Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-2212 State: PUBLISHED Published: 2024-03-26T15:58:27.486Z Last Updated: 2025-02-13T17:33:30.356Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L) Vendors: Eclipse Foundation Products: ThreadX Problem Types: CWE-122, CWE-190 Description: In Eclipse ThreadX before 6.4.0, xQueueCreate() and xQueueCreateSet() functions from the FreeRTOS compatibility API (utility/rtos_compatibility_layers/FreeRTOS/tx_freertos.c) were missing parameter checks. This could lead to integer wraparound, under-allocations and heap buffer overflows. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/eclipse-threadx/threadx/s
lyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/eclipse-threadx/threadx/security/advisories/GHSA-v9jj-7qjg-h6g6 - http://seclists.org/fulldisclosure/2024/May/35 - http://www.openwall.com/lists/oss-security/2024/05/28/1
CVE ID: CVE-2024-2213 State: PUBLISHED Published: 2024-06-06T18:19:26.553Z Last Updated: 2025-10-21T14:14:02.198Z Severity: LOW (CVSS 3.3 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: zenml-io Products: zenml-io/zenml Problem Types: CWE-620 Description: An issue was discovered in zenml-io/zenml versions up to and including 0.55.4. Due to improper authentication mechanisms, an attacker with access to an active user session can change the account password without needing to know the current password. This vulnerability allows for unauthorized account takeover by bypassing the standard password change verification process. The issue was fixed in version 0.56.3. Additional Analyst Notes
ssing the standard password change verification process. The issue was fixed in version 0.56.3. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://huntr.com/bounties/8f5534ac-fd08-4b8b-8c2e-35949aa36e48 - https://github.com/zenml-io/zenml/commit/58cb3d987372c91eb605853c35325701733337c2
CVE ID: CVE-2024-2214 State: PUBLISHED Published: 2024-03-26T15:48:36.304Z Last Updated: 2025-02-13T17:33:31.114Z Severity: HIGH (CVSS 7 CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Eclipse Foundation Products: ThreadX Problem Types: CWE-129 Description: In Eclipse ThreadX before version 6.4.0, the _Mtxinit() function in the Xtensa port was missing an array size check causing a memory overwrite. The affected file was ports/xtensa/xcc/src/tx_clib_lock.c Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/eclipse-threadx/threadx/security/advisories/GHSA-vmp6-qhp9-r66x - http://seclists.org/fulldisclosure/2024/May/35 - http://ww
pse-threadx/threadx/security/advisories/GHSA-vmp6-qhp9-r66x - http://seclists.org/fulldisclosure/2024/May/35 - http://www.openwall.com/lists/oss-security/2024/05/28/1
CVE ID: CVE-2024-2215 State: PUBLISHED Published: 2024-03-06T17:01:52.007Z Last Updated: 2025-02-13T17:33:31.813Z Vendors: Jenkins Project Products: Jenkins docker-build-step Plugin Description: A cross-site request forgery (CSRF) vulnerability in Jenkins docker-build-step Plugin 2.11 and earlier allows attackers to connect to an attacker-specified TCP or Unix socket URL, and to reconfigure the plugin using the provided connection test parameters, affecting future build step executions. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2024-03-06/#SECURITY-3200 - http://www.openwall.com/lists/oss-security/2024/0
- https://www.jenkins.io/security/advisory/2024-03-06/#SECURITY-3200 - http://www.openwall.com/lists/oss-security/2024/03/06/3
CVE ID: CVE-2024-2216 State: PUBLISHED Published: 2024-03-06T17:01:52.616Z Last Updated: 2025-02-13T17:33:32.424Z Vendors: Jenkins Project Products: Jenkins docker-build-step Plugin Description: A missing permission check in an HTTP endpoint in Jenkins docker-build-step Plugin 2.11 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified TCP or Unix socket URL, and to reconfigure the plugin using the provided connection test parameters, affecting future build step executions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2024-03-06/#SECURITY-3200 - http://www.openwall.com
Vulnrichment: References: - https://www.jenkins.io/security/advisory/2024-03-06/#SECURITY-3200 - http://www.openwall.com/lists/oss-security/2024/03/06/3
CVE ID: CVE-2024-2217 State: PUBLISHED Published: 2024-04-10T17:08:02.787Z Last Updated: 2024-08-22T18:08:10.258Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: gaizhenbiao Products: gaizhenbiao/chuanhuchatgpt Problem Types: CWE-284 Description: gaizhenbiao/chuanhuchatgpt is vulnerable to improper access control, allowing unauthorized access to the `config.json` file. This vulnerability is present in both authenticated and unauthenticated versions of the application, enabling attackers to obtain sensitive information such as API keys (`openai_api_key`, `google_palm_api_key`, `xmchat_api_key`, etc.), configuration details, and user credentials. The issue stems
i_api_key`, `google_palm_api_key`, `xmchat_api_key`, etc.), configuration details, and user credentials. The issue stems from the application's handling of HTTP requests for the `config.json` file, which does not properly restrict access based on user authentication. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/e4df74bf-b2ee-490f-a9c9-e5c8010b8b29 - https://github.com/gaizhenbiao/chuanhuchatgpt/commit/c5ae3b5ae6b47259e0ce8730e0a47e85121f4a7d
CVE ID: CVE-2024-2218 State: PUBLISHED Published: 2024-06-14T06:00:02.377Z Last Updated: 2024-08-01T19:03:39.405Z Vendors: Unknown Products: LuckyWP Table of Contents Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The LuckyWP Table of Contents WordPress plugin through 2.1.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://wpscan.com/vulnerability/ecd615f7-946e-45af-a610-0654a243b1dc/
CVE ID: CVE-2024-2219 State: REJECTED Published: N/A Last Updated: 2025-07-05T22:16:32.761Z Description: No description available.
CVE ID: CVE-2024-2220 State: PUBLISHED Published: 2024-05-23T06:00:02.518Z Last Updated: 2024-08-01T19:03:39.366Z Vendors: Unknown Products: Button contact VR Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Button contact VR WordPress plugin through 4.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://wpscan.com/vulnerability/fe8c001e-8880-4570-b010-a41fc8ee0c58/
CVE ID: CVE-2024-2221 State: PUBLISHED Published: 2024-04-10T17:07:59.396Z Last Updated: 2024-08-01T19:03:39.228Z Severity: CRITICAL (CVSS 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: qdrant Products: qdrant/qdrant Problem Types: CWE-434 Description: qdrant/qdrant is vulnerable to a path traversal and arbitrary file upload vulnerability via the `/collections/{COLLECTION}/snapshots/upload` endpoint, specifically through the `snapshot` parameter. This vulnerability allows attackers to upload and overwrite any file on the filesystem, leading to potential remote code execution. This issue affects the integrity and availability of the system, enabling unauthorized access and potenti
ode execution. This issue affects the integrity and availability of the system, enabling unauthorized access and potentially causing the server to malfunction. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://huntr.com/bounties/6be8d4e3-67e6-4660-a8db-04215a1cff3e - https://github.com/qdrant/qdrant/commit/e6411907f0ecf3c2f8ba44ab704b9e4597d9705d
CVE ID: CVE-2024-2222 State: PUBLISHED Published: 2024-04-09T18:59:18.152Z Last Updated: 2024-08-01T19:03:39.184Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: pluginsware Products: Advanced Classifieds & Directory Pro Problem Types: CWE-862 Missing Authorization Description: The Advanced Classifieds & Directory Pro plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the ajax_callback_delete_attachment function in all versions up to, and including, 3.0.0. This makes it possible for authenticated attackers, with subscriber access or higher, to delete arbitrary media uploads. Additional Analyst Notes: - CISA A
cated attackers, with subscriber access or higher, to delete arbitrary media uploads. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/bc5da189-838d-4c0b-a734-283c4da36473?source=cve - https://plugins.trac.wordpress.org/browser/advanced-classifieds-and-directory-pro/trunk/admin/admin.php#L757 - https://plugins.trac.wordpress.org/browser/advanced-classifieds-and-directory-pro/trunk/public/user.php#L689 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3054455%40advanced-classifieds-and-directory-pro%2Ftrunk&old=3012747%40advanced-classifieds-and-directory-pro%2Ft
e=&new=3054455%40advanced-classifieds-and-directory-pro%2Ftrunk&old=3012747%40advanced-classifieds-and-directory-pro%2Ftrunk&sfp_email=&sfph_mail=
CVE ID: CVE-2024-2223 State: PUBLISHED Published: 2024-04-09T13:01:34.716Z Last Updated: 2024-08-12T17:59:36.379Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Bitdefender Products: GravityZone Control Center (On Premises), Endpoint Security for Windows, Endpoint Security for Linux Problem Types: CWE-185 Description: An Incorrect Regular Expression vulnerability in Bitdefender GravityZone Update Server allows an attacker to cause a Server Side Request Forgery and reconfigure the relay. This issue affects the following products that include the vulnerable component: Bitdefender Endpoint Security for Linux version 7.0.5.200089 Bitdefender Endpoint Security for
the vulnerable component: Bitdefender Endpoint Security for Linux version 7.0.5.200089 Bitdefender Endpoint Security for Windows version 7.9.9.380 GravityZone Control Center (On Premises) version 6.36.1 Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.bitdefender.com/support/security-advisories/incorrect-regular-expression-in-gravityzone-update-server-va-11465/
CVE ID: CVE-2024-2224 State: PUBLISHED Published: 2024-04-09T13:01:47.416Z Last Updated: 2024-08-01T19:03:39.266Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Bitdefender Products: GravityZone Control Center (On Premises), Endpoint Security for Windows, Endpoint Security for Linux Problem Types: CWE-22 Description: Improper Limitation of a Pathname to a Restricted Directory (‘Path Traversal’) vulnerability in the UpdateServer component of Bitdefender GravityZone allows an attacker to execute arbitrary code on vulnerable instances. This issue affects the following products that include the vulnerable component: Bitdefender Endpoint Security for Linux version
ue affects the following products that include the vulnerable component: Bitdefender Endpoint Security for Linux version 7.0.5.200089 Bitdefender Endpoint Security for Windows version 7.9.9.380 GravityZone Control Center (On Premises) version 6.36.1 Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.bitdefender.com/support/security-advisories/privilege-escalation-via-the-gravityzone-productmanager-updateserver-kitsmanager-api-va-11466/
CVE ID: CVE-2024-2226 State: PUBLISHED Published: 2024-04-09T18:58:37.731Z Last Updated: 2024-08-01T19:03:39.392Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: themeisle Products: Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE Problem Types: CWE-20 Improper Input Validation Description: The Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the id parameter in the google-map block in all versions up to, and including, 2.6.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with co
4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with contributor access and higher to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/217d3148-d411-4fff-a4f6-d5d02ef207af?source=cve - https://plugins.trac.wordpress.org/changeset/3050429/otter-blocks
CVE ID: CVE-2024-2227 State: PUBLISHED Published: 2024-03-22T15:43:12.869Z Last Updated: 2024-08-01T19:03:39.142Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: SailPoint Products: IdentityIQ Problem Types: CWE-22 Description: This vulnerability allows access to arbitrary files in the application server file system due to a path traversal vulnerability in JavaServer Faces (JSF) 2.2.20 documented in CVE-2020-6950. The remediation for this vulnerability contained in this security fix provides additional changes to the remediation announced in May 2021 tracked by ETN IIQSAW-3585 and January 2024 tracked by IIQFW-336. This vulnerability in IdentityIQ is assign
in May 2021 tracked by ETN IIQSAW-3585 and January 2024 tracked by IIQFW-336. This vulnerability in IdentityIQ is assigned CVE-2024-2227. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.sailpoint.com/security-advisories/
CVE ID: CVE-2024-2228 State: PUBLISHED Published: 2024-03-22T15:50:09.729Z Last Updated: 2024-08-01T19:03:39.121Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: SailPoint Products: IdentityIQ Problem Types: CWE-269 Description: This vulnerability allows an authenticated user to perform a Lifecycle Manager flow or other QuickLink for a target user outside of the defined QuickLink Population. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.sailpoint.com/security-advisories/
CVE ID: CVE-2024-2229 State: PUBLISHED Published: 2024-03-18T16:08:33.773Z Last Updated: 2024-08-01T19:03:39.361Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Schneider Electric Products: EcoStruxure Power Design - Ecodial Problem Types: CWE-502 Description: CWE-502: Deserialization of Untrusted Data vulnerability exists that could cause remote code execution when a malicious project file is loaded into the application by a valid user. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2024-072-02&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2024-0
d.schneider-electric.com/files?p_Doc_Ref=SEVD-2024-072-02&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2024-072-02.pdf
CVE ID: CVE-2024-2230 State: REJECTED Published: 2024-06-12T17:03:22.099Z Last Updated: 2024-06-12T17:30:26.400Z Description: No description available.
CVE ID: CVE-2024-2231 State: PUBLISHED Published: 2024-07-03T06:00:03.187Z Last Updated: 2024-08-09T18:43:43.462Z Vendors: Unknown Products: Himer Problem Types: CWE-639 Authorization Bypass Through User-Controlled Key Description: The allows any authenticated user to join a private group due to a missing authorization check on a function Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/119d2d93-3b71-4ce9-b385-4e6f57b162cb/
CVE ID: CVE-2024-2232 State: PUBLISHED Published: 2024-08-05T06:00:01.247Z Last Updated: 2024-08-07T13:43:12.434Z Vendors: Unknown Products: Himer Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The lacks CSRF checks allowing a user to invite any user to any group (including private groups) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/a2df28d3-bf03-4fd3-b231-86e062739899/
CVE ID: CVE-2024-2233 State: PUBLISHED Published: 2024-07-03T06:00:03.458Z Last Updated: 2024-08-01T19:03:39.397Z Vendors: Unknown Products: Himer Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The Himer WordPress theme before 2.1.1 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks. These include declining and accepting group invitations or leaving a group Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://wpscan.com/vulnerability/51d0311a-673b-4538-9427-a48e8c89e38b/
CVE ID: CVE-2024-2234 State: PUBLISHED Published: 2024-07-03T06:00:03.688Z Last Updated: 2024-08-01T19:03:39.187Z Vendors: Unknown Products: Himer Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Himer WordPress theme before 2.1.1 does not sanitise and escape some of its Post settings, which could allow high privilege users such as Contributor to perform Stored Cross-Site Scripting attacks Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://wpscan.com/vulnerability/37018a3f-895f-48f7-b033-c051e2462830/
CVE ID: CVE-2024-2235 State: PUBLISHED Published: 2024-07-03T06:00:03.922Z Last Updated: 2024-08-01T19:03:39.198Z Vendors: Unknown Products: Himer Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The Himer WordPress theme before 2.1.1 does not have CSRF checks in some places, which could allow attackers to make users vote on any polls, including those they don't have access to via a CSRF attack Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://wpscan.com/vulnerability/62c8a564-225e-4202-9bb0-03029fa4fd42/
CVE ID: CVE-2024-2236 State: PUBLISHED Published: 2024-03-06T22:07:16.617Z Last Updated: 2025-11-20T18:18:15.192Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Red Hat Products: Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 9.2 Extended Update Support, Red Hat Enterprise Linux 9.4 Extended Update Support, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8 Problem Types: CWE-208 Description: A timing-based side-channel flaw was found in libgcrypt's RSA implementation. This issue may allow a remote attacker to initiate a Bleichenbacher-style attack, which can lead to the decryption of RSA ci
issue may allow a remote attacker to initiate a Bleichenbacher-style attack, which can lead to the decryption of RSA ciphertexts. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://access.redhat.com/errata/RHSA-2024:9404 - https://access.redhat.com/errata/RHSA-2025:3530 - https://access.redhat.com/errata/RHSA-2025:3534 - https://access.redhat.com/security/cve/CVE-2024-2236 - https://bugzilla.redhat.com/show_bug.cgi?id=2245218
CVE ID: CVE-2024-2237 State: PUBLISHED Published: 2024-03-13T15:32:38.512Z Last Updated: 2024-08-01T19:03:39.316Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: Premium Addons for Elementor Products: Premium Addons Pro for Elementor Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Premium Addons PRO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Global Badge module in all versions up to, and including, 2.9.12 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and abov
tization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/35151561-6a80-4c2c-b87a-2dfe02aa6158?source=cve - https://premiumaddons.com/change-log/
CVE ID: CVE-2024-2238 State: PUBLISHED Published: 2024-03-13T15:32:39.917Z Last Updated: 2025-04-15T15:19:49.466Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: Premium Addons for Elementor Products: Premium Addons Pro for Elementor Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Premium Addons PRO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Custom Mouse Cursor module in all versions up to, and including, 2.9.12 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access a
ut sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/82e5fd9f-9a1f-4a4c-ac06-61bf65e3c8ab?source=cve - https://premiumaddons.com/change-log/
CVE ID: CVE-2024-2239 State: PUBLISHED Published: 2024-03-13T15:32:37.901Z Last Updated: 2024-08-01T19:03:39.400Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: Premium Addons for Elementor Products: Premium Addons Pro for Elementor Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Premium Addons PRO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Premium Magic Scroll module in all versions up to, and including, 2.9.12 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access
put sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/254f3a1c-0d5d-499b-9da7-129f21ba70af?source=cve - https://premiumaddons.com/change-log/
CVE ID: CVE-2024-2240 State: PUBLISHED Published: 2025-02-14T04:53:11.643Z Last Updated: 2025-02-14T15:28:53.249Z Vendors: Brocade Products: Brocade SANnav Problem Types: CWE-250 Description: Docker daemon in Brocade SANnav before SANnav 2.3.1b runs without auditing. The vulnerability could allow a remote authenticated attacker to execute various attacks. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/25401
CVE ID: CVE-2024-2241 State: PUBLISHED Published: 2024-03-07T13:11:22.338Z Last Updated: 2024-10-30T17:53:38.772Z Vendors: Devolutions Products: Workspace Description: Improper access control in the user interface in Devolutions Workspace 2024.1.0 and earlier allows an authenticated user to perform unintended actions via specific permissions Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://devolutions.net/security/advisories/DEVO-2024-0003