Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-12068 State: PUBLISHED Published: 2025-03-20T10:08:58.246Z Last Updated: 2025-03-20T19:00:08.678Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: haotian-liu Products: haotian-liu/llava Problem Types: CWE-918 Description: A Server-Side Request Forgery (SSRF) vulnerability was discovered in haotian-liu/llava, affecting version git c121f04. This vulnerability allows an attacker to make the server perform HTTP requests to arbitrary URLs, potentially accessing sensitive data that is only accessible from the server, such as AWS metadata credentials. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/9d0b908d
tadata credentials. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/9d0b908d-63cd-4d62-91ff-6ceef3183752
CVE ID: CVE-2024-12069 State: PUBLISHED Published: 2025-02-19T07:32:09.799Z Last Updated: 2025-02-19T14:38:20.951Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: lexicata Products: Lexicata Problem Types: CWE-79 Description: The Lexicata plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 1.0.16. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that execute if they can successfully trick a user into performing an action, such as clicking on a specially crafted link. Additional Analyst Notes: - CIS
ly trick a user into performing an action, such as clicking on a specially crafted link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/7541a595-aae4-49d2-862a-c1d1f4a1e6e5?source=cve - https://wordpress.org/plugins/lexicata/
CVE ID: CVE-2024-12070 State: PUBLISHED Published: 2025-03-20T10:11:17.105Z Last Updated: 2025-03-20T13:12:00.420Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: haotian-liu Products: haotian-liu/llava Problem Types: CWE-400 Description: A Denial of Service (DoS) vulnerability exists in the file upload feature of haotian-liu/llava, specifically in Release v1.2.0 (LLaVA-1.6). The vulnerability is due to improper handling of form-data with a large filename in the file upload request. By sending a payload with an excessively large filename, the server becomes overwhelmed and unresponsive, leading to unavailability for legitimate users. This issue can be exploite
server becomes overwhelmed and unresponsive, leading to unavailability for legitimate users. This issue can be exploited without authentication, making it highly scalable and increasing the risk of exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/8adac028-21c5-41ba-b785-b03066c0b2a6
CVE ID: CVE-2024-12071 State: PUBLISHED Published: 2025-01-18T03:21:12.989Z Last Updated: 2025-01-22T14:20:33.762Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: evergreencontentposter Products: Evergreen Content Poster – Auto Post and Schedule Your Best Content to Social Media Problem Types: CWE-862 Description: The Evergreen Content Poster – Auto Post and Schedule Your Best Content to Social Media plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the delete_network_post() function in all versions up to, and including, 1.4.4. This makes it possible for unauthenticated attackers to delete arbitrary posts an
versions up to, and including, 1.4.4. This makes it possible for unauthenticated attackers to delete arbitrary posts and pages. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/aa07f48f-370f-4985-a6fc-a94ed5c59ed4?source=cve - https://plugins.trac.wordpress.org/browser/evergreen-content-poster/trunk/includes/class-evergreen_content_poster.php#L345 - https://plugins.trac.wordpress.org/browser/evergreen-content-poster/trunk/admin/class-evergreen_content_poster-admin.php#L333 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3224190%40evergreen-content-poster&new=3224190%40evergreen-conte
press.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3224190%40evergreen-content-poster&new=3224190%40evergreen-content-poster&sfp_email=&sfph_mail=
CVE ID: CVE-2024-12072 State: PUBLISHED Published: 2024-12-12T05:24:20.868Z Last Updated: 2024-12-12T14:52:25.459Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: fatcatapps Products: Analytics Cat – Google Analytics Made Easy Problem Types: CWE-79 Description: The Analytics Cat – Google Analytics Made Easy plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 1.1.2. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that execute if they can successfully trick a user into performing an action, such as
s to inject arbitrary web scripts that execute if they can successfully trick a user into performing an action, such as clicking on a specially crafted link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/6de64a12-0f73-40e9-bcd1-963dc6499ec4?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3202743%40analytics-cat&new=3202743%40analytics-cat&sfp_email=&sfph_mail=
CVE ID: CVE-2024-12073 State: PUBLISHED Published: 2025-01-07T05:23:57.939Z Last Updated: 2025-01-07T16:14:30.591Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: jleuze Products: Meteor Slides Problem Types: CWE-79 Description: The Meteor Slides plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'slide_url_value' parameter in all versions up to, and including, 1.5.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst
to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/be913494-f4a7-4718-ac2b-da4baf2b0a21?source=cve - https://wordpress.org/plugins/meteor-slides/
CVE ID: CVE-2024-12074 State: PUBLISHED Published: 2025-03-20T10:11:10.026Z Last Updated: 2025-03-20T14:23:03.483Z Severity: MEDIUM (CVSS 6.5 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: automatic1111 Products: automatic1111/stable-diffusion-webui Problem Types: CWE-400 Description: A Denial of Service (DoS) vulnerability was discovered in the file upload feature of automatic1111/stable-diffusion-webui version 1.10.0. The vulnerability is due to improper handling of form-data with a large filename in the file upload request. By sending a payload with an excessively large filename, the server becomes overwhelmed and unresponsive, leading to unavailability for legitimate users. This
y large filename, the server becomes overwhelmed and unresponsive, leading to unavailability for legitimate users. This issue can be exploited without authentication, making it highly scalable and increasing the risk of exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/6b44bfc2-31a7-4fe9-86fb-072c90a23642
CVE ID: CVE-2024-12076 State: PUBLISHED Published: 2025-01-25T07:24:13.906Z Last Updated: 2025-01-27T15:33:38.141Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: sovica Products: Target Video Easy Publish Problem Types: CWE-79 Description: The Target Video Easy Publish plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.8.3. This is due to missing or incorrect nonce validation on the resync_carousel(), seek_snapshot(), uploaded_cc(), and remove_cc() functions. This makes it possible for unauthenticated attackers to inject malicious web scripts via a forged request granted they can trick a site administrat
unauthenticated attackers to inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/192b8ab0-f80e-4c0e-9cc0-df567d5791a8?source=cve - https://plugins.trac.wordpress.org/browser/brid-video-easy-publish/trunk/lib/BridHtml.php#L465 - https://plugins.trac.wordpress.org/browser/brid-video-easy-publish/trunk/lib/BridHtml.php#L489 - https://plugins.trac.wordpress.org/browser/brid-video-easy-publish/trunk/lib/BridHtml.php#L1169 - https://plugins.trac.wordpress.org/browser/brid-video-easy
rowser/brid-video-easy-publish/trunk/lib/BridHtml.php#L1169 - https://plugins.trac.wordpress.org/browser/brid-video-easy-publish/trunk/lib/BridHtml.php#L1185 - https://wordpress.org/plugins/brid-video-easy-publish/#developers - https://plugins.trac.wordpress.org/changeset/3226143/
CVE ID: CVE-2024-12077 State: PUBLISHED Published: 2025-01-07T07:22:33.559Z Last Updated: 2025-01-07T15:56:39.183Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: wpdevart, WpDevArt Products: Booking calendar, Appointment Booking System, Booking Calendar Pro WpDevArt Problem Types: CWE-79 Description: The Booking Calendar and Booking Calendar Pro plugins for WordPress are vulnerable to Reflected Cross-Site Scripting via the ‘calendar_id’ parameter in all versions up to, and including, 3.2.19 and 11.2.19 respectively, due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web script
ut sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/81cc09ee-da3d-407d-82c0-542b56df5aed?source=cve - https://plugins.trac.wordpress.org/browser/booking-calendar/tags/3.2.16/admin/views/Reservations.php#L528 - https://plugins.trac.wordpress.org/browser/booking-calendar/tags/3.2.16/admin/views/Reservations.php#L532 - https://plugins.trac.wordpress.org/changeset/3209851/
CVE ID: CVE-2024-12078 State: PUBLISHED Published: 2025-01-23T16:38:48.017Z Last Updated: 2025-02-12T17:11:14.933Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: ECOVACS Products: Unspecified robots Problem Types: CWE-321 Description: ECOVACS robot lawn mowers and vacuums use a shared, static secret key to encrypt BLE GATT messages. An unauthenticated attacker within BLE range can control any robot using the same key. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://dontvacuum.me/talks/37c3-2023/37c3-vacuuming-and-mowing.pdf - https://youtu.be/_wUsM0Mlenc?t=2041
CVE ID: CVE-2024-12079 State: PUBLISHED Published: 2025-01-23T16:39:06.903Z Last Updated: 2025-02-12T17:12:21.831Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: ECOVACS Products: Unspecified robots Problem Types: CWE-312 Description: ECOVACS robot lawnmowers store the anti-theft PIN in cleartext on the device filesystem. An attacker can steal a lawnmower, read the PIN, and reset the anti-theft mechanism. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://dontvacuum.me/talks/37c3-2023/37c3-vacuuming-and-mowing.pdf
CVE ID: CVE-2024-12082 State: PUBLISHED Published: 2024-12-03T12:15:24.779Z Last Updated: 2024-12-03T14:24:59.407Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: OpenHarmony Products: OpenHarmony Problem Types: CWE-125, CWE-922 Description: in OpenHarmony v4.0.0 and prior versions allow a local attacker cause information leak through out-of-bounds Read. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitee.com/openharmony/security/blob/master/zh/security-disclosure/2024/2024-12.md
CVE ID: CVE-2024-12083 State: PUBLISHED Published: 2025-01-14T00:46:33.399Z Last Updated: 2025-05-06T23:55:36.575Z Severity: MEDIUM (CVSS 6.6 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: OMRON Corporation Products: Machine Automation Controller NJ-series, Machine Automation Controller NX-series Problem Types: CWE-22 Description: Path Traversal Vulnerabilities (CWE-22) exist in NJ/NX-series Machine Automation Controllers. An attacker may use these vulnerabilities to perform unauthorized access and to execute unauthorized code remotely to the controller products. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.fa.omron.co.jp/product/security/assets/pdf/en
ditional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.fa.omron.co.jp/product/security/assets/pdf/en/OMSR-2025-001_en.pdf - https://www.fa.omron.co.jp/product/security/assets/pdf/ja/OMSR-2025-001_ja.pdf
CVE ID: CVE-2024-12084 State: PUBLISHED Published: 2025-01-15T14:16:35.363Z Last Updated: 2025-11-06T20:52:27.377Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Red Hat Products: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat OpenShift Container Platform 4 Problem Types: CWE-122 Description: A heap-based buffer overflow flaw was found in the rsync daemon. This issue is due to improper handling of attacker-controlled checksum lengths (s2length) in the code. When MAX_DIGEST_LEN exceeds the fixed SUM_LENGTH (16 bytes), an attacker can write out of bounds in
length) in the code. When MAX_DIGEST_LEN exceeds the fixed SUM_LENGTH (16 bytes), an attacker can write out of bounds in the sum2 buffer. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://access.redhat.com/errata/RHBA-2025:6470 - https://access.redhat.com/security/cve/CVE-2024-12084 - https://bugzilla.redhat.com/show_bug.cgi?id=2330527 - https://kb.cert.org/vuls/id/952657
CVE ID: CVE-2024-12085 State: PUBLISHED Published: 2025-01-14T17:37:16.036Z Last Updated: 2025-11-20T20:47:25.527Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Red Hat Products: Red Hat Enterprise Linux 6 Extended Lifecycle Support - EXTENSION, Red Hat Enterprise Linux 7 Extended Lifecycle Support, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 8.2 Advanced Update Support, Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support, Red Hat Enterprise Linux 8.4 Telecommunications Update Service, Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions, Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support, Red Hat Enter
Update Services for SAP Solutions, Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support, Red Hat Enterprise Linux 8.6 Telecommunications Update Service, Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions, Red Hat Enterprise Linux 8.8 Extended Update Support, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions, Red Hat Enterprise Linux 9.2 Extended Update Support, Red Hat Enterprise Linux 9.4 Extended Update Support, Red Hat OpenShift Container Platform 4.12, Red Hat OpenShift Container Platform 4.13, Red Hat OpenShift Container Platform 4.14, Red Hat OpenShift Container Platform 4.15, Red Hat OpenShift Container Platform 4.
at OpenShift Container Platform 4.14, Red Hat OpenShift Container Platform 4.15, Red Hat OpenShift Container Platform 4.16, Red Hat OpenShift Container Platform 4.17, RHOL-5.8-RHEL-9, RHOL-5.9-RHEL-9, Compliance Operator 1, Red Hat Enterprise Linux 10 Problem Types: CWE-908 Description: A flaw was found in rsync which could be triggered when rsync compares file checksums. This flaw allows an attacker to manipulate the checksum length (s2length) to cause a comparison between a checksum and uninitialized memory and leak one byte of uninitialized stack data at a time. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-
al Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2025:0324 - https://access.redhat.com/errata/RHSA-2025:0325 - https://access.redhat.com/errata/RHSA-2025:0637 - https://access.redhat.com/errata/RHSA-2025:0688 - https://access.redhat.com/errata/RHSA-2025:0714 - https://access.redhat.com/errata/RHSA-2025:0774 - https://access.redhat.com/errata/RHSA-2025:0787 - https://access.redhat.com/errata/RHSA-2025:0790 - https://access.redhat.com/errata/RHSA-2025:0849 - https://access.redhat.com/errata/RHSA-2025:0884 - https://access.redhat.com/errata/RHSA-2025:0885 - https://access.redhat.com/errata/RHSA-2025:1120 - https://access.red
- https://access.redhat.com/errata/RHSA-2025:0885 - https://access.redhat.com/errata/RHSA-2025:1120 - https://access.redhat.com/errata/RHSA-2025:1123 - https://access.redhat.com/errata/RHSA-2025:1128 - https://access.redhat.com/errata/RHSA-2025:1225 - https://access.redhat.com/errata/RHSA-2025:1227 - https://access.redhat.com/errata/RHSA-2025:1242 - https://access.redhat.com/errata/RHSA-2025:1451 - https://access.redhat.com/errata/RHSA-2025:21885 - https://access.redhat.com/errata/RHSA-2025:2701 - https://access.redhat.com/security/cve/CVE-2024-12085 - https://bugzilla.redhat.com/show_bug.cgi?id=2330539 - https://kb.cert.org/vuls/id/952657
CVE ID: CVE-2024-12086 State: PUBLISHED Published: 2025-01-14T17:37:54.960Z Last Updated: 2025-11-06T21:50:27.844Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N) Vendors: Red Hat Products: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat OpenShift Container Platform 4 Problem Types: CWE-390 Description: A flaw was found in rsync. It could allow a server to enumerate the contents of an arbitrary file from the client's machine. This issue occurs when files are being copied from a client to a server. During this process, the rsync server will send checksums of local data
iles are being copied from a client to a server. During this process, the rsync server will send checksums of local data to the client to compare with in order to determine what data needs to be sent to the server. By sending specially constructed checksum values for arbitrary files, an attacker may be able to reconstruct the data of those files byte-by-byte based on the responses from the client. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://access.redhat.com/security/cve/CVE-2024-12086 - https://bugzilla.redhat.com/show_bug.cgi?id=2330577 - https://kb.cert.org/vuls/id/952657
CVE ID: CVE-2024-12087 State: PUBLISHED Published: 2025-01-14T17:57:33.927Z Last Updated: 2025-11-06T21:50:31.684Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N) Vendors: Red Hat Products: Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat Discovery 1.14, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat OpenShift Container Platform 4 Problem Types: CWE-22 Description: A path traversal vulnerability exists in rsync. It stems from behavior enabled by the `--inc-recursive` option, a default-enabled option for many client options and can be enabled by the server even if not explicitly enabled by the client. When u
led option for many client options and can be enabled by the server even if not explicitly enabled by the client. When using the `--inc-recursive` option, a lack of proper symlink verification coupled with deduplication checks occurring on a per-file-list basis could allow a server to write files outside of the client's intended destination directory. A malicious server could write malicious files to arbitrary locations named after valid directories/paths on the client. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2025:2600 - https://access.redhat.com/errata/RHSA-2025:7050 - https://access.redhat.com/errata/RH
redhat.com/errata/RHSA-2025:2600 - https://access.redhat.com/errata/RHSA-2025:7050 - https://access.redhat.com/errata/RHSA-2025:8385 - https://access.redhat.com/security/cve/CVE-2024-12087 - https://bugzilla.redhat.com/show_bug.cgi?id=2330672 - https://kb.cert.org/vuls/id/952657
CVE ID: CVE-2024-12088 State: PUBLISHED Published: 2025-01-14T17:38:34.890Z Last Updated: 2025-11-06T21:50:39.432Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N) Vendors: Red Hat Products: Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat Discovery 1.14, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat OpenShift Container Platform 4 Problem Types: CWE-22 Description: A flaw was found in rsync. When using the `--safe-links` option, the rsync client fails to properly verify if a symbolic link destination sent from the server contains another symbolic link within it. This results in a path traversal vulnerabilit
destination sent from the server contains another symbolic link within it. This results in a path traversal vulnerability, which may lead to arbitrary file write outside the desired directory. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2025:2600 - https://access.redhat.com/errata/RHSA-2025:7050 - https://access.redhat.com/errata/RHSA-2025:8385 - https://access.redhat.com/security/cve/CVE-2024-12088 - https://bugzilla.redhat.com/show_bug.cgi?id=2330676 - https://kb.cert.org/vuls/id/952657
CVE ID: CVE-2024-12089 State: PUBLISHED Published: 2024-12-16T15:06:33.457Z Last Updated: 2024-12-16T16:32:11.980Z Severity: HIGH (CVSS 8.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N) Vendors: Dassault Systèmes Products: ENOVIA Collaborative Industry Innovator Problem Types: CWE-79 Description: A stored Cross-site Scripting (XSS) vulnerability affecting ENOVIA Collaborative Industry Innovator from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024x allows an attacker to execute arbitrary script code in user's browser session. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.3ds.com/vulnerability/advisories
CVE ID: CVE-2024-12090 State: PUBLISHED Published: 2024-12-16T15:06:49.605Z Last Updated: 2024-12-16T16:31:00.607Z Severity: HIGH (CVSS 8.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N) Vendors: Dassault Systèmes Products: ENOVIA Collaborative Industry Innovator Problem Types: CWE-79 Description: A stored Cross-site Scripting (XSS) vulnerability affecting ENOVIA Collaborative Industry Innovator on Release 3DEXPERIENCE R2024x allows an attacker to execute arbitrary script code in user's browser session. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.3ds.com/vulnerability/advisories
CVE ID: CVE-2024-12091 State: PUBLISHED Published: 2024-12-16T15:06:56.964Z Last Updated: 2024-12-16T16:29:45.967Z Severity: HIGH (CVSS 8.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N) Vendors: Dassault Systèmes Products: ENOVIA Collaborative Industry Innovator Problem Types: CWE-79 Description: A stored Cross-site Scripting (XSS) vulnerability affecting ENOVIA Collaborative Industry Innovator from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024x allows an attacker to execute arbitrary script code in user's browser session. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.3ds.com/vulnerability/advisories