Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-1048 State: PUBLISHED Published: 2024-02-06T17:30:35.360Z Last Updated: 2025-11-20T18:11:20.016Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: Red Hat Products: Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7 Problem Types: CWE-459 Description: A flaw was found in the grub2-set-bootflag utility of grub2. After the fix of CVE-2019-14865, grub2-set-bootflag will create a temporary file with the new grubenv content and rename it to the original grubenv file. If the program is killed before the rename operation, the temporary file will not be removed and may fill the filesystem when i
program is killed before the rename operation, the temporary file will not be removed and may fill the filesystem when invoked multiple times, resulting in a filesystem out of free inodes or blocks. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2024:2456 - https://access.redhat.com/errata/RHSA-2024:3184 - https://access.redhat.com/security/cve/CVE-2024-1048 - https://bugzilla.redhat.com/show_bug.cgi?id=2256827 - https://www.openwall.com/lists/oss-security/2024/02/06/3
CVE ID: CVE-2024-1049 State: PUBLISHED Published: 2024-03-23T03:33:41.888Z Last Updated: 2024-08-01T18:26:30.415Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: godaddy Products: Page Builder Gutenberg Blocks – CoBlocks Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Page Builder Gutenberg Blocks – CoBlocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Icon Widget's in all versions up to, and including, 3.1.6 due to insufficient input sanitization and output escaping on the link value. This makes it possible for authenticated attackers with contr
input sanitization and output escaping on the link value. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/56d1d152-946f-47c9-b0d5-76513370677f?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3049222%40vimeography&new=3049222%40vimeography&sfp_email=&sfph_mail=
CVE ID: CVE-2024-1050 State: PUBLISHED Published: 2024-05-04T07:36:22.222Z Last Updated: 2024-08-01T18:26:30.414Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: carazo Products: Import and export users and customers Problem Types: CWE-862 Missing Authorization Description: The Import and export users and customers plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ajax_force_reset_password_delete_metas() function in all versions up to, and including, 1.26.5. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete all forced password resets. Additional
le for authenticated attackers, with subscriber-level access and above, to delete all forced password resets. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/d2fbd599-0a6c-4182-87d9-ad7cf3fb5865?source=cve - https://plugins.trac.wordpress.org/browser/import-users-from-csv-with-meta/trunk/classes/force-reset-password.php#L64 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3077276%40import-users-from-csv-with-meta&new=3077276%40import-users-from-csv-with-meta&sfp_email=&sfph_mail=
CVE ID: CVE-2024-1051 State: PUBLISHED Published: 2024-03-30T04:31:09.731Z Last Updated: 2024-08-01T18:26:30.389Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: fernandobt Products: List category posts Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The List category posts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'catlist' shortcode in all versions up to, and including, 0.89.6 due to insufficient input sanitization and output escaping on user supplied attributes like 'title_tag'. This makes it possible for authenticated attackers with contributo
scaping on user supplied attributes like 'title_tag'. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/a58cba26-a57e-4170-95bb-54ea7cfdb10c?source=cve - https://plugins.svn.wordpress.org/list-category-posts/trunk/include/lcp-catlistdisplayer.php - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3055332%40list-category-posts&new=3055332%40list-category-posts&sfp_email=
changeset?sfp_email=&sfph_mail=&reponame=&old=3055332%40list-category-posts&new=3055332%40list-category-posts&sfp_email=&sfph_mail=
CVE ID: CVE-2024-1052 State: PUBLISHED Published: 2024-02-05T20:43:53.939Z Last Updated: 2024-08-01T18:26:30.420Z Severity: HIGH (CVSS 8 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H) Vendors: HashiCorp Products: Boundary, Boundary Enterprise Problem Types: CWE-295 Description: Boundary and Boundary Enterprise (“Boundary”) is vulnerable to session hijacking through TLS certificate tampering. An attacker with privileges to enumerate active or pending sessions, obtain a private key pertaining to a session, and obtain a valid trust on first use (TOFU) token may craft a TLS certificate to hijack an active session and gain access to the underlying service or application. Additional Analyst Notes:
ificate to hijack an active session and gain access to the underlying service or application. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://discuss.hashicorp.com/t/hcsec-2024-02-boundary-vulnerable-to-session-hijacking-through-tls-certificate-tampering/62458
CVE ID: CVE-2024-1053 State: PUBLISHED Published: 2024-02-22T05:32:49.364Z Last Updated: 2024-08-01T18:26:30.353Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: theeventscalendar Products: Event Tickets and Registration Problem Types: CWE-284 Improper Access Control Description: The Event Tickets and Registration plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'email' action in all versions up to, and including, 5.8.1. This makes it possible for authenticated attackers, with contributor-level access and above, to email the attendees list to themselves. Additional Analyst Notes: - CISA ADP Vulnrichme
butor-level access and above, to email the attendees list to themselves. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/a7839847-2637-4a0d-bfc1-5f80b8433e24?source=cve - https://plugins.trac.wordpress.org/changeset/3038150/event-tickets/tags/5.8.2/src/Tickets/Commerce/Reports/Attendees.php
CVE ID: CVE-2024-1054 State: PUBLISHED Published: 2024-02-20T18:56:43.280Z Last Updated: 2024-08-01T18:26:30.392Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: pluggabl Products: Booster for WooCommerce Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Booster for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wcj_product_barcode' shortcode in all versions up to, and including, 7.1.6 due to insufficient input sanitization and output escaping on user supplied attributes like 'color'. This makes it possible for authenticated attackers wi
tion and output escaping on user supplied attributes like 'color'. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/c0b86c45-c346-4df7-844e-01de027bbc1e?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3034358%40woocommerce-jetpack&new=3034358%40woocommerce-jetpack&sfp_email=&sfph_mail=
CVE ID: CVE-2024-1055 State: PUBLISHED Published: 2024-02-07T06:46:55.779Z Last Updated: 2024-08-01T18:26:30.441Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: ideaboxcreations Products: PowerPack Addons for Elementor (Free Widgets, Extensions and Templates) Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The PowerPack Addons for Elementor (Free Widgets, Extensions and Templates) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's buttons in all versions up to, and including, 2.7.14 due to insufficient input sanitization and output escaping on user suppli
s in all versions up to, and including, 2.7.14 due to insufficient input sanitization and output escaping on user supplied URL values. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/036cf299-80c2-48a8-befc-02899ab96e3c?source=cve - https://plugins.trac.wordpress.org/browser/powerpack-lite-for-elementor/trunk/modules/buttons/widgets/buttons.php#L1544 - https://plugins.trac.wordpress.org/changeset?sf
ack-lite-for-elementor/trunk/modules/buttons/widgets/buttons.php#L1544 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3030473%40powerpack-lite-for-elementor&new=3030473%40powerpack-lite-for-elementor&sfp_email=&sfph_mail=
CVE ID: CVE-2024-1056 State: PUBLISHED Published: 2024-08-29T13:52:54.751Z Last Updated: 2024-08-29T14:03:32.926Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: FunnelKit Products: FunnelKit Funnel Builder Pro Problem Types: CWE-79 Description: The FunnelKit Funnel Builder Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'allow_iframe_tag_in_post' function which uses the 'wp_kses_allowed_html' filter to globally allow script and iframe tags in posts in all versions up to, and including, 3.4.5. This makes it possible for authenticated attackers, with contributor access and above, to inject arbitrary web scripts in pages that will
sible for authenticated attackers, with contributor access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/2fbacaf2-0b3e-4d1e-adc3-c501a6c4c816?source=cve - https://myaccount.funnelkit.com/changelog/changelog-funnel-builder-pro/?v=7516fd43adaa
CVE ID: CVE-2024-1057 State: PUBLISHED Published: 2024-04-20T01:56:38.442Z Last Updated: 2024-08-01T18:26:30.425Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: devitemsllc Products: ShopLentor – WooCommerce Builder for Elementor & Gutenberg +12 Modules – All in One Solution (formerly WooLentor) Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The ShopLentor – WooCommerce Builder for Elementor & Gutenberg +10 Modules – All in One Solution (formerly WooLentor) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wishsuite_button' shortcode in all versions up
WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wishsuite_button' shortcode in all versions up to, and including, 2.8.1 due to insufficient input sanitization and output escaping on user supplied attributes like 'button_class'. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/b6d8212d-7e72-487d-a4e8-0582fa72f602?source=cve - https://plugins.trac.wordpress.org/changeset/30447
/vulnerabilities/id/b6d8212d-7e72-487d-a4e8-0582fa72f602?source=cve - https://plugins.trac.wordpress.org/changeset/3044764/woolentor-addons/tags/2.8.2/includes/modules/wishlist/includes/templates/wishsuite-button-add.php
CVE ID: CVE-2024-1058 State: PUBLISHED Published: 2024-02-20T18:56:52.062Z Last Updated: 2024-08-01T18:26:30.417Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: gpriday Products: SiteOrigin Widgets Bundle Problem Types: CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) Description: The SiteOrigin Widgets Bundle plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the onclick parameter in all versions up to, and including, 1.58.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with contributor access or higher to inject arbitrary web scripts in
This makes it possible for authenticated attackers with contributor access or higher to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. 1.58.3 offers a partial fix. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/ffeb766f-3684-4eec-bacb-bbf0d434aba0?source=cve - https://plugins.trac.wordpress.org/browser/so-widgets-bundle/tags/1.58.2/widgets/button/tpl/default.php#L22 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3031864%40so-widgets-bundle%2Ftrunk&old=3027675%40so-widgets-bundle%2Ftrunk&sfp_email=&sfph_mai
sfph_mail=&reponame=&new=3031864%40so-widgets-bundle%2Ftrunk&old=3027675%40so-widgets-bundle%2Ftrunk&sfp_email=&sfph_mail= - https://plugins.trac.wordpress.org/browser/so-widgets-bundle/tags/1.58.3/base/base.php#L404 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3033967%40so-widgets-bundle%2Ftrunk&old=3031864%40so-widgets-bundle%2Ftrunk&sfp_email=&sfph_mail=
CVE ID: CVE-2024-1059 State: PUBLISHED Published: 2024-01-30T21:14:24.088Z Last Updated: 2025-05-08T17:51:54.136Z Vendors: Google Products: Chrome Problem Types: Use after free Description: Use after free in Peer Connection in Google Chrome prior to 121.0.6167.139 allowed a remote attacker to potentially exploit stack corruption via a crafted HTML page. (Chromium security severity: High) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2024/01/stable-channel-update-for-desktop_30.html - https://crbug.com/1514777 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NEUXJY
rbug.com/1514777 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NEUXJY3YC3VGIJW2AOHL4NZ7ZK7BRYWY/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XCVKRHRWPMITSVFBHQBSNXOVJAKT547Q/
CVE ID: CVE-2024-1060 State: PUBLISHED Published: 2024-01-30T21:14:24.325Z Last Updated: 2025-05-29T15:04:26.807Z Vendors: Google Products: Chrome Problem Types: Use after free Description: Use after free in Canvas in Google Chrome prior to 121.0.6167.139 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2024/01/stable-channel-update-for-desktop_30.html - https://crbug.com/1511567 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NEUXJY3YC3VGIJW2
511567 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NEUXJY3YC3VGIJW2AOHL4NZ7ZK7BRYWY/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XCVKRHRWPMITSVFBHQBSNXOVJAKT547Q/
CVE ID: CVE-2024-1061 State: PUBLISHED Published: 2024-01-30T08:26:23.960Z Last Updated: 2024-11-12T20:40:40.338Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N) Problem Types: CWE-89 Description: The 'HTML5 Video Player' WordPress Plugin, version < 2.5.25 is affected by an unauthenticated SQL injection vulnerability in the 'id' parameter in the 'get_view' function. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.tenable.com/security/research/tra-2024-02
CVE ID: CVE-2024-1062 State: PUBLISHED Published: 2024-02-12T13:04:39.944Z Last Updated: 2025-11-20T18:11:23.096Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: Red Hat Products: Red Hat Directory Server 11.5 E4S for RHEL 8, Red Hat Directory Server 11.7 for RHEL 8, Red Hat Directory Server 11.8 for RHEL 8, Red Hat Directory Server 12.2 EUS for RHEL 9, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 8.6 Extended Update Support, Red Hat Enterprise Linux 8.8 Extended Update Support, Red Hat Enterprise Linux 9.2 Extended Update Support, Red Hat Directory Server 12, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 9 Problem
Red Hat Directory Server 12, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 9 Problem Types: CWE-122 Description: A heap overflow flaw was found in 389-ds-base. This issue leads to a denial of service when writing a value larger than 256 chars in log_entry_attr. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2024:1074 - https://access.redhat.com/errata/RHSA-2024:1372 - https://access.redhat.com/errata/RHSA-2024:3047 - https://access.redhat.com/errata/RHSA-2024:4209 - https://access.redhat.com/errata/RHSA-2024:4633 - https://access.redhat.com/errata/RHSA-2024:5690 - https://acces
4209 - https://access.redhat.com/errata/RHSA-2024:4633 - https://access.redhat.com/errata/RHSA-2024:5690 - https://access.redhat.com/errata/RHSA-2024:7458 - https://access.redhat.com/errata/RHSA-2025:1632 - https://access.redhat.com/security/cve/CVE-2024-1062 - https://bugzilla.redhat.com/show_bug.cgi?id=2256711 - https://bugzilla.redhat.com/show_bug.cgi?id=2261879
CVE ID: CVE-2024-1063 State: PUBLISHED Published: 2024-01-30T09:20:26.210Z Last Updated: 2025-05-29T15:05:40.384Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Appwrite Products: Appwrite Problem Types: CWE-918 Description: Appwrite <= v1.4.13 is affected by a Server-Side Request Forgery (SSRF) via the '/v1/avatars/favicon' endpoint due to an incomplete fix of CVE-2023-27159. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.tenable.com/security/research/tra-2024-03
CVE ID: CVE-2024-1064 State: PUBLISHED Published: 2024-02-03T09:02:20.539Z Last Updated: 2024-08-29T15:04:54.738Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Arcadia Technology, LLC Products: Crafty Controller Problem Types: CWE-644 Description: A host header injection vulnerability in the HTTP handler component of Crafty Controller allows a remote, unauthenticated attacker to trigger a Denial of Service (DoS) condition via a modified host header Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://gitlab.com/crafty-controller/crafty-4/-/issues/327
CVE ID: CVE-2024-1065 State: PUBLISHED Published: 2024-04-19T08:51:56.962Z Last Updated: 2024-08-01T18:26:30.442Z Vendors: Arm Ltd Products: Bifrost GPU Kernel Driver, Valhall GPU Kernel Driver, Arm 5th Gen GPU Architecture Kernel Driver Problem Types: CWE-416 Description: Use After Free vulnerability in Arm Ltd Bifrost GPU Kernel Driver, Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Gen GPU Architecture Kernel Driver allows a local non-privileged user to make improper GPU memory processing operations to gain access to already freed memory.This issue affects Bifrost GPU Kernel Driver: from r45p0 through r48p0; Valhall GPU Kernel Driver: from r45p0 through r48p0; Arm 5th Gen GPU Architec
U Kernel Driver: from r45p0 through r48p0; Valhall GPU Kernel Driver: from r45p0 through r48p0; Arm 5th Gen GPU Architecture Kernel Driver: from r45p0 through r48p0. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://developer.arm.com/Arm%20Security%20Center/Mali%20GPU%20Driver%20Vulnerabilities
CVE ID: CVE-2024-1066 State: PUBLISHED Published: 2024-02-07T22:02:11.043Z Last Updated: 2024-10-03T06:23:18.169Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: GitLab Products: GitLab Problem Types: CWE-770 Description: An issue has been discovered in GitLab EE affecting all versions from 13.3.0 prior to 16.6.7, 16.7 prior to 16.7.5, and 16.8 prior to 16.8.2 which allows an attacker to do a resource exhaustion using GraphQL `vulnerabilitiesCountByDay` Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/420341
CVE ID: CVE-2024-1067 State: PUBLISHED Published: 2024-05-03T13:25:06.544Z Last Updated: 2025-03-27T15:09:12.088Z Vendors: Arm Ltd Products: Bifrost GPU Kernel Driver, Valhall GPU Kernel Driver, Arm 5th Gen GPU Architecture Kernel Driver Problem Types: CWE-416 Description: Use After Free vulnerability in Arm Ltd Bifrost GPU Kernel Driver, Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Gen GPU Architecture Kernel Driver allows a local non-privileged user to make improper GPU memory processing operations. On Armv8.0 cores, there are certain combinations of the Linux Kernel and Mali GPU kernel driver configurations that would allow the GPU operations to affect the userspace memory of other
l and Mali GPU kernel driver configurations that would allow the GPU operations to affect the userspace memory of other processes. This issue affects Bifrost GPU Kernel Driver: from r41p0 through r47p0; Valhall GPU Kernel Driver: from r41p0 through r47p0; Arm 5th Gen GPU Architecture Kernel Driver: from r41p0 through r47p0. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://developer.arm.com/Arm%20Security%20Center/Mali%20GPU%20Driver%20Vulnerabilities
CVE ID: CVE-2024-1068 State: PUBLISHED Published: 2024-03-11T17:56:05.763Z Last Updated: 2024-08-26T18:17:29.237Z Vendors: Unknown Products: 404 Solution Problem Types: CWE-89 SQL Injection Description: The 404 Solution WordPress plugin before 2.35.8 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admins. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://wpscan.com/vulnerability/25e3c1a1-3c45-41df-ae50-0e20d86c5484/