Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-8914 State: PUBLISHED Published: 2024-09-24T06:40:56.964Z Last Updated: 2025-08-27T21:43:06.600Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) Vendors: haibasoft Products: Thanh Toán Quét Mã QR Code Tự Động – MoMo, ViettelPay, VNPay và 40 ngân hàng Việt Nam Problem Types: CWE-79 Description: The Thanh Toán Quét Mã QR Code Tự Động – MoMo, ViettelPay, VNPay và 40 ngân hàng Việt Nam plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 2.0.1 due to incorrect use of the wp_kses_allowed_html function, which allows the 'onclick' attribute for certain HTML elements without sufficient restriction or context v
tml function, which allows the 'onclick' attribute for certain HTML elements without sufficient restriction or context validation. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/8ef7c48b-e8f2-40bd-aa48-191059e15453?source=cve - https://wordpress.org/plugins/bck-tu-dong-xac-nhan-thanh-toan-chuyen-khoan-ngan-hang/#developers - https://plugins.trac.wordpress.org/browser/bck-tu-dong-xac-nhan-thanh-toan-chuyen-khoan-ngan-hang/trunk/inc/functions.php#L184
CVE ID: CVE-2024-8915 State: PUBLISHED Published: 2024-10-12T08:40:58.994Z Last Updated: 2024-10-14T15:03:12.814Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: pixelgrade Products: Category Icon Problem Types: CWE-79 Description: The Category Icon plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file. Additional Analyst Notes: - CISA ADP Vu
ry web scripts in pages that will execute whenever a user accesses the SVG file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/1dc4acdc-754f-4ee0-947d-ff0c277e8181?source=cve - https://wordpress.org/plugins/category-icon/#developers - https://plugins.trac.wordpress.org/browser/category-icon/trunk/category-icon.php#L437 - https://plugins.trac.wordpress.org/changeset/3167148/
CVE ID: CVE-2024-8916 State: PUBLISHED Published: 2024-10-18T04:32:50.604Z Last Updated: 2024-10-18T14:17:22.521Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: sukiwp Products: Suki Sites Import Problem Types: CWE-79 Description: The Suki Sites Import plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.2.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file. Additional Analyst Notes: - CISA AD
itrary web scripts in pages that will execute whenever a user accesses the SVG file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/1c6dd146-a99e-4317-a703-de34735317c8?source=cve - https://wordpress.org/plugins/suki-sites-import/
CVE ID: CVE-2024-8917 State: PUBLISHED Published: 2024-09-24T06:40:54.705Z Last Updated: 2024-09-24T13:39:33.550Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: anwppro Products: AnWP Football Leagues Problem Types: CWE-79 Description: The AnWP Football Leagues plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 0.16.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file. Additional Analyst Notes:
inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/29a160ea-5582-4028-8621-7988e3a8cabf?source=cve - https://plugins.trac.wordpress.org/browser/football-leagues-by-anwppro/trunk/class-anwp-football-leagues.php#L675 - https://wordpress.org/plugins/football-leagues-by-anwppro/#developers - https://plugins.trac.wordpress.org/changeset/3153845/football-leagues-by-anwppro/trunk/class-anwp-football-leagues.php - https://plugins.trac.wordpress.org/changeset/3153845/
CVE ID: CVE-2024-8918 State: PUBLISHED Published: 2024-10-16T06:43:23.102Z Last Updated: 2024-10-16T17:58:49.419Z Severity: HIGH (CVSS 7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N) Vendors: File Manager Products: File Manager Pro Problem Types: CWE-434 Description: The File Manager Pro plugin for WordPress is vulnerable to Limited JavaScript File Upload in all versions up to, and including, 8.3.9. This is due to a lack of proper checks on allowed file types. This makes it possible for unauthenticated attackers, with permissions granted by an administrator, to upload .css and .js files, which could lead to Stored Cross-Site Scripting. Additional Analyst Notes: - CISA ADP Vulnrichment: Ref
s and .js files, which could lead to Stored Cross-Site Scripting. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/01ef62c8-e862-422c-948d-6d376d021c82?source=cve - https://filemanagerpro.io/
CVE ID: CVE-2024-8919 State: PUBLISHED Published: 2024-09-24T06:40:55.926Z Last Updated: 2024-09-24T13:39:06.646Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: shakeelu Products: Confetti Fall Animation Problem Types: CWE-79 Description: The Confetti Fall Animation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'confetti-fall-animation' shortcode in all versions up to, and including, 1.3.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will exe
authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/5b80fc93-212e-481d-907c-275139782e77?source=cve - https://plugins.trac.wordpress.org/browser/confetti-fall-animation/trunk/confetti-fall-animation.php#L242
CVE ID: CVE-2024-8920 State: PUBLISHED Published: 2024-10-17T09:32:17.085Z Last Updated: 2024-10-17T18:20:00.300Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: vladolaru Products: Fonto – Custom Web Fonts Manager Problem Types: CWE-79 Description: The Fonto – Custom Web Fonts Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.2.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file. Ad
l access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/358be91d-cb00-429b-a4ed-69bf81e4d19e?source=cve - https://plugins.trac.wordpress.org/browser/fonto/trunk/includes/class-fonto.php#L373 - https://wordpress.org/plugins/fonto/#developers - https://plugins.trac.wordpress.org/changeset/3169936/ - https://plugins.trac.wordpress.org/changeset/3169936/#file2
CVE ID: CVE-2024-8921 State: PUBLISHED Published: 2024-10-16T11:03:11.641Z Last Updated: 2024-10-16T12:57:15.360Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: wpzita Products: Zita Elementor Site Library Problem Types: CWE-79 Description: The Zita Elementor Site Library plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.6.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file. Additional Anal
above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/cc1c76ee-078d-4c9a-a4d3-063d9147d7e8?source=cve - https://plugins.trac.wordpress.org/browser/zita-site-library/trunk/importer/wxr-importer.php#L160 - https://plugins.trac.wordpress.org/browser/zita-site-library/trunk/inc/importer.php#L148 - https://wordpress.org/plugins/zita-site-library/#developers - https://wpzita.com/changelog/ - https://plugins.trac.wordpress.org/changeset/3168327/
CVE ID: CVE-2024-8922 State: PUBLISHED Published: 2024-09-27T05:31:03.421Z Last Updated: 2024-09-27T15:16:26.953Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: rajeshsingh520 Products: Product Enquiry for WooCommerce, WooCommerce product catalog Problem Types: CWE-502 Description: The Product Enquiry for WooCommerce, WooCommerce product catalog plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.2.33.32 via deserialization of untrusted input in enquiry_detail.php. This makes it possible for authenticated attackers, with Author-level access and above, to inject a PHP Object. No known POP chain is present in the v
henticated attackers, with Author-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/9a485314-cd68-400c-b398-2f8529c6a3ab?source=cve - https://plugins.trac.wordpress.org/changeset/3155863/enquiry-quotation-for-woocommerce
CVE ID: CVE-2024-8923 State: PUBLISHED Published: 2024-10-29T16:07:07.310Z Last Updated: 2024-10-31T03:55:16.080Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: ServiceNow Products: Now Platform Problem Types: CWE-94 Description: ServiceNow has addressed an input validation vulnerability that was identified in the Now Platform. This vulnerability could enable an unauthenticated user to remotely execute code within the context of the Now Platform. ServiceNow deployed an update to hosted instances and ServiceNow provided the update to our partners and self-hosted customers. Further, the vulnerability is addressed in the listed patches and hot fixes. Additio
partners and self-hosted customers. Further, the vulnerability is addressed in the listed patches and hot fixes. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB1706070
CVE ID: CVE-2024-8924 State: PUBLISHED Published: 2024-10-29T16:14:38.836Z Last Updated: 2024-10-31T03:55:17.683Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: ServiceNow Products: Now Platform Problem Types: CWE-89 Description: ServiceNow has addressed a blind SQL injection vulnerability that was identified in the Now Platform. This vulnerability could enable an unauthenticated user to extract unauthorized information. ServiceNow deployed an update to hosted instances, and ServiceNow provided the update to our partners and self-hosted customers. Further, the vulnerability is addressed in the listed patches and hot fixes. Additional Analyst Notes: - CISA ADP
omers. Further, the vulnerability is addressed in the listed patches and hot fixes. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB1706072
CVE ID: CVE-2024-8925 State: PUBLISHED Published: 2024-10-08T03:35:02.673Z Last Updated: 2025-11-03T22:33:05.003Z Severity: LOW (CVSS 3.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: PHP Group Products: PHP Description: In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, erroneous parsing of multipart form data contained in an HTTP POST request could lead to legitimate data not being processed. This could lead to malicious attacker able to control part of the submitted data being able to exclude portion of other data, potentially leading to erroneous application behavior. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: Referenc
to erroneous application behavior. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/php/php-src/security/advisories/GHSA-9pqp-7h25-4f32
CVE ID: CVE-2024-8926 State: PUBLISHED Published: 2024-10-08T03:48:53.628Z Last Updated: 2025-11-03T22:33:06.473Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: PHP Group Products: PHP Problem Types: CWE-78 Description: In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, when using a certain non-standard configurations of Windows codepages, the fixes for CVE-2024-4577 https://github.com/advisories/GHSA-vxpp-6299-mxw3 may still be bypassed and the same command injection related to Windows "Best Fit" codepage behavior can be achieved. This may allow a malicious user to pass options to PHP binary being run, and thus reveal the source c
r can be achieved. This may allow a malicious user to pass options to PHP binary being run, and thus reveal the source code of scripts, run arbitrary PHP code on the server, etc. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/php/php-src/security/advisories/GHSA-p99j-rfp4-xqvq
CVE ID: CVE-2024-8927 State: PUBLISHED Published: 2024-10-08T03:56:31.849Z Last Updated: 2025-11-03T22:33:09.411Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: PHP Group Products: PHP Description: In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, HTTP_REDIRECT_STATUS variable is used to check whether or not CGI binary is being run by the HTTP server. However, in certain scenarios, the content of this variable can be controlled by the request submitter via HTTP headers, which can lead to cgi.force_redirect option not being correctly applied. In certain configurations this may lead to arbitrary file inclusion in PHP. Additional Ana
not being correctly applied. In certain configurations this may lead to arbitrary file inclusion in PHP. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/php/php-src/security/advisories/GHSA-94p6-54jq-9mwp
CVE ID: CVE-2024-8929 State: PUBLISHED Published: 2024-11-22T06:15:29.643Z Last Updated: 2025-11-03T22:33:10.858Z Severity: MEDIUM (CVSS 5.8 CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N) Vendors: PHP Group Products: PHP Problem Types: CWE-200, CWE-125 Description: In PHP versions 8.1.* before 8.1.31, 8.2.* before 8.2.26, 8.3.* before 8.3.14, a hostile MySQL server can cause the client to disclose the content of its heap containing data from other SQL requests and possible other data belonging to different users of the same server. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/php/php-src/security/advisories/GHSA-h35g-vwh6-m678
CVE ID: CVE-2024-8932 State: PUBLISHED Published: 2024-11-22T06:03:29.764Z Last Updated: 2025-11-03T22:33:12.327Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: PHP Group Products: PHP Problem Types: CWE-787 Description: In PHP versions 8.1.* before 8.1.31, 8.2.* before 8.2.26, 8.3.* before 8.3.14, uncontrolled long string inputs to ldap_escape() function on 32-bit systems can cause an integer overflow, resulting in an out-of-bounds write. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/php/php-src/security/advisories/GHSA-g665-fm4p-vhff
CVE ID: CVE-2024-8933 State: PUBLISHED Published: 2024-11-13T04:06:09.279Z Last Updated: 2024-11-13T15:34:19.535Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Schneider Electric Products: Modicon M340 CPU (part numbers BMXP34*), Modicon MC80 (part numbers BMKC80), Modicon Momentum Unity M1E Processor (171CBU*) Problem Types: CWE-924 Description: CWE-924: Improper Enforcement of Message Integrity During Transmission in a Communication Channel vulnerability exists that could cause retrieval of password hash that could lead to denial of service and loss of confidentiality and integrity of controllers. To be successful, the attacker needs to inject themself ins
ce and loss of confidentiality and integrity of controllers. To be successful, the attacker needs to inject themself inside the logical network while a valid user uploads or downloads a project file into the controller. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://download.schneider-electric.com/doc/SEVD-2024-317-02/SEVD-2024-317-02.pdf
CVE ID: CVE-2024-8934 State: PUBLISHED Published: 2024-10-31T12:44:44.638Z Last Updated: 2024-10-31T13:47:50.093Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H) Vendors: Beckhoff Products: TwinCAT Package Manager Problem Types: CWE-78 Description: A local user with administrative access rights can enter specialy crafted values for settings at the user interface (UI) of the TwinCAT Package Manager which then causes arbitrary OS commands to be executed. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert.vde.com/en/advisories/VDE-2024-064
CVE ID: CVE-2024-8935 State: PUBLISHED Published: 2024-11-13T04:10:09.599Z Last Updated: 2024-11-13T15:31:54.906Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Schneider Electric Products: Modicon M340 CPU (part numbers BMXP34*), Modicon MC80 (part numbers BMKC80), Modicon Momentum Unity M1E Processor (171CBU*) Problem Types: CWE-290 Description: CWE-290: Authentication Bypass by Spoofing vulnerability exists that could cause a denial of service and loss of confidentiality and integrity of controllers when conducting a Man-In-The-Middle attack between the controller and the engineering workstation while a valid user is establishing a communication session. T
ack between the controller and the engineering workstation while a valid user is establishing a communication session. This vulnerability is inherent to Diffie Hellman algorithm which does not protect against Man-In-The-Middle attacks. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://download.schneider-electric.com/doc/SEVD-2024-317-02/SEVD-2024-317-02.pdf
CVE ID: CVE-2024-8936 State: PUBLISHED Published: 2024-11-13T04:23:59.219Z Last Updated: 2024-11-13T15:21:25.836Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N) Vendors: Schneider Electric Products: Modicon M340 CPU (part numbers BMXP34*) Problem Types: CWE-20 Description: CWE-20: Improper Input Validation vulnerability exists that could lead to loss of confidentiality of controller memory after a successful Man-In-The-Middle attack followed by sending a crafted Modbus function call used to tamper with memory. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://download.schneider-electric.com/doc/SEVD-2024-317-03/SEVD-2024-317-03.pdf
CVE ID: CVE-2024-8937 State: PUBLISHED Published: 2024-11-13T04:17:30.614Z Last Updated: 2024-11-13T15:27:59.982Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N) Vendors: Schneider Electric Products: Modicon M340 CPU (part numbers BMXP34*), Modicon MC80 (part numbers BMKC80), Modicon Momentum Unity M1E Processor (171CBU*) Problem Types: CWE-119 Description: CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability exists that could cause a potential arbitrary code execution after a successful Man-In-The Middle attack followed by sending a crafted Modbus function call to tamper with memory area involved in the authentication proces
tack followed by sending a crafted Modbus function call to tamper with memory area involved in the authentication process. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://download.schneider-electric.com/doc/SEVD-2024-317-03/SEVD-2024-317-03.pdf
CVE ID: CVE-2024-8938 State: PUBLISHED Published: 2024-11-13T04:20:19.875Z Last Updated: 2024-11-13T15:26:23.491Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Schneider Electric Products: Modicon M340 CPU (part numbers BMXP34*), Modicon MC80 (part numbers BMKC80), Modicon Momentum Unity M1E Processor (171CBU*) Problem Types: CWE-119 Description: CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability exists that could cause a potential arbitrary code execution after a successful Man-In-The-Middle attack followed by sending a crafted Modbus function call to tamper with memory area involved in memory size computation. Ad
ck followed by sending a crafted Modbus function call to tamper with memory area involved in memory size computation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://download.schneider-electric.com/doc/SEVD-2024-317-03/SEVD-2024-317-03.pdf
CVE ID: CVE-2024-8939 State: PUBLISHED Published: 2024-09-17T16:21:15.222Z Last Updated: 2025-11-20T20:57:47.098Z Severity: MEDIUM (CVSS 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Red Hat Products: Red Hat Enterprise Linux AI (RHEL AI) Problem Types: CWE-400 Description: A vulnerability was found in the ilab model serve component, where improper handling of the best_of parameter in the vllm JSON web API can lead to a Denial of Service (DoS). The API used for LLM-based sentence or chat completion accepts a best_of parameter to return the best completion from several options. When this parameter is set to a large value, the API does not handle timeouts or resource exhaustion pr
several options. When this parameter is set to a large value, the API does not handle timeouts or resource exhaustion properly, allowing an attacker to cause a DoS by consuming excessive system resources. This leads to the API becoming unresponsive, preventing legitimate users from accessing the service. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://access.redhat.com/security/cve/CVE-2024-8939 - https://bugzilla.redhat.com/show_bug.cgi?id=2312782
CVE ID: CVE-2024-8940 State: PUBLISHED Published: 2024-09-24T11:48:36.160Z Last Updated: 2024-09-24T13:28:36.727Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: Scriptcase Products: Scriptcase Problem Types: CWE-434 Description: Vulnerability in the Scriptcase application version 9.4.019, which involves the arbitrary upload of a file via /scriptcase/devel/lib/third/jquery_plugin/jQuery-File-Upload/server/php/ via a POST request. An attacker could upload malicious files to the server due to the application not properly verifying user input. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/mu
. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-scriptcase