Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
pient of the purchase receipt. This makes it possible for unauthenticated attackers to bypass intended security restrictions and view the receipts of other users, which contains a link to download paid content. Successful exploitation requires knowledge of another customers email address as well as the file ID of the content they purchased. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/d3f4de75-abf5-46e8-854d-be91ed74a5f3?source=cve - https://plugins.trac.wordpress.org/changeset/3188001/easy-digital-downloads/trunk/includes/blocks/includes/orders/functions.php?old=2990247&old_path=easy-digital-downloads%2Ftrunk%2Fin
l-downloads/trunk/includes/blocks/includes/orders/functions.php?old=2990247&old_path=easy-digital-downloads%2Ftrunk%2Fincludes%2Fblocks%2Fincludes%2Forders%2Ffunctions.php
CVE ID: CVE-2024-9655 State: PUBLISHED Published: 2024-11-01T07:33:30.334Z Last Updated: 2024-11-01T13:35:51.029Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: britner Products: Gutenberg Blocks with AI by Kadence WP – Page Builder Features Problem Types: CWE-79 Description: The Gutenberg Blocks with AI by Kadence WP – Page Builder Features plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Icon widget in all versions up to, and including, 6.6.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, t
user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/d4027138-9a8a-4602-90fd-19e9f7c45bb4?source=cve - https://plugins.trac.wordpress.org/browser/kadence-blocks/trunk/includes/assets/js/kb-tippy.min.js - https://www.kadencewp.com/kadence-blocks/changelog/ - https://wordpress.org/plugins/kadence-blocks/#developers - https://plugins.trac.wordpress.org/changeset?old_path=%2Fkadence-blocks&old=3162912&new_path
adence-blocks/#developers - https://plugins.trac.wordpress.org/changeset?old_path=%2Fkadence-blocks&old=3162912&new_path=%2Fkadence-blocks&new=3170375&sfp_email=&sfph_mail=
CVE ID: CVE-2024-9656 State: PUBLISHED Published: 2024-10-12T05:39:41.676Z Last Updated: 2024-10-17T05:38:59.777Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: azexo Products: Mynx Page Builder Problem Types: CWE-79 Description: The Mynx Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 0.27.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file. Additional Analyst Notes: - CISA AD
itrary web scripts in pages that will execute whenever a user accesses the SVG file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/73a25208-81fe-4337-a344-1c129bd80862?source=cve - https://wordpress.org/plugins/mynx-page-builder/#developers
CVE ID: CVE-2024-9657 State: PUBLISHED Published: 2024-11-05T11:32:21.044Z Last Updated: 2024-11-05T13:29:19.637Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: bdthemes Products: Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) Problem Types: CWE-79 Description: The Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘tooltip' parameter in all versions up to, and including, 5.10.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticate
nd including, 5.10.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/67eb77e9-7e0b-4134-9cb6-30ba78f6a686?source=cve - https://plugins.trac.wordpress.org/browser/bdthemes-element-pack-lite/trunk/assets/js/modules/ep-tooltip.js#L14 - https://plugins.trac.wordpress.org/browser/bdthemes-element-pack-lite/trunk/assets/js/modules/ep-reading-timer.js#L12 - https://plugins.t
rac.wordpress.org/browser/bdthemes-element-pack-lite/trunk/assets/js/modules/ep-reading-timer.js#L12 - https://plugins.trac.wordpress.org/browser/bdthemes-element-pack-lite/trunk/assets/js/modules/ep-logo-grid.js#L22 - https://plugins.trac.wordpress.org/browser/bdthemes-element-pack-lite/trunk/assets/js/modules/ep-image-stack.js#L22 - https://plugins.trac.wordpress.org/browser/bdthemes-element-pack-lite/trunk/assets/js/modules/ep-wrapper-link.js#L12 - https://plugins.trac.wordpress.org/changeset/3180563/
CVE ID: CVE-2024-9658 State: PUBLISHED Published: 2025-03-07T08:21:27.043Z Last Updated: 2025-03-07T15:11:06.035Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: dasinfomedia Products: School Management System for Wordpress Problem Types: CWE-288 Description: The School Management System for Wordpress plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 93.0.0. This is due to the plugin not properly validating a user's identity prior to updating their details like email and password through the mj_smgt_update_user() and mj_smgt_add_admission() functions, along with a local file inclusion vulnerab
word through the mj_smgt_update_user() and mj_smgt_add_admission() functions, along with a local file inclusion vulnerability. This makes it possible for authenticated attackers, with student-level access and above, to change arbitrary user's email addresses and passwords, including administrators, and leverage that to gain access to their account. This was escalated four months ago after no response to our initial outreach, yet it still vulnerable. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/b5fd7bca-7754-4f83-8e51-5278e6e8cc78?source=cve - https://codecanyon.net/item/school-management-system-for-wordpress/114700
d7bca-7754-4f83-8e51-5278e6e8cc78?source=cve - https://codecanyon.net/item/school-management-system-for-wordpress/11470032
CVE ID: CVE-2024-9659 State: PUBLISHED Published: 2024-11-23T07:38:07.945Z Last Updated: 2024-11-24T18:28:44.067Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: dasinfomedia Products: School Management System for Wordpress Problem Types: CWE-434 Description: The School Management System for Wordpress plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the mj_smgt_user_avatar_image_upload() function in all versions up to, and including, 91.5.0. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. Additional
ckers to upload arbitrary files on the affected site's server which may make remote code execution possible. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/ff1f303f-17fc-4006-b21b-5846216995da?source=cve - https://codecanyon.net/item/school-management-system-for-wordpress/11470032
CVE ID: CVE-2024-9660 State: PUBLISHED Published: 2024-11-23T07:38:03.531Z Last Updated: 2024-11-26T16:40:47.980Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: dasinfomedia Products: School Management System for Wordpress Problem Types: CWE-434 Description: The School Management System for Wordpress plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the mj_smgt_load_documets_new() and mj_smgt_load_documets() functions in all versions up to, and including, 91.5.0. This makes it possible for authenticated attackers, with Student-level access and above, to upload arbitrary files on the affected site's server whic
thenticated attackers, with Student-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/1b36fc50-7573-466e-883e-8d26f243c4d0?source=cve - https://codecanyon.net/item/school-management-system-for-wordpress/11470032
CVE ID: CVE-2024-9661 State: PUBLISHED Published: 2025-02-07T15:21:05.450Z Last Updated: 2025-02-18T18:12:00.389Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: Soflyy Products: WP All Import Pro Problem Types: CWE-352 Description: The WP All Import Pro plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.9.7. This is due to missing nonce validation on the delete_and_edit function. This makes it possible for unauthenticated attackers to delete imported content (posts, comments, users, etc.) via a forged request, granted they can trick a site administrator into performing an action such as clicking on a lin
.) via a forged request, granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/b5f8659a-fb3f-4df3-85a6-979751627a9c?source=cve - https://www.wpallimport.com
CVE ID: CVE-2024-9662 State: PUBLISHED Published: 2025-05-15T20:07:22.233Z Last Updated: 2025-05-16T20:34:51.569Z Vendors: Unknown Products: CYAN Backup Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The CYAN Backup WordPress plugin before 2.5.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/dfa6ff7d-c0dc-4118-afe0-587a24c76f12/
CVE ID: CVE-2024-9663 State: PUBLISHED Published: 2025-05-15T20:07:22.429Z Last Updated: 2025-05-16T20:33:52.980Z Vendors: Unknown Products: CYAN Backup Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The CYAN Backup WordPress plugin before 2.5.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/0dbd0927-f245-4202-b96b-e55f36a8bb30/
CVE ID: CVE-2024-9664 State: PUBLISHED Published: 2025-02-07T15:21:04.505Z Last Updated: 2025-02-07T15:32:12.342Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Soflyy Products: WP All Import Pro Problem Types: CWE-502 Description: The WP All Import Pro plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 4.9.7 via deserialization of untrusted input from an import file. This makes it possible for authenticated attackers, with Administrator-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software. If a POP chain is present via an additional plugin or theme installed on
P chain is present in the vulnerable software. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/0099a8d7-827d-4215-9a2b-b3c268fb5e97?source=cve - https://www.wpallimport.com/
CVE ID: CVE-2024-9665 State: PUBLISHED Published: 2024-11-22T21:02:44.953Z Last Updated: 2024-11-23T01:26:27.732Z Severity: MEDIUM (CVSS 6.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) Vendors: Zimbra Products: Zimbra Problem Types: CWE-352 Description: Zimbra GraphQL Cross-Site Request Forgery Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Zimbra. User interaction is required to exploit this vulnerability in that the target must open a malicious email message. The specific flaw exists within the implementation of the graphql endpoint. The issue results from the lack of proper protections again
aw exists within the implementation of the graphql endpoint. The issue results from the lack of proper protections against cross-site request forgery (CSRF) attacks. An attacker can leverage this vulnerability to disclose information in the context of the target email account. Was ZDI-CAN-23939. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-24-1369/ - https://blog.zimbra.com/2024/10/new-patch-release-reminders-for-missing-attachments-out-of-office-notifications-traffic-light-protocol-tlp-and-mailto-links/
CVE ID: CVE-2024-9666 State: PUBLISHED Published: 2024-11-25T07:29:52.073Z Last Updated: 2025-11-11T17:10:37.951Z Severity: MEDIUM (CVSS 4.7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: Red Hat Products: Red Hat build of Keycloak 24, Red Hat build of Keycloak 24.0.9, Red Hat build of Keycloak 26.0, Red Hat build of Keycloak 26.0.6, Red Hat JBoss Enterprise Application Platform 8 Problem Types: CWE-444 Description: A vulnerability was found in the Keycloak Server. The Keycloak Server is vulnerable to a denial of service (DoS) attack due to improper handling of proxy headers. When Keycloak is configured to accept incoming proxy headers, it may accept non-IP values, such as obfuscated
y headers. When Keycloak is configured to accept incoming proxy headers, it may accept non-IP values, such as obfuscated identifiers, without proper validation. This issue can lead to costly DNS resolution operations, which an attacker could exploit to tie up IO threads and potentially cause a denial of service. The attacker must have access to send requests to a Keycloak instance that is configured to accept proxy headers, specifically when reverse proxies do not overwrite incoming headers, and Keycloak is configured to trust these headers. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://access.redhat.com/errata/RHSA-2024:10175 - https://access.redhat.com/errata/RHS
ADP Vulnrichment: References: - https://access.redhat.com/errata/RHSA-2024:10175 - https://access.redhat.com/errata/RHSA-2024:10176 - https://access.redhat.com/errata/RHSA-2024:10177 - https://access.redhat.com/errata/RHSA-2024:10178 - https://access.redhat.com/security/cve/CVE-2024-9666 - https://bugzilla.redhat.com/show_bug.cgi?id=2317440
CVE ID: CVE-2024-9667 State: PUBLISHED Published: 2024-11-05T08:31:38.115Z Last Updated: 2024-11-05T13:30:17.023Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: podcastmotor Products: Seriously Simple Podcasting Problem Types: CWE-79 Description: The Seriously Simple Podcasting plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 3.5.0. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. A
ipts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/f4232656-2e97-4888-8dde-14039d8c2f9d?source=cve - https://plugins.trac.wordpress.org/browser/seriously-simple-podcasting/trunk/php/classes/handlers/class-options-handler.php#L101 - https://wordpress.org/plugins/seriously-simple-podcasting/#developers - https://plugins.trac.wordpress.org/changeset/3181485/
CVE ID: CVE-2024-9668 State: PUBLISHED Published: 2024-11-13T08:29:34.832Z Last Updated: 2024-11-13T14:38:59.688Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: wproyal Products: Royal Elementor Addons and Templates Problem Types: CWE-79 Description: The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Countdown widget in all versions up to, and including, 1.7.1001 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that
ible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/a8e39f0b-eb4c-4568-9f5a-60a0dc3eb6ba?source=cve - https://plugins.trac.wordpress.org/browser/royal-elementor-addons/tags/1.7.1002/modules/countdown/widgets/wpr-countdown.php?rev=3184222
CVE ID: CVE-2024-9669 State: PUBLISHED Published: 2024-11-28T08:47:32.349Z Last Updated: 2024-11-29T19:24:13.054Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: ninjateam Products: File Manager Pro – Filester Problem Types: CWE-22 Description: The File Manager Pro – Filester plugin for WordPress is vulnerable to Local JavaScript File Inclusion in all versions up to, and including, 1.8.5 via the 'fm_locale' parameter. This makes it possible for authenticated attackers, with Administrator-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls
y files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included. The vulnerability was partially patched in version 1.8.5. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/7d947023-60d3-4bd8-b45d-e1663326d6c1?source=cve - https://plugins.trac.wordpress.org/browser/filester/trunk/includes/File_manager/FileManager.php#L250 - https://plugins.trac.wordpress.org/browser/filester/trunk/views/pages/html-filemanager.php#L3 - https://plugins.tra
50 - https://plugins.trac.wordpress.org/browser/filester/trunk/views/pages/html-filemanager.php#L3 - https://plugins.trac.wordpress.org/changeset/3186518/ - https://plugins.trac.wordpress.org/changeset/3196150/
CVE ID: CVE-2024-9670 State: PUBLISHED Published: 2024-10-12T05:39:42.209Z Last Updated: 2024-10-14T15:17:13.748Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: sujin2f Products: 2D Tag Cloud Problem Types: CWE-79 Description: The 2D Tag Cloud plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 6.0.2. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP
can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/9dad1be5-ea6c-40fa-bb21-862e7fd8804a?source=cve - https://wordpress.org/plugins/2d-tag-cloud-widget-by-sujin/#developers - https://plugins.trac.wordpress.org/browser/2d-tag-cloud-widget-by-sujin/trunk/views/admin-tabs.php
CVE ID: CVE-2024-9671 State: PUBLISHED Published: 2024-10-09T14:32:10.972Z Last Updated: 2025-11-20T20:58:23.359Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Red Hat Products: Red Hat 3scale API Management Platform 2 Problem Types: CWE-862 Description: A vulnerability was found in 3Scale. There is no auth mechanism to see a PDF invoice of a Developer user if the URL is known. Anyone can see the invoice if the URL is known or guessed. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://access.redhat.com/security/cve/CVE-2024-9671 - https://bugzilla.redhat.com/show_bug.cgi?id=2317449
CVE ID: CVE-2024-9672 State: PUBLISHED Published: 2024-12-09T23:49:55.535Z Last Updated: 2024-12-10T16:08:48.582Z Vendors: PaperCut Products: PaperCut MF Problem Types: CWE-917 Description: A reflected cross-site scripting (XSS) vulnerability exists in PaperCut NG/MF. This issue can be used to execute specially created JavaScript payloads in the browser. A user must click on a malicious link for this issue to occur. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.papercut.com/kb/Main/security-bulletin-december-2024/
CVE ID: CVE-2024-9673 State: REJECTED Published: 2025-01-08T06:41:37.121Z Last Updated: 2025-01-17T16:59:34.255Z Description: No description available.
CVE ID: CVE-2024-9674 State: PUBLISHED Published: 2024-10-18T11:02:55.817Z Last Updated: 2024-10-18T13:42:18.846Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: morceaudebois Products: Debrandify · Remove or Replace WordPress Branding Problem Types: CWE-79 Description: The Debrandify · Remove or Replace WordPress Branding plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.1.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whe
henticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/a2110d13-d6d3-43f8-b1bf-8958d4f39ef5?source=cve - https://wordpress.org/plugins/debrandify/#developers - https://plugins.trac.wordpress.org/changeset/3170586/
CVE ID: CVE-2024-9675 State: PUBLISHED Published: 2024-10-09T14:32:11.922Z Last Updated: 2025-11-20T06:24:04.863Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Red Hat Products: Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support, Red Hat Enterprise Linux 8.6 Telecommunications Update Service, Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions, Red Hat Enterprise Linux 8.8 Extended Update Support, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 9.0 Extended Update Support, Red Hat Enterprise Linux 9.2 Extended Update Support, Red Hat OpenShift Container Platform 4.12, Red Hat OpenShift Container