress-cliengo-chatbot-plugin-3-0-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2024-37924 State: PUBLISHED Published: 2024-08-12T22:56:42.982Z Last Updated: 2024-08-13T16:04:09.633Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Wp2speed Products: WP2Speed Faster Problem Types: CWE-200 Description: Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wp2speed WP2Speed Faster allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects WP2Speed Faster: from n/a through 1.0.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/wp2speed/wordpress-wp2speed-faster-optimize-pagespeed-insights-score-90-100-plugin-1-0-1-sensiti
/database/vulnerability/wp2speed/wordpress-wp2speed-faster-optimize-pagespeed-insights-score-90-100-plugin-1-0-1-sensitive-data-exposure-vulnerability?_s_id=cve
CVE ID: CVE-2024-37925 State: PUBLISHED Published: 2025-01-02T13:28:46.944Z Last Updated: 2025-01-02T14:31:30.829Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L) Vendors: BUDDYBOSS LLC Products: BuddyBoss Theme Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in BUDDYBOSS LLC BuddyBoss Theme allows Cross Site Request Forgery.This issue affects BuddyBoss Theme: from n/a through 2.4.61. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/theme/buddyboss-theme/vulnerability/wordpress-buddyboss-theme-theme-2-4-61-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2024-37926 State: PUBLISHED Published: 2024-11-01T14:18:10.633Z Last Updated: 2024-11-01T18:23:10.282Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: Alex Volkov Products: WP Accessibility Helper (WAH) Problem Types: CWE-862 Description: Missing Authorization vulnerability in Alex Volkov WP Accessibility Helper (WAH) allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects WP Accessibility Helper (WAH): from n/a through 0.6.2.9. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/wp-accessibility-helper/wordpress-wp-accessibility-helper-wah-plugin-0-6-2-8-broken
atchstack.com/database/vulnerability/wp-accessibility-helper/wordpress-wp-accessibility-helper-wah-plugin-0-6-2-8-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2024-37927 State: PUBLISHED Published: 2024-07-12T13:59:18.641Z Last Updated: 2024-08-02T04:04:23.423Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: NooTheme Products: Jobmonster Problem Types: CWE-269 Description: Improper Privilege Management vulnerability in NooTheme Jobmonster allows Privilege Escalation.This issue affects Jobmonster: from n/a through 4.7.0. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/noo-jobmonster/wordpress-jobmonster-theme-4-7-0-unauthenticated-privilege-escalation-vulnerability?_s_id=cve
CVE ID: CVE-2024-37928 State: PUBLISHED Published: 2024-07-12T14:00:51.146Z Last Updated: 2024-08-02T04:04:24.340Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H) Vendors: NooTheme Products: Jobmonster Problem Types: CWE-22 Description: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in NooTheme Jobmonster allows File Manipulation.This issue affects Jobmonster: from n/a through 4.7.0. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/noo-jobmonster/wordpress-jobmonster-theme-4-7-0-unauthenticated-arbitrary-file-deletion-vulnerability?_s_id=
lnerability/noo-jobmonster/wordpress-jobmonster-theme-4-7-0-unauthenticated-arbitrary-file-deletion-vulnerability?_s_id=cve
CVE ID: CVE-2024-37929 State: PUBLISHED Published: 2024-11-01T14:18:10.007Z Last Updated: 2024-11-04T14:07:03.150Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: solwin Products: User Activity Log Pro Problem Types: CWE-862 Description: Missing Authorization vulnerability in solwin User Activity Log Pro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects User Activity Log Pro: from n/a through 2.3.4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/user-activity-log-pro/wordpress-user-activity-log-pro-plugin-2-3-4-subscriber-multiple-broken-access-control-vu
rability/user-activity-log-pro/wordpress-user-activity-log-pro-plugin-2-3-4-subscriber-multiple-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2024-37930 State: PUBLISHED Published: 2024-08-12T23:00:54.742Z Last Updated: 2024-08-13T14:01:48.112Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: ThemeSphere Products: SmartMag Problem Types: CWE-200, CWE-862 Description: Exposure of Sensitive Information to an Unauthorized Actor, Missing Authorization vulnerability in ThemeSphere SmartMag allows Excavation, Accessing Functionality Not Properly Constrained by ACLs.This issue affects SmartMag: from n/a through 9.3.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/smartmag-responsive-retina-wordpress-magazine/wordpress-smartmag-th
ces: - https://patchstack.com/database/vulnerability/smartmag-responsive-retina-wordpress-magazine/wordpress-smartmag-theme-9-3-0-sensitive-data-exposure-via-log-file-vulnerability?_s_id=cve
CVE ID: CVE-2024-37931 State: PUBLISHED Published: 2025-01-02T13:27:24.818Z Last Updated: 2025-01-02T14:33:50.900Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: Creativthemes Products: Point Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Creativthemes Point allows Cross Site Request Forgery.This issue affects Point: from n/a through 1.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/theme/point/vulnerability/wordpress-point-theme-1-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2024-37932 State: PUBLISHED Published: 2024-07-12T14:03:09.283Z Last Updated: 2024-08-02T04:04:24.389Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H) Vendors: anhvnit Products: Woocommerce OpenPos Problem Types: CWE-22 Description: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in anhvnit Woocommerce OpenPos allows File Manipulation.This issue affects Woocommerce OpenPos: from n/a through 6.4.4. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/woocommerce-openpos/wordpress-woocommerce-openpos-plugin-6-4-4-unauthenticated-arbi
atchstack.com/database/vulnerability/woocommerce-openpos/wordpress-woocommerce-openpos-plugin-6-4-4-unauthenticated-arbitrary-file-deletion-vulnerability?_s_id=cve
CVE ID: CVE-2024-37933 State: PUBLISHED Published: 2024-07-12T13:23:07.232Z Last Updated: 2024-08-02T04:04:23.426Z Severity: CRITICAL (CVSS 9.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L) Vendors: anhvnit Products: Woocommerce OpenPos Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in anhvnit Woocommerce OpenPos.This issue affects Woocommerce OpenPos: from n/a through 6.4.4. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/woocommerce-openpos/wordpress-woocommerce-openpos-plugin-6-4-4-unauthenticated-sql-injection-vulne
atabase/vulnerability/woocommerce-openpos/wordpress-woocommerce-openpos-plugin-6-4-4-unauthenticated-sql-injection-vulnerability?_s_id=cve
CVE ID: CVE-2024-37934 State: PUBLISHED Published: 2024-07-09T12:22:20.040Z Last Updated: 2024-08-02T04:04:24.406Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) Vendors: Saturday Drive Products: Ninja Forms Problem Types: CWE-94 Description: Improper Control of Generation of Code ('Code Injection') vulnerability in Saturday Drive Ninja Forms allows Code Injection.This issue affects Ninja Forms: from n/a through 3.8.4. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/ninja-forms/wordpress-ninja-forms-plugin-3-8-4-subscriber-arbitrary-shortcode-execution-vulnerability?_s_id=cve
CVE ID: CVE-2024-37935 State: PUBLISHED Published: 2024-08-13T09:47:40.201Z Last Updated: 2024-08-13T13:16:22.209Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: anhvnit Products: Woocommerce OpenPos Problem Types: CWE-862 Description: Missing Authorization vulnerability in anhvnit Woocommerce OpenPos allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Woocommerce OpenPos: from n/a through 6.4.4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/woocommerce-openpos/wordpress-woocommerce-openpos-plugin-6-4-4-unauthenticated-sensitive-data-exposure-vulnerability?_s_id=cv
mmerce-openpos/wordpress-woocommerce-openpos-plugin-6-4-4-unauthenticated-sensitive-data-exposure-vulnerability?_s_id=cve
CVE ID: CVE-2024-37936 State: PUBLISHED Published: 2024-07-20T08:56:01.919Z Last Updated: 2024-08-02T04:04:24.419Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: labibahmed Products: Tabs For WPBakery Page Builder Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in labibahmed Tabs For WPBakery Page Builder allows Stored XSS.This issue affects Tabs For WPBakery Page Builder: from n/a through 1.2. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/tabs-for-visual-composer/wordpress-tab
VE Program Container: References: - https://patchstack.com/database/vulnerability/tabs-for-visual-composer/wordpress-tabs-for-wpbakery-page-builder-plugin-1-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2024-37937 State: PUBLISHED Published: 2025-01-02T12:01:02.910Z Last Updated: 2025-01-02T16:25:30.880Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: Rara Theme Products: Rara Business Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Rara Theme Rara Business allows Cross Site Request Forgery.This issue affects Rara Business: from n/a through 1.2.5. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/theme/rara-business/vulnerability/wordpress-rara-business-theme-1-2-5-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2024-37938 State: PUBLISHED Published: 2024-07-12T13:49:33.077Z Last Updated: 2024-08-02T04:04:24.188Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: MyThemeShop Products: SociallyViral Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in MyThemeShop SociallyViral.This issue affects SociallyViral: from n/a through 1.0.10. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/sociallyviral/wordpress-sociallyviral-theme-1-0-10-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2024-37939 State: PUBLISHED Published: 2024-07-12T13:45:51.246Z Last Updated: 2024-08-02T04:04:24.119Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: VolThemes Products: Patricia Lite Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in VolThemes Patricia Lite.This issue affects Patricia Lite: from n/a through 1.2.3. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/patricia-lite/wordpress-patricia-lite-theme-1-2-3-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2024-37940 State: PUBLISHED Published: 2024-07-12T13:44:14.951Z Last Updated: 2024-08-02T04:04:24.449Z Severity: HIGH (CVSS 7.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:N/A:H) Vendors: Seraphinite Solutions Products: Seraphinite Accelerator (Full, premium) Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Seraphinite Solutions Seraphinite Accelerator (Full, premium).This issue affects Seraphinite Accelerator (Full, premium): from n/a through 2.21.13. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/seraphinite-accelerator-ext/wordpress-seraphinite-accelerator-
ferences: - https://patchstack.com/database/vulnerability/seraphinite-accelerator-ext/wordpress-seraphinite-accelerator-full-premium-plugin-2-21-13-csrf-leading-to-arbitrary-file-deletion-vulnerability?_s_id=cve
CVE ID: CVE-2024-37941 State: PUBLISHED Published: 2024-07-12T13:42:37.780Z Last Updated: 2024-08-02T04:04:24.296Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: Internal Link Juicer Products: Internal Link Juicer: SEO Auto Linker for WordPress Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Internal Link Juicer Internal Link Juicer: SEO Auto Linker for WordPress.This issue affects Internal Link Juicer: SEO Auto Linker for WordPress: from n/a through 2.24.3. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/internal-links/wordpress-in
chment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/internal-links/wordpress-internal-link-juicer-seo-auto-linker-for-wordpress-plugin-2-24-3-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2024-37942 State: PUBLISHED Published: 2024-07-22T10:28:35.072Z Last Updated: 2024-08-02T04:04:24.345Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) Vendors: Berqier Ltd Products: BerqWP Problem Types: CWE-918 Description: Server-Side Request Forgery (SSRF) vulnerability in Berqier Ltd BerqWP.This issue affects BerqWP: from n/a through 1.7.5. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/searchpro/wordpress-berqwp-plugin-1-7-5-unauthenticated-non-blind-server-side-request-forgery-ssrf-vulnerability?_s_id=cve