Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-10231 State: PUBLISHED Published: 2024-10-22T21:43:11.374Z Last Updated: 2024-10-30T03:55:24.531Z Vendors: Google Products: Chrome Problem Types: CWE-843 Description: Type Confusion in V8 in Google Chrome prior to 130.0.6723.69 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2024/10/stable-channel-update-for-desktop_22.html - https://issues.chromium.org/issues/372269618
CVE ID: CVE-2024-10232 State: PUBLISHED Published: 2024-11-01T09:29:24.777Z Last Updated: 2024-11-01T13:34:15.474Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: atomchat Products: Group Chat & Video Chat by AtomChat Problem Types: CWE-79 Description: The Group Chat & Video Chat by AtomChat plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's atomchat shortcode in all versions up to, and including, 1.1.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that
ble for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/c10993bd-b4f3-44b6-bb0f-cb783dbcf314?source=cve - https://wordpress.org/plugins/atomchat/#developers - https://plugins.trac.wordpress.org/changeset/3178522/
CVE ID: CVE-2024-10233 State: PUBLISHED Published: 2024-10-29T11:01:35.559Z Last Updated: 2024-10-29T14:50:37.540Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: cozyvision1 Products: SMS Alert Order Notifications – WooCommerce Problem Types: CWE-79 Description: The SMS Alert Order Notifications – WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's sa_subscribe shortcode in all versions up to, and including, 3.7.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web
es. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/c923d1d6-04c6-4ea2-a69e-041fea1e280a?source=cve - https://wordpress.org/plugins/sms-alert/#developers - https://plugins.trac.wordpress.org/changeset/3175629/
CVE ID: CVE-2024-10234 State: PUBLISHED Published: 2024-10-22T13:17:57.891Z Last Updated: 2025-11-11T16:05:02.693Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N) Vendors: Red Hat Products: Red Hat JBoss Enterprise Application Platform 7.4.23, Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8, Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9, Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7, Red Hat JBoss Enterprise Application Platform 8, Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8, Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9, Red Hat Single Sign-On 7, Red Hat Single Sign-On 7.6 for RHEL 7, Red Hat
nterprise Application Platform 8.0 for RHEL 9, Red Hat Single Sign-On 7, Red Hat Single Sign-On 7.6 for RHEL 7, Red Hat Single Sign-On 7.6 for RHEL 8, Red Hat Single Sign-On 7.6 for RHEL 9, RHEL-8 based Middleware Containers, Red Hat Build of Keycloak, Red Hat Fuse 7, Red Hat JBoss Data Grid 7, Red Hat JBoss Enterprise Application Platform Expansion Pack Problem Types: CWE-79 Description: A vulnerability was found in Wildfly, where a user may perform Cross-site scripting in the Wildfly deployment system. This flaw allows an attacker or insider to execute a deployment with a malicious payload, which could trigger undesired behavior against the server. Additional Analyst Notes: - CISA ADP Vuln
malicious payload, which could trigger undesired behavior against the server. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://access.redhat.com/errata/RHSA-2025:10924 - https://access.redhat.com/errata/RHSA-2025:10925 - https://access.redhat.com/errata/RHSA-2025:10926 - https://access.redhat.com/errata/RHSA-2025:10931 - https://access.redhat.com/errata/RHSA-2025:11636 - https://access.redhat.com/errata/RHSA-2025:11638 - https://access.redhat.com/errata/RHSA-2025:11639 - https://access.redhat.com/errata/RHSA-2025:11640 - https://access.redhat.com/errata/RHSA-2025:11645 - https://access.redhat.com/errata/RHSA-2025:2025 - https://access.redhat.com/errata/RHSA-2025:2026
rata/RHSA-2025:11645 - https://access.redhat.com/errata/RHSA-2025:2025 - https://access.redhat.com/errata/RHSA-2025:2026 - https://access.redhat.com/errata/RHSA-2025:2029 - https://access.redhat.com/security/cve/CVE-2024-10234 - https://bugzilla.redhat.com/show_bug.cgi?id=2320848
CVE ID: CVE-2024-10237 State: PUBLISHED Published: 2025-02-04T07:59:26.354Z Last Updated: 2025-02-04T14:38:14.400Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: SMCI Products: MBD-X12DPG-OA6 Problem Types: CWE-347, CWE-345 Description: There is a vulnerability in the BMC firmware image authentication design at Supermicro MBD-X12DPG-OA6 . An attacker can modify the firmware to bypass BMC inspection and bypass the signature verification process Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.supermicro.com/en/support/security_BMC_IPMI_Jan_2025
CVE ID: CVE-2024-10238 State: PUBLISHED Published: 2025-02-04T08:00:51.373Z Last Updated: 2025-02-04T14:33:16.387Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: SMCI Products: MBD-X12DPG-OA6 Problem Types: CWE-121 Description: A security issue in the firmware image verification implementation at Supermicro MBD-X12DPG-OA6. An attacker can upload a specially crafted image that will cause a stack overflow is caused by not checking fld->used_bytes. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.supermicro.com/en/support/security_BMC_IPMI_Jan_2025
CVE ID: CVE-2024-10239 State: PUBLISHED Published: 2025-02-04T08:02:02.414Z Last Updated: 2025-02-04T14:25:28.872Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: SMCI Products: MBD-X12DPG-OA6 Problem Types: CWE-121 Description: A security issue in the firmware image verification implementation at Supermicro MBD-X12DPG-OA6 . An attacker with administrator privileges can upload a specially crafted image, which can cause a stack overflow due to the unchecked fat->fsd.max_fld. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.supermicro.com/en/support/security_BMC_IPMI_Jan_2025
CVE ID: CVE-2024-10240 State: PUBLISHED Published: 2024-11-26T19:22:52.689Z Last Updated: 2024-11-26T20:26:23.503Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: GitLab Products: GitLab Problem Types: CWE-497 Description: An issue has been discovered in GitLab EE affecting all versions starting from 17.3 before 17.3.7, all versions starting from 17.4 before 17.4.4, all versions starting from 17.5 before 17.5.2 in which an unauthenticated user may be able to read some information about an MR in a private project, under certain circumstances. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/493188
. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/493188 - https://about.gitlab.com/releases/2024/11/13/patch-release-gitlab-17-5-2-released/#information-disclosure-through-an-api-endpoint
CVE ID: CVE-2024-10241 State: PUBLISHED Published: 2024-10-29T08:08:20.873Z Last Updated: 2024-10-29T12:52:53.569Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: Mattermost Products: Mattermost Problem Types: CWE-284 Description: Mattermost versions 9.5.x <= 9.5.9 fail to properly filter the channel data when ElasticSearch is enabled which allows a user to get private channel names by using cmd+K/ctrl+K. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://mattermost.com/security-updates
CVE ID: CVE-2024-10243 State: REJECTED Published: N/A Last Updated: 2025-07-05T22:16:35.200Z Description: No description available.
CVE ID: CVE-2024-10244 State: PUBLISHED Published: 2024-12-19T14:00:45.914Z Last Updated: 2025-04-10T18:51:59.121Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: ISDO Software Products: Web Software Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ISDO Software Web Software allows SQL Injection.This issue affects Web Software: before 3.6. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.usom.gov.tr/bildirim/tr-24-1893
CVE ID: CVE-2024-10245 State: PUBLISHED Published: 2024-11-12T09:30:17.585Z Last Updated: 2024-11-12T14:59:19.721Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: mobisoft974 Products: Relais 2FA Problem Types: CWE-288 Description: The Relais 2FA plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 1.0. This is due to incorrect authentication and capability checking in the 'rl_do_ajax' function. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the email. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - ht
an administrator, if they have access to the email. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/4d476336-e997-4379-a8f6-963ae22b2417?source=cve - https://plugins.trac.wordpress.org/browser/relais-2fa/trunk/relais.php?rev=2439540#L39
CVE ID: CVE-2024-10246 State: REJECTED Published: N/A Last Updated: 2025-09-20T22:19:14.328Z Description: No description available.
CVE ID: CVE-2024-10247 State: PUBLISHED Published: 2024-12-06T03:25:39.169Z Last Updated: 2024-12-06T16:13:44.433Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: totalsoft Products: Video Gallery – YouTube Gallery and Vimeo Gallery Problem Types: CWE-89 Description: The Video Gallery – Best WordPress YouTube Gallery Plugin plugin for WordPress is vulnerable to time-based SQL Injection via the orderby parameter in all versions up to, and including, 2.4.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Administrator-level access and
ation on the existing SQL query. This makes it possible for authenticated attackers, with Administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/f5524582-5aac-48b4-ad67-7c4829d63ed0?source=cve - https://packetstormsecurity.com/files/179387/WordPress-Video-Gallery-YouTube-Gallery-And-Vimeo-Gallery-2.3.6-SQL-Injection.html - https://plugins.trac.wordpress.org/browser/gallery-videos/trunk/admin/class-tsvg-list.php#L15 - https://plugins.trac.wordpress.org/change
rac.wordpress.org/browser/gallery-videos/trunk/admin/class-tsvg-list.php#L15 - https://plugins.trac.wordpress.org/changeset/3200979/gallery-videos/trunk/admin/class-tsvg-list.php
CVE ID: CVE-2024-10249 State: REJECTED Published: N/A Last Updated: 2025-02-11T01:05:17.315Z Description: No description available.
CVE ID: CVE-2024-10250 State: PUBLISHED Published: 2024-10-23T13:58:40.528Z Last Updated: 2024-10-24T13:14:44.859Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: SteelThemes Products: Nioland - SaaS & Software Startup Tech WordPress Theme Problem Types: CWE-79 Description: The Nioland theme for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘s’ parameter in all versions up to, and including, 1.2.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicki
bitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/e13c6d97-873a-4067-846d-92e54514645d?source=cve - https://themeforest.net/item/nioland-saas-software-startup-tech-wordpress-theme/47895474#item-description__change-log
CVE ID: CVE-2024-10251 State: PUBLISHED Published: 2024-12-11T16:40:38.536Z Last Updated: 2024-12-20T04:55:51.819Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Ivanti Products: Security Controls Problem Types: CWE-276 Description: Under specific circumstances, insecure permissions in Ivanti Security Controls before version 2024.4.1 allows a local authenticated attacker to achieve local privilege escalation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Security-Controls-iSec-CVE-2024-10251
CVE ID: CVE-2024-10252 State: PUBLISHED Published: 2025-03-20T10:10:41.847Z Last Updated: 2025-10-15T12:50:08.187Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: langgenius Products: langgenius/dify Problem Types: CWE-94 Description: A vulnerability in langgenius/dify versions <=v0.9.1 allows for code injection via internal SSRF requests in the Dify sandbox service. This vulnerability enables an attacker to execute arbitrary Python code with root privileges within the sandbox environment, potentially leading to the deletion of the entire sandbox service and causing irreversible damage. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://h
dbox service and causing irreversible damage. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/62c6c958-96cb-426c-aebc-c41f06b9d7b0 - https://github.com/langgenius/dify/commit/4ac99ffe0e1c9f4d7c523908e91bbc7739e0a8d4
CVE ID: CVE-2024-10253 State: PUBLISHED Published: 2025-01-14T21:17:52.869Z Last Updated: 2025-01-15T15:30:12.193Z Severity: MEDIUM (CVSS 4.7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: Lenovo Products: PC Manager, Browser, App Store Problem Types: CWE-122 Description: A potential TOCTOU vulnerability was reported in PC Manager, Lenovo Browser, and Lenovo App Store that could allow a local attacker to cause a system crash. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://iknow.lenovo.com.cn/detail/425367
CVE ID: CVE-2024-10254 State: PUBLISHED Published: 2025-01-14T21:18:05.353Z Last Updated: 2025-01-15T15:11:47.876Z Severity: MEDIUM (CVSS 4.7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: Lenovo Products: PC Manager, Browser, App Store Problem Types: CWE-122 Description: A potential buffer overflow vulnerability was reported in PC Manager, Lenovo Browser, and Lenovo App Store that could allow a local attacker to cause a system crash. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://iknow.lenovo.com.cn/detail/425367
CVE ID: CVE-2024-10256 State: PUBLISHED Published: 2024-12-10T18:46:01.911Z Last Updated: 2024-12-10T20:44:59.599Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H) Vendors: Ivanti Products: Patch SDK, Endpoint Manager, Security Controls, Patch for Configuration Manager, Neurons for Patch Management, Neurons Agent Platform Problem Types: CWE-732 Description: Insufficient permissions in Ivanti Patch SDK before version 9.7.703 allows a local authenticated attacker to delete arbitrary files. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Patch-SDK-CVE-2024-10256
CVE ID: CVE-2024-10260 State: PUBLISHED Published: 2024-11-15T05:30:56.350Z Last Updated: 2024-11-15T18:17:36.938Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) Vendors: tripetto Products: WordPress form builder plugin for contact forms, surveys and quizzes – Tripetto Problem Types: CWE-79 Description: The Tripetto plugin for WordPress is vulnerable to Stored Cross-Site Scripting via File uploads in all versions up to, and including, 8.0.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses the file. Additional Analyst Notes
s to inject arbitrary web scripts in pages that will execute whenever a user accesses the file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/3718c252-2ca3-4f7d-b43a-3c1b2e6b34c0?source=cve - https://plugins.svn.wordpress.org/tripetto/trunk/lib/attachments.php
CVE ID: CVE-2024-10261 State: PUBLISHED Published: 2024-11-09T11:19:45.940Z Last Updated: 2024-11-12T18:30:55.938Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: madalinungureanu Products: Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction Problem Types: CWE-94 Description: The The Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.13.0. This is due to the software allowing users to execute an action that does not properly validate a value before running do_short
due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/eaf19371-7b06-45c6-bf16-6ef7dfffb175?source=cve - https://plugins.trac.wordpress.org/changeset/3182968/paid-member-subscriptions
CVE ID: CVE-2024-10262 State: PUBLISHED Published: 2024-11-16T03:20:53.725Z Last Updated: 2024-11-19T16:06:53.739Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: stevehenty Products: Drop Shadow Boxes Problem Types: CWE-94 Description: The The Drop Shadow Boxes plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.7.14. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for authenticated attackers, with Subscriber-level access and above, to execute arbitrary shortcodes. Additional Analyst Notes: - CIS
ated attackers, with Subscriber-level access and above, to execute arbitrary shortcodes. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/fa0a296a-a93f-4c0e-9911-b4f9bdd53fad?source=cve - https://plugins.trac.wordpress.org/browser/drop-shadow-boxes/trunk/dropshadowboxes.php#L150 - https://wordpress.org/plugins/drop-shadow-boxes/#developers
CVE ID: CVE-2024-10263 State: PUBLISHED Published: 2024-11-05T12:45:22.158Z Last Updated: 2024-11-05T14:41:47.415Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: tickera Products: Tickera – WordPress Event Ticketing Problem Types: CWE-94 Description: The Tickera – WordPress Event Ticketing plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 3.5.4.4. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes. Additional Analyst Notes: - CISA ADP Vulnr
es it possible for unauthenticated attackers to execute arbitrary shortcodes. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/6e5e9249-9705-4cfa-9c8e-2e002190562b?source=cve - https://plugins.trac.wordpress.org/changeset/3179272/tickera-event-ticketing-system
CVE ID: CVE-2024-10264 State: PUBLISHED Published: 2025-03-20T10:10:04.256Z Last Updated: 2025-03-20T18:31:45.800Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: netease-youdao Products: netease-youdao/qanything Problem Types: CWE-444 Description: HTTP Request Smuggling vulnerability in netease-youdao/qanything version 1.4.1 allows attackers to exploit inconsistencies in the interpretation of HTTP requests between a proxy and a server. This can lead to unauthorized access, bypassing security controls, session hijacking, data leakage, and potentially arbitrary code execution. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bo
entially arbitrary code execution. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/988247d5-fd60-4d85-845a-e867d62c0d02
CVE ID: CVE-2024-10265 State: PUBLISHED Published: 2024-11-10T12:30:34.046Z Last Updated: 2024-11-11T11:48:50.475Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: 10web Products: Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder Problem Types: CWE-79 Description: The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 1.15.30. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can
. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/0fb1a2c2-581d-47ed-a180-9f70fdf79066?source=cve - https://wordpress.org/plugins/form-maker/#developers - https://plugins.trac.wordpress.org/browser/form-maker/trunk/wd/includes/notices.php#L199 - https://plugins.trac.wordpress.org/changeset/3183170/
CVE ID: CVE-2024-10266 State: PUBLISHED Published: 2024-10-29T11:01:35.033Z Last Updated: 2024-10-29T14:50:45.933Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: leap13 Products: Premium Addons for Elementor Problem Types: CWE-79 Description: The Premium Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Video Box widget in all versions up to, and including, 4.10.60 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whe
cated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/c6102c07-2776-4963-8d16-a779c5979275?source=cve - https://plugins.trac.wordpress.org/changeset/3176303/premium-addons-for-elementor