Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. The identifier VDB-254393 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.254393 - https://vuldb.com/?ctiid.254393 - https://note.zhaoj.in/share/QHdXavkw5eDm
CVE ID: CVE-2024-1706 State: PUBLISHED Published: 2024-02-21T18:00:07.522Z Last Updated: 2025-08-22T07:29:38.911Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:ND/RC:UR) Vendors: ZKTeco Products: ZKBio Access IVS Problem Types: CWE-79, CWE-94 Description: A vulnerability was determined in ZKTeco ZKBio Access IVS up to 3.3.2. This impacts an unknown function of the component Department Name Search Bar. This manipulation with the input <marquee>hi causes cross site scripting. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. The vendor explains: "ZKBio Access IVS is no longer maintained and the product has been replaced by Z
d may be utilized. The vendor explains: "ZKBio Access IVS is no longer maintained and the product has been replaced by ZKBio CVAccess, it is recommended to replace it with the latest version of ZKBio CVAccess." This vulnerability only affects products that are no longer supported by the maintainer. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.254396 - https://vuldb.com/?ctiid.254396 - https://vuldb.com/?submit.280083 - https://vuldb.com/?submit.280084 - https://gist.githubusercontent.com/whiteman007/8d3a09991de4ef336937ba91c07b7856/raw/adc00538d7a8c3c54bde4797a10d9b6af393711d/gistfile1.txt - https://www.zkteco.com/en/Security
1de4ef336937ba91c07b7856/raw/adc00538d7a8c3c54bde4797a10d9b6af393711d/gistfile1.txt - https://www.zkteco.com/en/Security_Bulletinsibs/21
CVE ID: CVE-2024-1707 State: PUBLISHED Published: 2024-02-21T18:31:04.501Z Last Updated: 2024-08-01T18:48:21.803Z Severity: N/A (CVSS 5 AV:N/AC:L/Au:N/C:N/I:P/A:N) Vendors: GARO Products: WALLBOX GLB+ T2EV7 Problem Types: CWE-79 Description: A vulnerability, which was classified as problematic, was found in GARO WALLBOX GLB+ T2EV7 0.5. This affects an unknown part of the file /index.jsp#settings of the component Software Update Handler. The manipulation of the argument Reference leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-254397 was assigned to this vulnerability. NOTE: The ven
een disclosed to the public and may be used. The identifier VDB-254397 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.254397 - https://vuldb.com/?ctiid.254397 - https://github.com/strik3r0x1/Vulns/blob/main/GARO_GLBDCMB-T274WO_Stored_XSS.md - https://drive.google.com/file/d/1spsElvU8rgCs4gUxc662SCBjTI9VAqth/view
CVE ID: CVE-2024-1708 State: PUBLISHED Published: 2024-02-21T15:29:10.091Z Last Updated: 2024-08-01T18:48:21.724Z Severity: HIGH (CVSS 8.4 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H) Vendors: ConnectWise Products: ScreenConnect Problem Types: CWE-22 Description: ConnectWise ScreenConnect 23.9.7 and prior are affected by path-traversal vulnerability, which may allow an attacker the ability to execute remote code or directly impact confidential data or critical systems. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.connectwise.com/company/trust/security-bulletins/connectwise-screenconnect-23.9.8 - https://www.huntress.com/blog/a-catastr
nectwise.com/company/trust/security-bulletins/connectwise-screenconnect-23.9.8 - https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass
CVE ID: CVE-2024-1709 State: PUBLISHED Published: 2024-02-21T15:36:03.960Z Last Updated: 2025-10-21T23:05:24.008Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: ConnectWise Products: ScreenConnect Problem Types: CWE-288 Description: ConnectWise ScreenConnect 23.9.7 and prior are affected by an Authentication Bypass Using an Alternate Path or Channel vulnerability, which may allow an attacker direct access to confidential information or critical systems. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.connectwise.com/company/trust/security-bulletins/connectwise-screenconnect-23.9.8 - https://www.huntress
: - https://www.connectwise.com/company/trust/security-bulletins/connectwise-screenconnect-23.9.8 - https://www.huntress.com/blog/vulnerability-reproduced-immediately-patch-screenconnect-23-9-8 - https://www.huntress.com/blog/detection-guidance-for-connectwise-cwe-288-2 - https://www.bleepingcomputer.com/news/security/connectwise-urges-screenconnect-admins-to-patch-critical-rce-flaw/ - https://github.com/watchtowrlabs/connectwise-screenconnect_auth-bypass-add-user-poc - https://github.com/rapid7/metasploit-framework/pull/18870 - https://www.horizon3.ai/attack-research/red-team/connectwise-screenconnect-auth-bypass-deep-dive/ - https://techcrunch.com/2024/02/21/researchers-warn-high-risk-conn
eam/connectwise-screenconnect-auth-bypass-deep-dive/ - https://techcrunch.com/2024/02/21/researchers-warn-high-risk-connectwise-flaw-under-attack-is-embarrassingly-easy-to-exploit/ - https://www.securityweek.com/connectwise-confirms-screenconnect-flaw-under-active-exploitation/ - https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass
CVE ID: CVE-2024-1710 State: PUBLISHED Published: 2024-02-24T09:38:21.302Z Last Updated: 2025-04-22T16:14:44.280Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: unitecms Products: Addon Library Problem Types: CWE-862 Missing Authorization Description: The Addon Library plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the onAjaxAction function action in all versions up to, and including, 1.3.76. This makes it possible for authenticated attackers, with subscriber-level access and above, to perform several unauthorized actions including uploading arbitrary files. Additional Analyst Notes: - CISA ADP Vulnrichm
perform several unauthorized actions including uploading arbitrary files. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/15cf34d8-256b-495e-9385-a5d526bfb335?source=cve - https://plugins.trac.wordpress.org/browser/addon-library/trunk/inc_php/unitecreator_actions.class.php#L39
CVE ID: CVE-2024-1711 State: PUBLISHED Published: 2024-03-20T06:48:28.971Z Last Updated: 2024-08-05T16:24:46.368Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: mediavine Products: Create by Mediavine Problem Types: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Description: The Create by Mediavine plugin for WordPress is vulnerable to SQL Injection via the 'id' parameter in all versions up to, and including, 1.9.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL
ent preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/fcc78fa6-a5f0-4f29-ae19-8e783698b19e?source=cve - https://wordpress.org/plugins/mediavine-create/
CVE ID: CVE-2024-1712 State: PUBLISHED Published: 2024-04-15T05:00:04.271Z Last Updated: 2024-11-25T20:31:37.623Z Vendors: Unknown Products: Carousel Slider Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Carousel Slider WordPress plugin before 2.2.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://wpscan.com/vulnerability/23805a61-9fcd-4744-a60d-05c8cb43ee01/
CVE ID: CVE-2024-1713 State: PUBLISHED Published: 2024-03-14T20:14:28.611Z Last Updated: 2024-08-02T20:49:14.578Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:H) Vendors: Plv8 Products: Plv8 Problem Types: CWE-394 Description: A user who can create objects in a database with plv8 3.2.1 installed is able to cause deferred triggers to execute as the Superuser during autovacuum. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/google/security-research/security/advisories/GHSA-r7m9-grw7-vcc4
CVE ID: CVE-2024-1714 State: PUBLISHED Published: 2024-02-21T16:57:19.298Z Last Updated: 2025-08-26T20:08:09.865Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:L/A:L) Vendors: SailPoint Products: IdentityIQ Problem Types: CWE-20 Description: An issue exists in all supported versions of IdentityIQ Lifecycle Manager that can result if an entitlement with a value containing leading or trailing whitespace is requested by an authenticated user in an access request. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.sailpoint.com/security-advisories/sailpoint-identityiq-access-request-for-entitlement-values-with-leading-trailing-
/www.sailpoint.com/security-advisories/sailpoint-identityiq-access-request-for-entitlement-values-with-leading-trailing-whitespace-cve-2024-1714/
CVE ID: CVE-2024-1715 State: REJECTED Published: 2024-08-01T03:49:12.622Z Last Updated: 2024-08-02T15:04:16.261Z Description: No description available.
CVE ID: CVE-2024-1716 State: PUBLISHED Published: 2024-05-02T16:52:45.931Z Last Updated: 2024-08-01T18:48:21.796Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: litonice13 Products: Admin Bar Editor – Hide Toolbar by User Roles Problem Types: CWE-862 Missing Authorization Description: The Admin Bar Remover plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the update_form() function in all versions up to, and including, 1.0.2.2. This makes it possible for authenticated attackers, with subscriber-level access and above, to enable or disable the admin bar on the front-end of the site. Additional Analys
th subscriber-level access and above, to enable or disable the admin bar on the front-end of the site. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/dfbf2556-0509-4d8a-8949-494c6bc82ea1?source=cve - https://plugins.trac.wordpress.org/browser/admin-bar/trunk/Inc/Classes/AdminBarRemover.php#L81 - https://plugins.trac.wordpress.org/changeset/2955636/admin-bar/trunk
CVE ID: CVE-2024-1717 State: PUBLISHED Published: 2024-06-04T05:32:12.265Z Last Updated: 2024-08-01T18:48:21.978Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: melapress Products: Admin Notices Manager Problem Types: CWE-862 Missing Authorization Description: The Admin Notices Manager plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the handle_ajax_call() function in all versions up to, and including, 1.4.0. This makes it possible for authenticated attackers, with subscriber-level access and above, to retrieve a list of registered user emails. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Pro
ss and above, to retrieve a list of registered user emails. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/0849d86b-5cf1-4346-a9e9-a54768837969?source=cve - https://plugins.trac.wordpress.org/browser/admin-notices-manager/trunk/vendor/wpwhitesecurity/select2-wpwhitesecurity/load.php#L58
CVE ID: CVE-2024-1718 State: PUBLISHED Published: 2024-06-04T05:32:13.867Z Last Updated: 2024-08-01T18:48:21.743Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: claudiosanches Products: Claudio Sanches – Checkout Cielo for WooCommerce Problem Types: CWE-345 Insufficient Verification of Data Authenticity Description: The Claudio Sanches – Checkout Cielo for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to insufficient payment validation in the update_order_status() function in all versions up to, and including, 1.1.0. This makes it possible for unauthenticated attackers to update the status of orders to paid bypassin
d including, 1.1.0. This makes it possible for unauthenticated attackers to update the status of orders to paid bypassing payment. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/40cb3214-a11b-4bee-9422-256d12303460?source=cve - https://plugins.trac.wordpress.org/browser/woocommerce-checkout-cielo/trunk/includes/class-wc-checkout-cielo-gateway.php#L296
CVE ID: CVE-2024-1719 State: PUBLISHED Published: 2024-02-28T09:33:34.989Z Last Updated: 2024-08-01T18:48:21.862Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: scottpaterson Products: Contact Form 7 – PayPal & Stripe Add-on, Easy PayPal & Stripe Buy Now Button Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The Easy PayPal & Stripe Buy Now Button plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.8.3 and in Contact Form 7 – PayPal & Stripe Add-on all versions up to, and including 2.1. This is due to missing or incorrect nonce validation on the 'wpecpp_stripe_connect_completion' fun
o, and including 2.1. This is due to missing or incorrect nonce validation on the 'wpecpp_stripe_connect_completion' function. This makes it possible for unauthenticated attackers to modify the plugins settings and chance the stripe connection via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/a5276227-9bd4-4ad8-a6b7-ac7d05e8b056?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3040962%40wp-ecommerce-paypal&new=3040962%40wp-ecommerce-p
c.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3040962%40wp-ecommerce-paypal&new=3040962%40wp-ecommerce-paypal&sfp_email=&sfph_mail= - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3040958%40contact-form-7-paypal-add-on&new=3040958%40contact-form-7-paypal-add-on&sfp_email=&sfph_mail=
CVE ID: CVE-2024-1720 State: PUBLISHED Published: 2024-03-07T05:32:39.478Z Last Updated: 2024-08-01T18:48:21.827Z Severity: MEDIUM (CVSS 4.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: wpeverest Products: User Registration – Custom Registration Form, Login Form, and User Profile WordPress Plugin Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The User Registration – Custom Registration Form, Login Form, and User Profile WordPress Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Display Name' parameter in all versions up to, and including, 3.1.4 due to insufficient input sanitiz
Scripting via the 'Display Name' parameter in all versions up to, and including, 3.1.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This vulnerability requires social engineering to successfully exploit, and the impact would be very limited due to the attacker requiring a user to login as the user with the injected payload for execution. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/62b809dc-4089-4822-8aeb-7049fcfe376e?sourc
iner: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/62b809dc-4089-4822-8aeb-7049fcfe376e?source=cve - https://plugins.trac.wordpress.org/browser/user-registration/trunk/includes/class-ur-shortcodes.php#L288 - https://plugins.trac.wordpress.org/changeset/3045419/user-registration/trunk/includes/class-ur-shortcodes.php
CVE ID: CVE-2024-1721 State: PUBLISHED Published: 2024-05-21T15:41:49.165Z Last Updated: 2024-08-01T18:48:21.740Z Vendors: HYPR Products: Passwordless Problem Types: CWE-347 Description: Improper Verification of Cryptographic Signature vulnerability in HYPR Passwordless on Windows allows Malicious Software Update.This issue affects HYPR Passwordless: before 9.1. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.hypr.com/trust-center/security-advisories
CVE ID: CVE-2024-1722 State: PUBLISHED Published: 2024-02-27T17:39:13.261Z Last Updated: 2025-11-21T06:27:40.399Z Severity: LOW (CVSS 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: Red Hat Products: Red Hat Build of Keycloak, Red Hat Single Sign-On 7 Problem Types: CWE-645 Description: A flaw was found in Keycloak. In certain conditions, this issue may allow a remote unauthenticated attacker to block other accounts from logging in. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://access.redhat.com/security/cve/CVE-2024-1722 - https://bugzilla.redhat.com/show_bug.cgi?id=2265389
CVE ID: CVE-2024-1723 State: PUBLISHED Published: 2024-03-13T15:27:21.210Z Last Updated: 2024-08-01T18:48:21.828Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: gpriday Products: SiteOrigin Widgets Bundle Problem Types: CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) Description: The SiteOrigin Widgets Bundle plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several parameters in all versions up to, and including, 1.58.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor access or above, to inject arbitrary web scripts in pa
s makes it possible for authenticated attackers, with contributor access or above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Affected parameters include: $instance['fonts']['title_options']['tag'], $headline_tag, $sub_headline_tag, $feature['icon']. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/e63c566d-744b-42f5-9ba6-9007cc60313a?source=cve - https://plugins.trac.wordpress.org/browser/so-widgets-bundle/tags/1.58.6/widgets/features/tpl/default.php#L90 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new
/widgets/features/tpl/default.php#L90 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3044174%40so-widgets-bundle%2Ftrunk&old=3040814%40so-widgets-bundle%2Ftrunk&sfp_email=&sfph_mail=
CVE ID: CVE-2024-1724 State: PUBLISHED Published: 2024-07-25T19:05:23.299Z Last Updated: 2024-08-01T18:48:21.887Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L) Vendors: Canonical Products: snap Problem Types: CWE-732 Description: In snapd versions prior to 2.62, when using AppArmor for enforcement of sandbox permissions, snapd failed to restrict writes to the $HOME/bin path. In Ubuntu, when this path exists, it is automatically added to the users PATH. An attacker who could convince a user to install a malicious snap which used the 'home' plug could use this vulnerability to install arbitrary scripts into the users PATH which may then be run by the user outside of
ld use this vulnerability to install arbitrary scripts into the users PATH which may then be run by the user outside of the expected snap sandbox and hence allow them to escape confinement. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/snapcore/snapd/commit/aa191f97713de8dc3ce3ac818539f0b976eb8ef6 - https://gld.mcphail.uk/posts/explaining-cve-2024-1724/ - https://github.com/snapcore/snapd/pull/13689
CVE ID: CVE-2024-1725 State: PUBLISHED Published: 2024-03-07T20:09:11.616Z Last Updated: 2025-11-14T01:32:09.565Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: Red Hat Products: Red Hat OpenShift Container Platform 4.13, Red Hat OpenShift Container Platform 4.14, Red Hat OpenShift Container Platform 4.15 Problem Types: CWE-501 Description: A flaw was found in the kubevirt-csi component of OpenShift Virtualization's Hosted Control Plane (HCP). This issue could allow an authenticated attacker to gain access to the root HCP worker node's volume by creating a custom Persistent Volume that matches the name of a worker node. Additional Analyst Notes: - CVE Progr
ume by creating a custom Persistent Volume that matches the name of a worker node. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://access.redhat.com/errata/RHSA-2024:1559 - https://access.redhat.com/errata/RHSA-2024:1891 - https://access.redhat.com/errata/RHSA-2024:2047 - https://access.redhat.com/security/cve/CVE-2024-1725 - https://bugzilla.redhat.com/show_bug.cgi?id=2265398
CVE ID: CVE-2024-1726 State: PUBLISHED Published: 2024-04-25T16:29:04.615Z Last Updated: 2025-11-21T06:27:42.743Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: Red Hat Products: Red Hat build of Quarkus 3.2.11.Final, Red Hat build of Quarkus Problem Types: CWE-281 Description: A flaw was discovered in the RESTEasy Reactive implementation in Quarkus. Due to security checks for some JAX-RS endpoints being performed after serialization, more processing resources are consumed while the HTTP request is checked. In certain configurations, if an attacker has knowledge of any POST, PUT, or PATCH request paths, they can potentially identify vulnerable endpoints and
attacker has knowledge of any POST, PUT, or PATCH request paths, they can potentially identify vulnerable endpoints and trigger excessive resource usage as the endpoints process the requests. This can result in a denial of service. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2024:1662 - https://access.redhat.com/security/cve/CVE-2024-1726 - https://bugzilla.redhat.com/show_bug.cgi?id=2265158
CVE ID: CVE-2024-1727 State: PUBLISHED Published: 2024-03-21T19:57:39.129Z Last Updated: 2024-08-01T18:48:21.951Z Severity: MEDIUM (CVSS 4.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L) Vendors: gradio-app Products: gradio-app/gradio Problem Types: CWE-352 Description: A Cross-Site Request Forgery (CSRF) vulnerability in gradio-app/gradio allows attackers to upload multiple large files to a victim's system if they are running Gradio locally. By crafting a malicious HTML page that triggers an unauthorized file upload to the victim's server, an attacker can deplete the system's disk space, potentially leading to a denial of service. This issue affects the file upload functionality as implemen