Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-34367 State: PUBLISHED Published: 2024-05-06T18:16:15.716Z Last Updated: 2024-08-02T02:51:11.170Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: Popup Box Team Products: Popup box Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Popup Box Team Popup box allows Cross-Site Scripting (XSS).This issue affects Popup box: from n/a through 4.1.2. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/ays-popup-box/wordpress-popup-box-plugin-4-1-2-csrf-to-xss-vulnerability?_s_id=cve
CVE ID: CVE-2024-34368 State: PUBLISHED Published: 2024-05-06T18:10:33.709Z Last Updated: 2024-08-02T02:51:11.326Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Mooberry Dreams Products: Mooberry Book Manager Problem Types: CWE-200 Description: Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Mooberry Dreams Mooberry Book Manager.This issue affects Mooberry Book Manager: from n/a through 4.15.12. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/mooberry-book-manager/wordpress-mooberry-book-manager-plugin-4-15-12-sensitive-data-exposure-vulnerab
base/vulnerability/mooberry-book-manager/wordpress-mooberry-book-manager-plugin-4-15-12-sensitive-data-exposure-vulnerability?_s_id=cve
CVE ID: CVE-2024-34369 State: PUBLISHED Published: 2024-05-06T18:32:39.087Z Last Updated: 2024-08-02T02:51:10.902Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: Webpushr Web Push Notifications Products: Webpushr Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Webpushr Web Push Notifications Webpushr allows Reflected XSS.This issue affects Webpushr: from n/a through 4.35.0. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/webpushr-web-push-notifications/wordpress-web-push-notifications-
ences: - https://patchstack.com/database/vulnerability/webpushr-web-push-notifications/wordpress-web-push-notifications-webpushr-plugin-4-35-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2024-34370 State: PUBLISHED Published: 2024-05-17T08:12:41.892Z Last Updated: 2024-08-02T02:51:10.873Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: WPFactory Products: EAN for WooCommerce Problem Types: CWE-269 Description: Improper Privilege Management vulnerability in WPFactory EAN for WooCommerce allows Privilege Escalation.This issue affects EAN for WooCommerce: from n/a through 4.8.9. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/ean-for-woocommerce/wordpress-ean-for-woocommerce-plugin-4-8-9-arbitrary-option-update-to-privilege-escalation-vulnerability
for-woocommerce/wordpress-ean-for-woocommerce-plugin-4-8-9-arbitrary-option-update-to-privilege-escalation-vulnerability?_s_id=cve
CVE ID: CVE-2024-34371 State: PUBLISHED Published: 2024-05-06T19:04:12.584Z Last Updated: 2024-08-15T17:45:53.591Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: Hamid Alinia – idehweb Products: Login with phone number Problem Types: CWE-862 Description: Missing Authorization vulnerability in Hamid Alinia – idehweb Login with phone number.This issue affects Login with phone number: from n/a through 1.7.18. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/login-with-phone-number/wordpress-login-with-phone-number-plugin-1-7-18-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2024-34372 State: PUBLISHED Published: 2024-05-06T18:59:58.715Z Last Updated: 2024-08-02T02:51:10.878Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: AddonMaster Products: Post Grid Master Problem Types: CWE-862 Description: Missing Authorization vulnerability in AddonMaster Post Grid Master.This issue affects Post Grid Master: from n/a through 3.4.7. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/ajax-filter-posts/wordpress-post-grid-master-plugin-3-4-7-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2024-34373 State: PUBLISHED Published: 2024-05-06T18:31:19.521Z Last Updated: 2024-08-02T02:51:11.348Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: POSIMYTH Products: The Plus Addons for Elementor Page Builder Lite Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in POSIMYTH The Plus Addons for Elementor Page Builder Lite allows Stored XSS.This issue affects The Plus Addons for Elementor Page Builder Lite: from n/a through 5.4.2. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerabil
nalyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/the-plus-addons-for-elementor-page-builder/wordpress-the-plus-addons-for-elementor-plugin-5-4-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2024-34374 State: PUBLISHED Published: 2024-05-06T18:29:41.351Z Last Updated: 2024-08-02T02:51:11.213Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: QuomodoSoft Products: ElementsReady Addons for Elementor Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in QuomodoSoft ElementsReady Addons for Elementor allows Stored XSS.This issue affects ElementsReady Addons for Elementor: from n/a through 5.8.0. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/element-ready-lite/wordpress-
ment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/element-ready-lite/wordpress-elementsready-addons-for-elementor-plugin-5-8-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2024-34375 State: PUBLISHED Published: 2024-05-06T18:28:14.610Z Last Updated: 2024-08-02T02:51:10.977Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: WPPOOL Products: Sheets To WP Table Live Sync Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPPOOL Sheets To WP Table Live Sync allows Stored XSS.This issue affects Sheets To WP Table Live Sync: from n/a through 3.7.0. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/sheets-to-wp-table-live-sync/wordpress-sheets-to-wp-table
r: References: - https://patchstack.com/database/vulnerability/sheets-to-wp-table-live-sync/wordpress-sheets-to-wp-table-live-sync-plugin-3-7-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2024-34376 State: PUBLISHED Published: 2024-05-06T18:27:05.522Z Last Updated: 2024-08-02T02:51:11.432Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: Theme Freesia Products: Edge Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Theme Freesia Edge allows Stored XSS.This issue affects Edge: from n/a through 2.0.9. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/edge/wordpress-edge-theme-2-0-9-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2024-34377 State: PUBLISHED Published: 2024-05-06T18:57:07.345Z Last Updated: 2024-08-02T02:51:11.193Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: A WP Life Products: Video Gallery – Api Gallery, YouTube and Vimeo, Link Gallery Problem Types: CWE-862 Description: Missing Authorization vulnerability in A WP Life Video Gallery – Api Gallery, YouTube and Vimeo, Link Gallery.This issue affects Video Gallery – Api Gallery, YouTube and Vimeo, Link Gallery: from n/a through 1.5.3. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/new-video-gallery/wordpress-video-g
- CVE Program Container: References: - https://patchstack.com/database/vulnerability/new-video-gallery/wordpress-video-gallery-api-gallery-youtube-and-vimeo-link-gallery-plugin-1-5-3-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2024-34378 State: PUBLISHED Published: 2024-05-06T18:55:07.977Z Last Updated: 2024-08-02T02:51:11.423Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L) Vendors: LeadConnector Products: LeadConnector Problem Types: CWE-862 Description: Missing Authorization vulnerability in LeadConnector.This issue affects LeadConnector: from n/a through 1.7. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/leadconnector/wordpress-leadconnector-plugin-1-7-api-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2024-34379 State: PUBLISHED Published: 2024-05-06T18:19:54.838Z Last Updated: 2024-08-02T02:51:10.733Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: Rara Theme Products: Restaurant and Cafe Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Rara Theme Restaurant and Cafe.This issue affects Restaurant and Cafe: from n/a through 1.2.1. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/restaurant-and-cafe/wordpress-restaurant-and-cafe-theme-1-2-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2024-34380 State: PUBLISHED Published: 2024-05-06T18:25:49.630Z Last Updated: 2024-08-02T02:51:11.400Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: QuantumCloud Products: Conversational Forms for ChatBot Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in QuantumCloud Conversational Forms for ChatBot allows Stored XSS.This issue affects Conversational Forms for ChatBot: from n/a through 1.2.0. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/conversational-forms/wordpress-ch
: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/conversational-forms/wordpress-chatbot-conversational-forms-plugin-1-2-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2024-34381 State: PUBLISHED Published: 2024-05-06T18:23:01.324Z Last Updated: 2024-08-02T02:51:11.262Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: PropertyHive Products: PropertyHive Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PropertyHive allows Stored XSS.This issue affects PropertyHive: from n/a through 2.0.10. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/propertyhive/wordpress-propertyhive-plugin-2-0-10-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2024-34382 State: PUBLISHED Published: 2024-05-06T17:57:27.409Z Last Updated: 2024-08-02T02:51:11.391Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: RoboSoft Products: Robo Gallery Problem Types: CWE-200 Description: Exposure of Sensitive Information to an Unauthorized Actor vulnerability in RoboSoft Robo Gallery.This issue affects Robo Gallery: from n/a through 3.2.18. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/robo-gallery/wordpress-photo-gallery-images-slider-in-rbs-image-gallery-plugin-3-2-18-sensitive-data-exposure-vulnerability?_s_id=cve
CVE ID: CVE-2024-34383 State: PUBLISHED Published: 2024-05-06T17:54:52.233Z Last Updated: 2024-08-02T02:51:11.387Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: The SEO Guys at SEOPress Products: SEOPress Problem Types: CWE-639 Description: Authorization Bypass Through User-Controlled Key vulnerability in The SEO Guys at SEOPress SEOPress.This issue affects SEOPress: from n/a through 7.7.1. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/wp-seopress/wordpress-seopress-plugin-7-6-1-sensitive-data-exposure-vulnerability?_s_id=cve
CVE ID: CVE-2024-34384 State: PUBLISHED Published: 2024-06-04T13:17:11.193Z Last Updated: 2024-08-02T02:51:11.383Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: SinaExtra Products: Sina Extension for Elementor Problem Types: CWE-22 Description: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in SinaExtra Sina Extension for Elementor allows PHP Local File Inclusion.This issue affects Sina Extension for Elementor: from n/a through 3.5.1. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/sina-extension-for-elementor/wordpress-sina
ogram Container: References: - https://patchstack.com/database/vulnerability/sina-extension-for-elementor/wordpress-sina-extension-for-elementor-plugin-3-5-1-local-file-inclusion-vulnerability?_s_id=cve
CVE ID: CVE-2024-34385 State: PUBLISHED Published: 2024-06-03T11:41:00.230Z Last Updated: 2024-08-02T02:51:10.939Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: YITH Products: YITH WooCommerce Wishlist Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in YITH YITH WooCommerce Wishlist allows Stored XSS.This issue affects YITH WooCommerce Wishlist: from n/a through 3.32.0. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/yith-woocommerce-wishlist/wordpress-yith-woocommerce-wishlist-
ferences: - https://patchstack.com/database/vulnerability/yith-woocommerce-wishlist/wordpress-yith-woocommerce-wishlist-plugin-3-32-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2024-34386 State: PUBLISHED Published: 2024-05-06T18:15:00.211Z Last Updated: 2024-08-02T02:51:11.409Z Severity: HIGH (CVSS 7.6 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L) Vendors: Lucian Apostol Products: Auto Affiliate Links Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Lucian Apostol Auto Affiliate Links.This issue affects Auto Affiliate Links: from n/a through 6.4.3.1. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/wp-auto-affiliate-links/wordpress-auto-affiliate-links-plugin-6-4-3-1-sql-injection
atchstack.com/database/vulnerability/wp-auto-affiliate-links/wordpress-auto-affiliate-links-plugin-6-4-3-1-sql-injection-vulnerability?_s_id=cve
CVE ID: CVE-2024-34387 State: PUBLISHED Published: 2024-05-06T18:49:03.579Z Last Updated: 2024-08-02T02:51:11.403Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: AF themes Products: WP Post Author Problem Types: CWE-862 Description: Missing Authorization vulnerability in AF themes WP Post Author.This issue affects WP Post Author: from n/a through 3.6.4. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/wp-post-author/wordpress-wp-post-author-plugin-3-6-4-rating-value-manipulation-vulnerability?_s_id=cve
CVE ID: CVE-2024-34388 State: PUBLISHED Published: 2024-05-06T17:49:06.586Z Last Updated: 2024-08-02T02:51:10.987Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Scribit Products: GDPR Compliance Problem Types: CWE-200 Description: Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Scribit GDPR Compliance.This issue affects GDPR Compliance: from n/a through 1.2.5. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/gdpr-compliance/wordpress-gdpr-compliance-plugin-1-2-5-sensitive-data-exposure-vulnerability?_s_id=cve
CVE ID: CVE-2024-34389 State: PUBLISHED Published: 2024-05-06T18:42:14.643Z Last Updated: 2024-08-02T02:51:11.415Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: AF themes Products: WP Post Author Problem Types: CWE-862 Description: Missing Authorization vulnerability in AF themes WP Post Author.This issue affects WP Post Author: from n/a through 3.6.4. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/wp-post-author/wordpress-wp-post-author-plugin-3-6-4-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2024-34390 State: PUBLISHED Published: 2024-05-06T18:21:56.842Z Last Updated: 2024-08-02T02:51:11.430Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: AddonMaster Products: Post Grid Master Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AddonMaster Post Grid Master allows Stored XSS.This issue affects Post Grid Master: from n/a through 3.4.8. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/ajax-filter-posts/wordpress-post-grid-master-plugin-3-4-8-auth-cross-site-scripting
atchstack.com/database/vulnerability/ajax-filter-posts/wordpress-post-grid-master-plugin-3-4-8-auth-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2024-34391 State: PUBLISHED Published: 2024-05-02T18:54:29.635Z Last Updated: 2024-11-25T12:55:10.548Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Problem Types: CWE-843 Description: libxmljs is vulnerable to a type confusion vulnerability when parsing a specially crafted XML while invoking a function on the result of attrs() that was called on a parsed node. This vulnerability might lead to denial of service (on both 32-bit systems and 64-bit systems), data leak, infinite loop and remote code execution (on 32-bit systems with the XML_PARSE_HUGE flag enabled). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http
PARSE_HUGE flag enabled). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://research.jfrog.com/vulnerabilities/libxmljs-attrs-type-confusion-rce-jfsa-2024-001033988/ - https://github.com/libxmljs/libxmljs/issues/645
CVE ID: CVE-2024-34392 State: PUBLISHED Published: 2024-05-02T18:55:38.219Z Last Updated: 2024-11-25T12:54:47.608Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Problem Types: CWE-843 Description: libxmljs is vulnerable to a type confusion vulnerability when parsing a specially crafted XML while invoking the namespaces() function (which invokes _wrap__xmlNode_nsDef_get()) on a grand-child of a node that refers to an entity. This vulnerability can lead to denial of service and remote code execution. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://research.jfrog.com/vulnerabilities/libxmljs-namespaces-type-confusion-rce
- CVE Program Container: References: - https://research.jfrog.com/vulnerabilities/libxmljs-namespaces-type-confusion-rce-jfsa-2024-001034096/ - https://github.com/libxmljs/libxmljs/issues/646
CVE ID: CVE-2024-34393 State: PUBLISHED Published: 2024-05-02T18:56:44.270Z Last Updated: 2024-11-25T12:54:31.518Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Problem Types: CWE-843 Description: libxmljs2 is vulnerable to a type confusion vulnerability when parsing a specially crafted XML while invoking a function on the result of attrs() that was called on a parsed node. This vulnerability might lead to denial of service (on both 32-bit systems and 64-bit systems), data leak, infinite loop and remote code execution (on 32-bit systems with the XML_PARSE_HUGE flag enabled). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - htt
_PARSE_HUGE flag enabled). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://research.jfrog.com/vulnerabilities/libxmljs2-attrs-type-confusion-rce-jfsa-2024-001034097/ - https://github.com/marudor/libxmljs2/issues/204
CVE ID: CVE-2024-34394 State: PUBLISHED Published: 2024-05-02T18:57:35.301Z Last Updated: 2024-11-25T12:54:08.634Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Problem Types: CWE-843 Description: libxmljs2 is vulnerable to a type confusion vulnerability when parsing a specially crafted XML while invoking the namespaces() function (which invokes XmlNode::get_local_namespaces()) on a grand-child of a node that refers to an entity. This vulnerability can lead to denial of service and remote code execution. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://research.jfrog.com/vulnerabilities/libxmljs2-namespaces-type-confus
ment: - CVE Program Container: References: - https://research.jfrog.com/vulnerabilities/libxmljs2-namespaces-type-confusion-rce-jfsa-2024-001034098/ - https://github.com/marudor/libxmljs2/issues/205
CVE ID: CVE-2024-34397 State: PUBLISHED Published: 2024-05-07T00:00:00.000Z Last Updated: 2025-11-04T22:06:15.286Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in GNOME GLib before 2.78.5, and 2.79.x and 2.80.x before 2.80.1. When a GDBus-based client subscribes to signals from a trusted system service such as NetworkManager on a shared computer, other users of the same computer can send spoofed D-Bus signals that the GDBus-based client will wrongly interpret as having been sent by the trusted system service. This could lead to the GDBus-based client behaving incorrectly, with an application-dependent impact. Additional Analyst Notes: - CISA ADP Vulnrich
s-based client behaving incorrectly, with an application-dependent impact. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://gitlab.gnome.org/GNOME/glib/-/issues/3268 - https://www.openwall.com/lists/oss-security/2024/05/07/5 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IRSFYAE5X23TNRWX7ZWEJOMISLCDSYNS/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UNFJHISR4O6VFOHBFWH5I5WWMG37H63A/ - https://lists.debian.org/debian-lts-announce/2024/05/msg00008.html - https://security.netapp.com/advisory/ntap-20240531-0008/ - https://lists.fedoraproject.or
nounce/2024/05/msg00008.html - https://security.netapp.com/advisory/ntap-20240531-0008/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LL6HSJDXCXMLEIJBYV6CPOR4K2NTCTXW/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LCDY3KA7G7D3DRXYTT46K6LFHS2KHWBH/