Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-11574 State: PUBLISHED Published: 2024-11-22T20:47:46.067Z Last Updated: 2024-11-22T21:45:52.481Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: IrfanView Products: IrfanView Problem Types: CWE-119 Description: IrfanView DXF File Parsing Memory Corruption Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of IrfanView. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of DXF files. The issue results from the lack of proper validation of us
le. The specific flaw exists within the parsing of DXF files. The issue results from the lack of proper validation of user-supplied data, which can result in a memory corruption condition. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24900. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-24-1573/
CVE ID: CVE-2024-11575 State: PUBLISHED Published: 2024-11-22T20:46:54.706Z Last Updated: 2024-11-22T21:45:52.617Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: IrfanView Products: IrfanView Problem Types: CWE-119 Description: IrfanView DXF File Parsing Memory Corruption Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of IrfanView. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of DXF files. The issue results from the lack of proper validation of us
le. The specific flaw exists within the parsing of DXF files. The issue results from the lack of proper validation of user-supplied data, which can result in a memory corruption condition. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24901. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-24-1569/
CVE ID: CVE-2024-11576 State: PUBLISHED Published: 2024-11-22T20:42:54.741Z Last Updated: 2024-12-04T21:42:58.512Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Luxion Products: KeyShot Problem Types: CWE-122 Description: Luxion KeyShot 3DS File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Luxion KeyShot. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of 3DS files. The issue results from the lack of proper va
a malicious file. The specific flaw exists within the parsing of 3DS files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-23681. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-24-1607/ - https://download.keyshot.com/cert/ksa-655925/ksa-655925.pdf?version=1.0&_gl=1*1vzfrlf*_gcl_au*MTIxNTA2Njg4MS4xNzMxNTMwMjIx
CVE ID: CVE-2024-11577 State: PUBLISHED Published: 2024-11-22T20:43:46.911Z Last Updated: 2024-12-04T21:42:46.254Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Luxion Products: KeyShot Problem Types: CWE-787 Description: Luxion KeyShot SKP File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Luxion KeyShot. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of SKP files. The issue results from the lack of proper validatio
ious file. The specific flaw exists within the parsing of SKP files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-23685. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-24-1608/ - https://download.keyshot.com/cert/ksa-655925/ksa-655925.pdf?version=1.0&_gl=1*1vzfrlf*_gcl_au*MTIxNTA2Njg4MS4xNzMxNTMwMjIx
CVE ID: CVE-2024-11578 State: PUBLISHED Published: 2024-11-22T20:43:54.601Z Last Updated: 2024-12-04T21:42:32.879Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Luxion Products: KeyShot Problem Types: CWE-121 Description: Luxion KeyShot 3DS File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Luxion KeyShot. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of 3DS files. The issue results from the lack of proper v
a malicious file. The specific flaw exists within the parsing of 3DS files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-23693. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-24-1609/ - https://download.keyshot.com/cert/ksa-655925/ksa-655925.pdf?version=1.0&_gl=1*1vzfrlf*_gcl_au*MTIxNTA2Njg4MS4xNzMxNTMwMjIx
CVE ID: CVE-2024-11579 State: PUBLISHED Published: 2024-11-22T20:43:58.801Z Last Updated: 2024-12-04T21:42:19.285Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Luxion Products: KeyShot Problem Types: CWE-787 Description: Luxion KeyShot OBJ File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Luxion KeyShot. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of obj files. The issue results from the lack of proper validatio
ious file. The specific flaw exists within the parsing of obj files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-23697. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-24-1610/ - https://download.keyshot.com/cert/ksa-655925/ksa-655925.pdf?version=1.0&_gl=1*1vzfrlf*_gcl_au*MTIxNTA2Njg4MS4xNzMxNTMwMjIx
CVE ID: CVE-2024-11580 State: PUBLISHED Published: 2024-11-22T20:44:02.641Z Last Updated: 2024-12-04T21:42:06.953Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Luxion Products: KeyShot Problem Types: CWE-122 Description: Luxion KeyShot ABC File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Luxion KeyShot. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of abc files. The issue results from the lack of proper va
a malicious file. The specific flaw exists within the parsing of abc files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-23700. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-24-1611/ - https://download.keyshot.com/cert/ksa-655925/ksa-655925.pdf?version=1.0&_gl=1*1vzfrlf*_gcl_au*MTIxNTA2Njg4MS4xNzMxNTMwMjIx
CVE ID: CVE-2024-11581 State: PUBLISHED Published: 2024-11-22T20:44:07.235Z Last Updated: 2024-12-04T21:32:46.182Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Luxion Products: KeyShot Problem Types: CWE-125 Description: Luxion KeyShot JT File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Luxion KeyShot. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of jt files. The issue results from the lack of proper validation o
us file. The specific flaw exists within the parsing of jt files. The issue results from the lack of proper validation of user-supplied data, which can result in a read before the start of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-23826. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-24-1612/ - https://download.keyshot.com/cert/ksa-655925/ksa-655925.pdf?version=1.0&_gl=1*1vzfrlf*_gcl_au*MTIxNTA2Njg4MS4xNzMxNTMwMjIx
CVE ID: CVE-2024-11582 State: PUBLISHED Published: 2025-02-19T03:21:11.532Z Last Updated: 2025-02-19T14:58:22.696Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) Vendors: wedevs Products: Subscribe2 – Form, Email Subscribers & Newsletters Problem Types: CWE-79 Description: The Subscribe2 – Form, Email Subscribers & Newsletters plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ip parameter in all versions up to, and including, 10.43 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. A
icated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/36777e39-be45-41f2-beca-2971e15b77cd?source=cve - https://plugins.trac.wordpress.org/browser/subscribe2/tags/10.43/classes/class-s2-list-table.php#L72
CVE ID: CVE-2024-11583 State: PUBLISHED Published: 2025-01-30T13:41:55.042Z Last Updated: 2025-01-30T14:54:40.574Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: visualmodo Products: Borderless – Widgets, Elements, Templates and Toolkit for Elementor & Gutenberg Problem Types: CWE-862 Description: The Borderless – Widgets, Elements, Templates and Toolkit for Elementor & Gutenberg plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'remove_zipped_font' function in all versions up to, and including, 1.5.9. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete
including, 1.5.9. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete icon fonts that were previously uploaded. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/0968fe3b-2256-41e8-8cc9-e800dd7f8c27?source=cve - https://plugins.trac.wordpress.org/browser/borderless/tags/1.5.7/includes/icon-manager/icon-manager.php#L270
CVE ID: CVE-2024-11584 State: PUBLISHED Published: 2025-06-26T09:25:20.199Z Last Updated: 2025-06-26T19:14:46.084Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: Canonical Products: cloud-init Description: cloud-init through 25.1.2 includes the systemd socket unit cloud-init-hotplugd.socket with default SocketMode that grants 0666 permissions, making it world-writable. This is used for the "/run/cloud-init/hook-hotplug-cmd" FIFO. An unprivileged user could trigger hotplug-hook commands. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/canonical/cloud-init/pull/6265/commits/6e10240a7f0a2d6110b398640b3fd46cfa9a7cf3 - https:/
ferences: - https://github.com/canonical/cloud-init/pull/6265/commits/6e10240a7f0a2d6110b398640b3fd46cfa9a7cf3 - https://github.com/canonical/cloud-init/releases/tag/25.1.3
CVE ID: CVE-2024-11585 State: PUBLISHED Published: 2024-12-06T05:26:15.076Z Last Updated: 2024-12-06T16:10:30.516Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) Vendors: nsp-code Products: WP Hide & Security Enhancer Problem Types: CWE-22 Description: The WP Hide & Security Enhancer plugin for WordPress is vulnerable to arbitrary file contents deletion due to a missing authorization and insufficient file path validation in the file-process.php in all versions up to, and including, 2.5.1. This makes it possible for unauthenticated attackers to delete the contents of arbitrary files on the server, which can break the site or lead to data loss. Additional Analyst Notes:
the contents of arbitrary files on the server, which can break the site or lead to data loss. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/43c7056e-39d8-467e-92ec-33a31e5dafc9?source=cve - https://plugins.trac.wordpress.org/browser/wp-hide-security-enhancer/tags/2.5.1/router/file-process.php#L43
CVE ID: CVE-2024-11586 State: PUBLISHED Published: 2024-11-23T02:05:58.503Z Last Updated: 2024-11-25T17:32:23.158Z Severity: MEDIUM (CVSS 4 CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:N/I:N/A:H) Vendors: Canonical Ltd. Products: Ubuntu's pulseaudio Description: Ubuntu's implementation of pulseaudio can be crashed by a malicious program if a bluetooth headset is connected. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://bugs.launchpad.net/ubuntu/+source/pulseaudio/+bug/2078822 - https://www.cve.org/CVERecord?id=CVE-2024-11586
CVE ID: CVE-2024-11587 State: PUBLISHED Published: 2024-11-21T12:31:04.263Z Last Updated: 2024-11-21T14:36:23.632Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: n/a Products: idcCMS Problem Types: CWE-79, CWE-94 Description: A vulnerability was found in idcCMS 1.60. It has been classified as problematic. This affects the function GetCityOptionJs of the file /inc/classProvCity.php. The manipulation of the argument idName leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.285657 - https://vuldb.com/?ctiid.2
ditional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.285657 - https://vuldb.com/?ctiid.285657 - https://vuldb.com/?submit.442071 - https://github.com/Hebing123/cve/issues/75
CVE ID: CVE-2024-11588 State: PUBLISHED Published: 2024-11-21T12:31:05.812Z Last Updated: 2024-11-21T14:33:35.454Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: AVL-DiTEST-DiagDev Products: libdoip Problem Types: CWE-476, CWE-404 Description: A vulnerability was found in AVL-DiTEST-DiagDev libdoip 1.0.0. It has been rated as problematic. This issue affects the function DoIPConnection::reactOnReceivedTcpMessage of the file DoIPConnection.cpp. The manipulation leads to null pointer dereference. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.285659 - https://vuldb.com/?ctiid.285659 - https://vuldb.com/?submit.443175 - http
: References: - https://vuldb.com/?id.285659 - https://vuldb.com/?ctiid.285659 - https://vuldb.com/?submit.443175 - https://github.com/AVL-DiTEST-DiagDev/libdoip/issues/11
CVE ID: CVE-2024-11589 State: PUBLISHED Published: 2024-11-21T13:00:14.921Z Last Updated: 2024-11-21T14:30:53.795Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: itsourcecode Products: Tailoring Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability classified as critical was found in itsourcecode Tailoring Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /expcatedit.php. The manipulation of the argument id leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?i
sed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.285661 - https://vuldb.com/?ctiid.285661 - https://vuldb.com/?submit.445506 - https://github.com/kevin27392/cve/issues/1 - https://itsourcecode.com/
CVE ID: CVE-2024-11590 State: PUBLISHED Published: 2024-11-21T13:00:16.669Z Last Updated: 2024-11-21T14:28:55.543Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: 1000 Projects Products: Bookstore Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability, which was classified as critical, has been found in 1000 Projects Bookstore Management System 1.0. Affected by this issue is some unknown functionality of the file /forget_password_process.php. The manipulation of the argument unm leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: Referen
The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.285662 - https://vuldb.com/?ctiid.285662 - https://vuldb.com/?submit.445580 - https://github.com/1ighttack/CVE/issues/1 - https://1000projects.org/
CVE ID: CVE-2024-11591 State: PUBLISHED Published: 2024-11-21T14:00:08.044Z Last Updated: 2024-11-21T14:13:59.736Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: 1000 Projects Products: Beauty Parlour Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability, which was classified as critical, was found in 1000 Projects Beauty Parlour Management System 1.0. This affects an unknown part of the file /admin/add-services.php. The manipulation of the argument sername leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - ht
it has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.285663 - https://vuldb.com/?ctiid.285663 - https://vuldb.com/?submit.445718 - https://github.com/Hacker0xone/CVE/issues/14 - https://1000projects.org/
CVE ID: CVE-2024-11592 State: PUBLISHED Published: 2024-11-21T14:31:03.786Z Last Updated: 2024-11-22T15:38:19.490Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: 1000 Projects Products: Beauty Parlour Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability has been found in 1000 Projects Beauty Parlour Management System 1.0 and classified as critical. This vulnerability affects unknown code of the file /admin/about-us.php. The manipulation of the argument pagetitle leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https:
as been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.285664 - https://vuldb.com/?ctiid.285664 - https://vuldb.com/?submit.445719 - https://github.com/Hacker0xone/CVE/issues/15 - https://1000projects.org/
CVE ID: CVE-2024-11595 State: PUBLISHED Published: 2024-11-21T09:30:54.899Z Last Updated: 2024-11-22T15:16:02.829Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Wireshark Foundation Products: Wireshark Problem Types: CWE-835 Description: FiveCo RAP dissector infinite loop in Wireshark 4.4.0 to 4.4.1 and 4.2.0 to 4.2.8 allows denial of service via packet injection or crafted capture file Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wireshark.org/security/wnpa-sec-2024-14.html - https://gitlab.com/wireshark/wireshark/-/issues/20176
CVE ID: CVE-2024-11596 State: PUBLISHED Published: 2024-11-21T09:30:59.843Z Last Updated: 2024-11-22T15:41:11.586Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Wireshark Foundation Products: Wireshark Problem Types: CWE-126 Description: ECMP dissector crash in Wireshark 4.4.0 to 4.4.1 and 4.2.0 to 4.2.8 allows denial of service via packet injection or crafted capture file Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wireshark.org/security/wnpa-sec-2024-15.html - https://gitlab.com/wireshark/wireshark/-/issues/20214
CVE ID: CVE-2024-11597 State: PUBLISHED Published: 2024-12-11T16:49:05.360Z Last Updated: 2024-12-11T16:59:06.904Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Ivanti Products: Performance Manager Problem Types: CWE-276 Description: Under specific circumstances, insecure permissions in Ivanti Performance Manager before version 2024.3 HF1, 2024.1 HF1, or 2023.3 HF1 allows a local authenticated attacker to achieve local privilege escalation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://forums.ivanti.com/s/article/December-2024-Security-Advisory-Ivanti-Performance-Manager-CVE-2024-11597
CVE ID: CVE-2024-11598 State: PUBLISHED Published: 2024-12-11T16:50:14.346Z Last Updated: 2024-12-19T04:55:28.732Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Ivanti Products: Application Control Problem Types: CWE-276 Description: Under specific circumstances, insecure permissions in Ivanti Application Control before version 2024.3 HF1, 2024.1 HF2, or 2023.3 HF3 allows a local authenticated attacker to achieve local privilege escalation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://forums.ivanti.com/s/article/December-2024-Security-Advisory-Ivanti-Application-Control-CVE-2024-11598
CVE ID: CVE-2024-11599 State: PUBLISHED Published: 2024-11-28T09:42:48.141Z Last Updated: 2024-11-29T19:55:00.509Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N) Vendors: Mattermost Products: Mattermost Problem Types: CWE-754 Description: Mattermost versions 10.0.x <= 10.0.1, 10.1.x <= 10.1.1, 9.11.x <= 9.11.3, 9.5.x <= 9.5.11 fail to properly validate email addresses which allows an unauthenticated user to bypass email domain restrictions via carefully crafted input on email registration. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://mattermost.com/security-updates
CVE ID: CVE-2024-11600 State: PUBLISHED Published: 2025-01-30T13:41:59.249Z Last Updated: 2025-01-30T14:41:53.305Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: visualmodo Products: Borderless – Widgets, Elements, Templates and Toolkit for Elementor & Gutenberg Problem Types: CWE-94 Description: The Borderless – Widgets, Elements, Templates and Toolkit for Elementor & Gutenberg plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.5.9 via the 'write_config' function. This is due to a lack of sanitization on an imported JSON file. This makes it possible for authenticated attackers, with Administrator-level access