Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-11031 State: PUBLISHED Published: 2025-03-20T10:09:16.417Z Last Updated: 2025-07-15T10:48:56.680Z Severity: HIGH (CVSS 7.7 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) Vendors: binary-husky Products: binary-husky/gpt_academic Problem Types: CWE-918 Description: In version 3.83 of binary-husky/gpt_academic, a Server-Side Request Forgery (SSRF) vulnerability exists in the Markdown_Translate.get_files_from_everything() API. This vulnerability is exploited through the HotReload(Markdown翻译中) plugin function, which allows downloading arbitrary web hosts by only checking if the link starts with 'http'. Attackers can exploit this vulnerability to abuse the victim GPT Academic's Gra
checking if the link starts with 'http'. Attackers can exploit this vulnerability to abuse the victim GPT Academic's Gradio Web server's credentials to access unauthorized web resources. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/d27d89a7-7d54-45b9-a9eb-66c00bc56e02
CVE ID: CVE-2024-11032 State: PUBLISHED Published: 2024-11-26T09:32:35.112Z Last Updated: 2024-11-26T14:09:22.849Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: man4toman Products: Parsi Date Problem Types: CWE-79 Description: The Parsi Date plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 5.1.1. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP
an successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/72383bd3-82b4-4aea-9a1c-277ad06e2500?source=cve - https://plugins.trac.wordpress.org/browser/wp-parsidate/tags/5.1.1/includes/general.php#L76 - https://wordpress.org/plugins/wp-parsidate/#developers - https://plugins.trac.wordpress.org/changeset/3195986/wp-parsidate/trunk/includes/general.php
CVE ID: CVE-2024-11033 State: PUBLISHED Published: 2025-03-20T10:10:30.878Z Last Updated: 2025-03-20T18:20:33.613Z Severity: MEDIUM (CVSS 6.5 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: binary-husky Products: binary-husky/gpt_academic Problem Types: CWE-400 Description: A Denial of Service (DoS) vulnerability exists in the file upload feature of binary-husky/gpt_academic version 3.83. The vulnerability is due to improper handling of form-data with a large filename in the file upload request. An attacker can exploit this vulnerability by sending a payload with an excessively large filename, causing the server to become overwhelmed and unavailable for legitimate users. Additional An
excessively large filename, causing the server to become overwhelmed and unavailable for legitimate users. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/78afc15c-7db7-42fe-90f5-a0480a2ec222
CVE ID: CVE-2024-11034 State: PUBLISHED Published: 2024-11-23T11:23:16.004Z Last Updated: 2024-11-26T16:28:44.847Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: wpbean Products: Request a Quote for WooCommerce and Elementor – Get a Quote Button – Product Enquiry Form Popup – Product Quotation Problem Types: CWE-94 Description: The The Request a Quote for WooCommerce and Elementor – Get a Quote Button – Product Enquiry Form Popup – Product Quotation plugin for WordPress is vulnerable to arbitrary shortcode execution via fire_contact_form AJAX action in all versions up to, and including, 1.4. This is due to the software allowing users to execute an action that
X action in all versions up to, and including, 1.4. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/3ccd3504-5663-48cd-90bc-502c2ce232f7?source=cve - https://plugins.trac.wordpress.org/browser/get-a-quote-button-for-woocommerce/tags/1.3.9/includes/class-ajax.php#L31 - https://wordpress.org/plugins/get-a-quote-button-for-woocommerce/#developers - https://plugins.trac.wordpress.org/changeset/3195227/
CVE ID: CVE-2024-11035 State: PUBLISHED Published: 2025-03-05T16:56:53.153Z Last Updated: 2025-03-05T17:10:17.214Z Severity: LOW (CVSS 2.5 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: Symantec Products: Carbon Black Cloud Windows Sensor Description: Carbon Black Cloud Windows Sensor, prior to 4.0.3, may be susceptible to an Information Leak vulnerability, which s a type of issue whereby sensitive information may b exposed due to a vulnerability in software. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/25472
CVE ID: CVE-2024-11036 State: PUBLISHED Published: 2024-11-19T11:02:29.496Z Last Updated: 2024-11-19T14:29:40.512Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: rubengc Products: GamiPress – The #1 gamification plugin to reward points, achievements, badges & ranks in WordPress Problem Types: CWE-94 Description: The The GamiPress – The #1 gamification plugin to reward points, achievements, badges & ranks in WordPress plugin for WordPress is vulnerable to arbitrary shortcode execution via gamipress_get_user_earnings AJAX action in all versions up to, and including, 7.1.5. This is due to the software allowing users to execute an action that does not properly va
s up to, and including, 7.1.5. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/bad0cd3f-88ea-4a1d-b400-0a450b07a546?source=cve - https://plugins.trac.wordpress.org/browser/gamipress/tags/7.1.4/includes/functions.php#L693 - https://plugins.trac.wordpress.org/browser/gamipress/tags/7.1.4/includes/functions.php#L702 - https://wordpress.org/plugins/gamipress/#developers - https://plugins.trac.wordpress.org/
/includes/functions.php#L702 - https://wordpress.org/plugins/gamipress/#developers - https://plugins.trac.wordpress.org/browser/gamipress/
CVE ID: CVE-2024-11037 State: PUBLISHED Published: 2025-03-20T10:08:57.513Z Last Updated: 2025-03-20T19:00:18.387Z Severity: MEDIUM (CVSS 6.5 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: binary-husky Products: binary-husky/gpt_academic Problem Types: CWE-22 Description: A path traversal vulnerability exists in binary-husky/gpt_academic at commit 679352d, which allows an attacker to bypass the blocked_paths protection and read the config.py file containing sensitive information such as the OpenAI API key. This vulnerability is exploitable on Windows operating systems by accessing a specific URL that includes the absolute path of the project. Additional Analyst Notes: - CISA ADP Vuln
ms by accessing a specific URL that includes the absolute path of the project. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/91243fc1-f287-4f4b-8aa6-dfe3efff23e5
CVE ID: CVE-2024-11038 State: PUBLISHED Published: 2024-11-19T11:02:28.827Z Last Updated: 2024-11-19T14:32:53.674Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: wpbean Products: WPB Popup for Contact Form 7 – Showing The Contact Form 7 Popup on Button Click – CF7 Popup Problem Types: CWE-94 Description: The The WPB Popup for Contact Form 7 – Showing The Contact Form 7 Popup on Button Click – CF7 Popup plugin for WordPress is vulnerable to arbitrary shortcode execution via wpb_pcf_fire_contact_form AJAX action in all versions up to, and including, 1.7.5. This is due to the software allowing users to execute an action that does not properly validate a value be
uding, 1.7.5. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/a7faa800-3b29-4b79-8b94-1e7985acb50d?source=cve - https://plugins.trac.wordpress.org/browser/wpb-popup-for-contact-form-7/tags/1.7.4/includes/class.ajax.php#L34 - https://wordpress.org/plugins/wpb-popup-for-contact-form-7/#developers - https://plugins.trac.wordpress.org/changeset/3188864/ - https://gist.github.com/wpbean/1a5abfea883621b4e150e
evelopers - https://plugins.trac.wordpress.org/changeset/3188864/ - https://gist.github.com/wpbean/1a5abfea883621b4e150eab1362a420f
CVE ID: CVE-2024-11039 State: PUBLISHED Published: 2025-03-20T10:09:58.792Z Last Updated: 2025-03-20T18:32:12.099Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: binary-husky Products: binary-husky/gpt_academic Problem Types: CWE-502 Description: A pickle deserialization vulnerability exists in the Latex English error correction plug-in function of binary-husky/gpt_academic versions up to and including 3.83. This vulnerability allows attackers to achieve remote command execution by deserializing untrusted data. The issue arises from the inclusion of numpy in the deserialization whitelist, which can be exploited by constructing a malicious compressed package c
usion of numpy in the deserialization whitelist, which can be exploited by constructing a malicious compressed package containing a merge_result.pkl file and a merge_proofread_en.tex file. The vulnerability is fixed in commit 91f5e6b. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/f233a365-522c-44f6-876f-db492fb58ad5 - https://github.com/binary-husky/gpt_academic/commit/91f5e6b8f754beb47b02f7c1893804c1c9543ccb
CVE ID: CVE-2024-11040 State: REJECTED Published: 2025-03-20T10:10:55.762Z Last Updated: 2025-04-15T15:53:31.930Z Description: No description available.
CVE ID: CVE-2024-11041 State: PUBLISHED Published: 2025-03-20T10:10:40.868Z Last Updated: 2025-03-20T18:18:48.224Z Severity: CRITICAL (CVSS 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: vllm-project Products: vllm-project/vllm Problem Types: CWE-502 Description: vllm-project vllm version v0.6.2 contains a vulnerability in the MessageQueue.dequeue() API function. The function uses pickle.loads to parse received sockets directly, leading to a remote code execution vulnerability. An attacker can exploit this by sending a malicious payload to the MessageQueue, causing the victim's machine to execute arbitrary code. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - htt
ing the victim's machine to execute arbitrary code. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/00136195-11e0-4ad0-98d5-72db066e867f
CVE ID: CVE-2024-11042 State: PUBLISHED Published: 2025-03-20T10:08:52.134Z Last Updated: 2025-10-15T12:49:27.422Z Severity: CRITICAL (CVSS 9.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H) Vendors: invoke-ai Products: invoke-ai/invokeai Problem Types: CWE-73 Description: In invoke-ai/invokeai version v5.0.2, the web API `POST /api/v1/images/delete` is vulnerable to Arbitrary File Deletion. This vulnerability allows unauthorized attackers to delete arbitrary files on the server, potentially including critical or sensitive system files such as SSH keys, SQLite databases, and configuration files. This can impact the integrity and availability of applications relying on these files. Additional
configuration files. This can impact the integrity and availability of applications relying on these files. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/635535a7-c804-4789-ac3a-48d951263987 - https://github.com/invoke-ai/invokeai/commit/5440c037674882b2ab7acd59087e9bb04b49657a
CVE ID: CVE-2024-11043 State: PUBLISHED Published: 2025-03-20T10:11:14.925Z Last Updated: 2025-03-20T13:32:48.412Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: invoke-ai Products: invoke-ai/invokeai Problem Types: CWE-400 Description: A Denial of Service (DoS) vulnerability was discovered in the /api/v1/boards/{board_id} endpoint of invoke-ai/invokeai version v5.0.2. This vulnerability occurs when an excessively large payload is sent in the board_name field during a PATCH request. By sending a large payload, the UI becomes unresponsive, rendering it impossible for users to interact with or manage the affected board. Additionally, the option to delete the bo
ndering it impossible for users to interact with or manage the affected board. Additionally, the option to delete the board becomes inaccessible, amplifying the severity of the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/9270900a-b8b7-402f-aee5-432d891e5648
CVE ID: CVE-2024-11044 State: PUBLISHED Published: 2025-03-20T10:09:31.708Z Last Updated: 2025-03-20T18:37:59.803Z Severity: MEDIUM (CVSS 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: automatic1111 Products: automatic1111/stable-diffusion-webui Problem Types: CWE-601 Description: An open redirect vulnerability in automatic1111/stable-diffusion-webui version 1.10.0 allows a remote unauthenticated attacker to redirect users to arbitrary websites via a specially crafted URL. This vulnerability can be exploited to conduct phishing attacks, distribute malware, and steal user credentials. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/ee942
teal user credentials. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/ee942e5e-4987-4f81-ba83-014fec6b33b3
CVE ID: CVE-2024-11045 State: PUBLISHED Published: 2025-03-20T10:10:12.258Z Last Updated: 2025-03-20T18:24:44.284Z Severity: CRITICAL (CVSS 9.6 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) Vendors: automatic1111 Products: automatic1111/stable-diffusion-webui Problem Types: CWE-284 Description: A Cross-Site WebSocket Hijacking (CSWSH) vulnerability in automatic1111/stable-diffusion-webui version 1.10.0 allows an attacker to clone a malicious server extension from a GitHub repository. The vulnerability arises from the lack of proper validation on WebSocket connections at ws://127.0.0.1:7860/queue/join, enabling unauthorized actions on the server. This can lead to unauthorized cloning of serve
//127.0.0.1:7860/queue/join, enabling unauthorized actions on the server. This can lead to unauthorized cloning of server extensions, execution of malicious scripts, data exfiltration, and potential denial of service (DoS). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/b7ed0d87-0be5-4526-9b21-ffe0d39c283e
CVE ID: CVE-2024-11046 State: PUBLISHED Published: 2024-11-10T03:00:10.737Z Last Updated: 2024-11-12T15:05:58.947Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: D-Link Products: DI-8003 Problem Types: CWE-78, CWE-77 Description: A vulnerability was found in D-Link DI-8003 16.07.16A1. It has been classified as critical. Affected is the function upgrade_filter_asp of the file /upgrade_filter.asp. The manipulation of the argument path leads to os command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.283632 - https://vuldb.
be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.283632 - https://vuldb.com/?ctiid.283632 - https://vuldb.com/?submit.434929 - https://github.com/theRaz0r/iot-mycve/blob/main/Dlink_DI8003_command_injection/DI8003_command_injection.md - https://www.dlink.com/
CVE ID: CVE-2024-11047 State: PUBLISHED Published: 2024-11-10T03:31:04.900Z Last Updated: 2024-11-12T15:46:48.981Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C) Vendors: D-Link Products: DI-8003 Problem Types: CWE-121, CWE-119 Description: A vulnerability was found in D-Link DI-8003 16.07.16A1. It has been declared as critical. Affected by this vulnerability is the function upgrade_filter_asp of the file /upgrade_filter.asp. The manipulation of the argument path leads to stack-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.28363
the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.283633 - https://vuldb.com/?ctiid.283633 - https://vuldb.com/?submit.434931 - https://github.com/theRaz0r/iot-mycve/blob/main/Dlink_DI8003_stackoverflow/Dlink_DI8003_stackoverflow.md - https://www.dlink.com/
CVE ID: CVE-2024-11048 State: PUBLISHED Published: 2024-11-10T04:00:10.367Z Last Updated: 2024-11-12T15:46:02.785Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C) Vendors: D-Link Products: DI-8003 Problem Types: CWE-121, CWE-119 Description: A vulnerability was found in D-Link DI-8003 16.07.16A1. It has been rated as critical. Affected by this issue is the function dbsrv_asp of the file /dbsrv.asp. The manipulation of the argument str leads to stack-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.283634 - https://vuldb.com/?ctiid.2
ditional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.283634 - https://vuldb.com/?ctiid.283634 - https://vuldb.com/?submit.434936 - https://github.com/theRaz0r/iot-mycve/blob/main/Dlink_DI8003_stackoverflow/Dlink-DI8003-stackoverflow-dbsrv.md - https://www.dlink.com/
CVE ID: CVE-2024-11049 State: PUBLISHED Published: 2024-11-10T05:31:04.017Z Last Updated: 2024-11-14T15:32:34.411Z Severity: LOW (CVSS 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: ZKTeco Products: ZKBio Time Problem Types: CWE-425 Description: A vulnerability classified as problematic has been found in ZKTeco ZKBio Time 9.0.1. Affected is an unknown function of the file /auth_files/photo/ of the component Image File Handler. The manipulation leads to direct request. It is possible to launch the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. The vendor was cont
xploitability is told to be difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.283662 - https://vuldb.com/?ctiid.283662 - https://vuldb.com/?submit.435034 - https://gist.githubusercontent.com/whiteman007/f7a85252fed91deff6eb3f20596710b0/raw/b7c8a7f53d3316cfd2da1cae9bcf583d923860b7/biotime%25209.0.1
CVE ID: CVE-2024-11050 State: PUBLISHED Published: 2024-11-10T07:00:17.242Z Last Updated: 2024-11-12T15:36:35.242Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: AMTT Products: Hotel Broadband Operation System Problem Types: CWE-79, CWE-94 Description: A vulnerability was found in AMTT Hotel Broadband Operation System up to 3.0.3.151204 and classified as problematic. This issue affects some unknown processing of the file /language.php. The manipulation of the argument LangID/LangName/LangEName leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but d
The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.283793 - https://vuldb.com/?ctiid.283793 - https://vuldb.com/?submit.432690 - https://wiki.shikangsi.com/post/share/ba791f6d-7f63-494f-bd73-827ed7f26e2e
CVE ID: CVE-2024-11051 State: PUBLISHED Published: 2024-11-10T07:31:06.746Z Last Updated: 2024-11-12T15:32:54.172Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: AMTT Products: Hotel Broadband Operation System Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in AMTT Hotel Broadband Operation System up to 3.0.3.151204. It has been classified as critical. Affected is an unknown function of the file /manager/frontdesk/online_status.php. The manipulation of the argument AccountID leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure
ely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.283794 - https://vuldb.com/?ctiid.283794 - https://vuldb.com/?submit.432691 - https://wiki.shikangsi.com/post/share/ab8e6804-5c8e-442b-8a37-c6b376bcc86f
CVE ID: CVE-2024-11052 State: PUBLISHED Published: 2024-12-12T05:24:24.004Z Last Updated: 2024-12-12T15:46:09.581Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) Vendors: kstover Products: Ninja Forms – The Contact Form Builder That Grows With You Problem Types: CWE-79 Description: The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the calculations parameter in all versions up to, and including, 3.8.19 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user
es it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/c3adf367-0126-4d95-b337-cc3581975113?source=cve - https://plugins.trac.wordpress.org/browser/ninja-forms/tags/3.8.18/includes/Admin/Metaboxes/Calculations.php#L26
CVE ID: CVE-2024-11053 State: PUBLISHED Published: 2024-12-11T07:34:29.539Z Last Updated: 2025-11-03T20:36:27.027Z Vendors: curl Products: curl Problem Types: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor Description: When asked to both use a `.netrc` file for credentials and to follow HTTP redirects, curl could leak the password used for the first host to the followed-to host under certain circumstances. This flaw only manifests itself if the netrc file has an entry that matches the redirect target hostname but the entry either omits just the password or omits both login and password. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References
or omits both login and password. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://curl.se/docs/CVE-2024-11053.json - https://curl.se/docs/CVE-2024-11053.html - https://hackerone.com/reports/2829063