Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-0744 State: PUBLISHED Published: 2024-01-23T13:48:20.751Z Last Updated: 2024-09-10T19:57:53.602Z Vendors: Mozilla Products: Firefox Problem Types: Wild pointer dereference in JavaScript Description: In some circumstances, JIT compiled code could have dereferenced a wild pointer value. This could have led to an exploitable crash. This vulnerability affects Firefox < 122. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1871089 - https://www.mozilla.org/security/advisories/mfsa2024-01/
CVE ID: CVE-2024-0745 State: PUBLISHED Published: 2024-01-23T13:48:21.297Z Last Updated: 2024-08-29T14:17:07.214Z Vendors: Mozilla Products: Firefox Problem Types: Stack buffer overflow in WebAudio Description: The WebAudio `OscillatorNode` object was susceptible to a stack buffer overflow. This could have led to a potentially exploitable crash. This vulnerability affects Firefox < 122. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1871838 - https://www.mozilla.org/security/advisories/mfsa2024-01/
CVE ID: CVE-2024-0746 State: PUBLISHED Published: 2024-01-23T13:48:16.400Z Last Updated: 2025-06-20T19:02:12.969Z Vendors: Mozilla Products: Firefox, Firefox ESR, Thunderbird Problem Types: Crash when listing printers on Linux Description: A Linux user opening the print preview dialog could have caused the browser to crash. This vulnerability affects Firefox < 122, Firefox ESR < 115.7, and Thunderbird < 115.7. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1660223 - https://www.mozilla.org/security/advisories/mfsa2024-01/ - https://www.mozilla.org/security/advisories/mfsa2024-02/ - https://www.mozilla.org
rg/security/advisories/mfsa2024-01/ - https://www.mozilla.org/security/advisories/mfsa2024-02/ - https://www.mozilla.org/security/advisories/mfsa2024-04/ - https://lists.debian.org/debian-lts-announce/2024/01/msg00015.html - https://lists.debian.org/debian-lts-announce/2024/01/msg00022.html
CVE ID: CVE-2024-0747 State: PUBLISHED Published: 2024-01-23T13:48:16.960Z Last Updated: 2025-05-22T17:40:22.592Z Vendors: Mozilla Products: Firefox, Firefox ESR, Thunderbird Problem Types: Bypass of Content Security Policy when directive unsafe-inline was set Description: When a parent page loaded a child in an iframe with `unsafe-inline`, the parent Content Security Policy could have overridden the child Content Security Policy. This vulnerability affects Firefox < 122, Firefox ESR < 115.7, and Thunderbird < 115.7. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1764343 - https://www.mozilla.org/security
ADP Vulnrichment: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1764343 - https://www.mozilla.org/security/advisories/mfsa2024-01/ - https://www.mozilla.org/security/advisories/mfsa2024-02/ - https://www.mozilla.org/security/advisories/mfsa2024-04/ - https://lists.debian.org/debian-lts-announce/2024/01/msg00015.html - https://lists.debian.org/debian-lts-announce/2024/01/msg00022.html
CVE ID: CVE-2024-0748 State: PUBLISHED Published: 2024-01-23T13:48:21.814Z Last Updated: 2025-06-11T15:15:11.112Z Vendors: Mozilla Products: Firefox Problem Types: Compromised content process could modify document URI Description: A compromised content process could have updated the document URI. This could have allowed an attacker to set an arbitrary URI in the address bar or history. This vulnerability affects Firefox < 122. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1783504 - https://www.mozilla.org/security/advisories/mfsa2024-01/
CVE ID: CVE-2024-0749 State: PUBLISHED Published: 2024-01-23T13:48:17.500Z Last Updated: 2025-05-22T17:32:22.221Z Vendors: Mozilla Products: Firefox, Thunderbird Problem Types: Phishing site popup could show local origin in address bar Description: A phishing site could have repurposed an `about:` dialog to show phishing content with an incorrect origin in the address bar. This vulnerability affects Firefox < 122 and Thunderbird < 115.7. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1813463 - https://lists.debian.org/debian-lts-announce/2024/01/msg00015.html - https://lists.debian.org/debian-lts-announce
3463 - https://lists.debian.org/debian-lts-announce/2024/01/msg00015.html - https://lists.debian.org/debian-lts-announce/2024/01/msg00022.html - https://www.mozilla.org/security/advisories/mfsa2024-01/ - https://www.mozilla.org/security/advisories/mfsa2024-04/
CVE ID: CVE-2024-0750 State: PUBLISHED Published: 2024-01-23T13:48:18.029Z Last Updated: 2025-06-20T19:03:15.204Z Vendors: Mozilla Products: Firefox, Firefox ESR, Thunderbird Problem Types: Potential permissions request bypass via clickjacking Description: A bug in popup notifications delay calculation could have made it possible for an attacker to trick a user into granting permissions. This vulnerability affects Firefox < 122, Firefox ESR < 115.7, and Thunderbird < 115.7. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1863083 - https://www.mozilla.org/security/advisories/mfsa2024-01/ - https://www.mozil
zilla.mozilla.org/show_bug.cgi?id=1863083 - https://www.mozilla.org/security/advisories/mfsa2024-01/ - https://www.mozilla.org/security/advisories/mfsa2024-02/ - https://www.mozilla.org/security/advisories/mfsa2024-04/ - https://lists.debian.org/debian-lts-announce/2024/01/msg00015.html - https://lists.debian.org/debian-lts-announce/2024/01/msg00022.html
CVE ID: CVE-2024-0751 State: PUBLISHED Published: 2024-01-23T13:48:18.580Z Last Updated: 2025-06-20T19:03:57.280Z Vendors: Mozilla Products: Firefox, Firefox ESR, Thunderbird Problem Types: Privilege escalation through devtools Description: A malicious devtools extension could have been used to escalate privileges. This vulnerability affects Firefox < 122, Firefox ESR < 115.7, and Thunderbird < 115.7. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1865689 - https://www.mozilla.org/security/advisories/mfsa2024-01/ - https://www.mozilla.org/security/advisories/mfsa2024-02/ - https://www.mozilla.org/security
ty/advisories/mfsa2024-01/ - https://www.mozilla.org/security/advisories/mfsa2024-02/ - https://www.mozilla.org/security/advisories/mfsa2024-04/ - https://lists.debian.org/debian-lts-announce/2024/01/msg00015.html - https://lists.debian.org/debian-lts-announce/2024/01/msg00022.html
CVE ID: CVE-2024-0752 State: PUBLISHED Published: 2024-01-23T13:48:22.310Z Last Updated: 2025-06-20T19:04:39.738Z Vendors: Mozilla Products: Firefox Problem Types: Use-after-free could occur when applying update on macOS Description: A use-after-free crash could have occurred on macOS if a Firefox update were being applied on a very busy system. This could have resulted in an exploitable crash. This vulnerability affects Firefox < 122. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1866840 - https://www.mozilla.org/security/advisories/mfsa2024-01/
CVE ID: CVE-2024-0753 State: PUBLISHED Published: 2024-01-23T13:48:19.157Z Last Updated: 2025-06-07T20:20:27.558Z Vendors: Mozilla Products: Firefox, Firefox ESR, Thunderbird Problem Types: HSTS policy on subdomain could bypass policy of upper domain Description: In specific HSTS configurations an attacker could have bypassed HSTS on a subdomain. This vulnerability affects Firefox < 122, Firefox ESR < 115.7, and Thunderbird < 115.7. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1870262 - https://www.mozilla.org/security/advisories/mfsa2024-01/ - https://www.mozilla.org/security/advisories/mfsa2024-02/ -
- https://www.mozilla.org/security/advisories/mfsa2024-01/ - https://www.mozilla.org/security/advisories/mfsa2024-02/ - https://www.mozilla.org/security/advisories/mfsa2024-04/ - https://lists.debian.org/debian-lts-announce/2024/01/msg00015.html - https://lists.debian.org/debian-lts-announce/2024/01/msg00022.html
CVE ID: CVE-2024-0754 State: PUBLISHED Published: 2024-01-23T13:48:22.822Z Last Updated: 2025-05-22T17:38:48.920Z Vendors: Mozilla Products: Firefox Problem Types: Crash when using some WASM files in devtools Description: Some WASM source files could have caused a crash when loaded in devtools. This vulnerability affects Firefox < 122. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1871605 - https://www.mozilla.org/security/advisories/mfsa2024-01/
CVE ID: CVE-2024-0755 State: PUBLISHED Published: 2024-01-23T13:48:19.684Z Last Updated: 2025-05-22T17:36:55.681Z Vendors: Mozilla Products: Firefox, Firefox ESR, Thunderbird Problem Types: Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7, and Thunderbird 115.7 Description: Memory safety bugs present in Firefox 121, Firefox ESR 115.6, and Thunderbird 115.6. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 122, Firefox ESR < 115.7, and Thunderbird < 115.7. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: Referenc
R < 115.7, and Thunderbird < 115.7. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://bugzilla.mozilla.org/buglist.cgi?bug_id=1868456%2C1871445%2C1873701 - https://www.mozilla.org/security/advisories/mfsa2024-01/ - https://www.mozilla.org/security/advisories/mfsa2024-02/ - https://www.mozilla.org/security/advisories/mfsa2024-04/ - https://lists.debian.org/debian-lts-announce/2024/01/msg00015.html - https://lists.debian.org/debian-lts-announce/2024/01/msg00022.html
CVE ID: CVE-2024-0756 State: PUBLISHED Published: 2024-06-04T14:28:07.852Z Last Updated: 2025-03-13T18:10:14.952Z Vendors: Unknown Products: Insert or Embed Articulate Content into WordPress Problem Types: CWE-345 Insufficient Verification of Data Authenticity Description: The Insert or Embed Articulate Content into WordPress plugin through 4.3000000023 lacks validation of URLs when adding iframes, allowing attackers to inject an iFrame in the page and thus load arbitrary content from any page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://wpscan.com/vulnerability/9130a42d-fca3-4f9c-ab97-d5e0a7a5cef2/
CVE ID: CVE-2024-0757 State: PUBLISHED Published: 2024-06-04T06:00:02.008Z Last Updated: 2025-03-27T21:04:01.050Z Vendors: Unknown Products: Insert or Embed Articulate Content into WordPress Problem Types: CWE-94 Improper Control of Generation of Code ('Code Injection') Description: The Insert or Embed Articulate Content into WordPress plugin through 4.3000000023 is not properly filtering which file extensions are allowed to be imported on the server, allowing the uploading of malicious code within zip files Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://wpscan.com/vulnerability/eccd017c-e442-46b6-b5e6-aec7bbd5f836/
CVE ID: CVE-2024-0758 State: PUBLISHED Published: 2024-01-19T20:19:40.558Z Last Updated: 2025-05-30T14:25:23.193Z Problem Types: CWE-79 Description: MolecularFaces before 0.3.0 is vulnerable to cross site scripting. A remote attacker can execute arbitrary JavaScript in the context of a victim browser via crafted molfiles. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/ipb-halle/MolecularFaces/security/advisories/GHSA-2pwh-52h7-7j84 - https://github.com/advisories/GHSA-2pwh-52h7-7j84 - https://vulncheck.com/advisories/vc-advisory-GHSA-2pwh-52h7-7j84
CVE ID: CVE-2024-0759 State: PUBLISHED Published: 2024-02-27T05:12:38.318Z Last Updated: 2024-08-11T14:28:00.394Z Severity: HIGH (CVSS 7.7 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) Vendors: mintplex-labs Products: mintplex-labs/anything-llm Problem Types: CWE-918 Description: Should an instance of AnythingLLM be hosted on an internal network and the attacked be explicitly granted a permission level of manager or admin, they could link-scrape internally resolving IPs of other services that are on the same network as AnythingLLM. This would require the attacker also be able to guess these internal IPs as `/*` ranging is not possible, but could be brute forced. There is a duty of care that
le to guess these internal IPs as `/*` ranging is not possible, but could be brute forced. There is a duty of care that other services on the same network would not be fully open and accessible via a simple CuRL with zero authentication as it is not possible to set headers or access via the link collector. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/9a978edd-ac94-41fc-8e3e-c35441bdd12b - https://github.com/mintplex-labs/anything-llm/commit/0db6c3b2aa1787a7054ffdaba975474f122c20eb
CVE ID: CVE-2024-0760 State: PUBLISHED Published: 2024-07-23T14:26:54.983Z Last Updated: 2025-02-13T17:27:19.172Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: ISC Products: BIND 9 Description: A malicious client can send many DNS messages over TCP, potentially causing the server to become unstable while the attack is in progress. The server may recover after the attack ceases. Use of ACLs will not mitigate the attack. This issue affects BIND 9 versions 9.18.1 through 9.18.27, 9.19.0 through 9.19.24, and 9.18.11-S1 through 9.18.27-S1. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://kb.isc.org/docs/cve-2024-07
ional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://kb.isc.org/docs/cve-2024-0760 - http://www.openwall.com/lists/oss-security/2024/07/23/1 - http://www.openwall.com/lists/oss-security/2024/07/31/2
CVE ID: CVE-2024-0761 State: PUBLISHED Published: 2024-02-05T21:21:34.656Z Last Updated: 2025-06-17T21:29:25.417Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: mndpsingh287 Products: File Manager Problem Types: CWE-330 Use of Insufficiently Random Values Description: The File Manager plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 7.2.1 due to insufficient randomness in the backup filenames, which use a timestamp plus 4 random digits. This makes it possible for unauthenticated attackers, to extract sensitive data including site backups in configurations where the .htaccess file in the directory does
kers, to extract sensitive data including site backups in configurations where the .htaccess file in the directory does not block access. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/1928f8e4-8bbe-4a3f-8284-aa12ca2f5176?source=cve - https://wordpress.org/plugins/wp-file-manager/ - https://plugins.trac.wordpress.org/changeset/3023403/wp-file-manager/trunk/file_folder_manager.php?old=2984933&old_path=wp-file-manager%2Ftrunk%2Ffile_folder_manager.php
CVE ID: CVE-2024-0762 State: PUBLISHED Published: 2024-05-14T14:56:25.578Z Last Updated: 2025-07-28T20:53:10.827Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: Phoenix Products: SecureCore™ for Intel Kaby Lake, SecureCore™ for Intel Coffee Lake, SecureCore™ for Intel Ice Lake, SecureCore™ for Intel Comet Lake, SecureCore™ for Intel Tiger Lake, SecureCore™ for Intel Jasper Lake, SecureCore™ for Intel Alder Lake, SecureCore™ for Intel Raptor Lake, SecureCore™ for Intel Meteor Lake Description: Potential buffer overflow in unsafe UEFI variable handling in Phoenix SecureCore™ for select Intel platforms This issue affects: Phoenix SecureCore™ for Intel Kaby Lake:
handling in Phoenix SecureCore™ for select Intel platforms This issue affects: Phoenix SecureCore™ for Intel Kaby Lake: from 4.0.1.1 before 4.0.1.998; Phoenix SecureCore™ for Intel Coffee Lake: from 4.1.0.1 before 4.1.0.562; Phoenix SecureCore™ for Intel Ice Lake: from 4.2.0.1 before 4.2.0.323; Phoenix SecureCore™ for Intel Comet Lake: from 4.2.1.1 before 4.2.1.287; Phoenix SecureCore™ for Intel Tiger Lake: from 4.3.0.1 before 4.3.0.236; Phoenix SecureCore™ for Intel Jasper Lake: from 4.3.1.1 before 4.3.1.184; Phoenix SecureCore™ for Intel Alder Lake: from 4.4.0.1 before 4.4.0.269; Phoenix SecureCore™ for Intel Raptor Lake: from 4.5.0.1 before 4.5.0.218; Phoenix SecureCore™ for Intel Meteor
.4.0.269; Phoenix SecureCore™ for Intel Raptor Lake: from 4.5.0.1 before 4.5.0.218; Phoenix SecureCore™ for Intel Meteor Lake: from 4.5.1.1 before 4.5.1.15. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://phoenixtech.com/phoenix-security-notifications/CVE-2024-0762/ - https://eclypsium.com/blog/ueficanhazbufferoverflow-widespread-impact-from-vulnerability-in-popular-pc-and-server-firmware/ - https://news.ycombinator.com/item?id=40747852
CVE ID: CVE-2024-0763 State: PUBLISHED Published: 2024-02-27T21:14:56.552Z Last Updated: 2025-04-22T16:00:34.125Z Severity: HIGH (CVSS 8.1 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H) Vendors: mintplex-labs Products: mintplex-labs/anything-llm Problem Types: CWE-22 Description: Any user can delete an arbitrary folder (recursively) on a remote server due to bad input sanitization leading to path traversal. The attacker would need access to the server at some privilege level since this endpoint is protected and requires authorization. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://huntr.com/bounties/25a2f487-5a9c-4c7f-a2d3-b0527db73ea5 - http
nrichment: - CVE Program Container: References: - https://huntr.com/bounties/25a2f487-5a9c-4c7f-a2d3-b0527db73ea5 - https://github.com/mintplex-labs/anything-llm/commit/8a7324d0e77a15186e1ad5e5119fca4fb224c39c
CVE ID: CVE-2024-0765 State: PUBLISHED Published: 2024-03-03T14:13:41.067Z Last Updated: 2024-08-16T19:20:10.865Z Severity: CRITICAL (CVSS 9.6 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N) Vendors: mintplex-labs Products: mintplex-labs/anything-llm Problem Types: CWE-200 Description: As a default user on a multi-user instance of AnythingLLM, you could execute a call to the `/export-data` endpoint of the system and then unzip and read that export that would enable you do exfiltrate data of the system at that save state. This would require the attacked to be granted explicit access to the system, but they can do this at any role. Additionally, post-download, the data is deleted so no evidence
access to the system, but they can do this at any role. Additionally, post-download, the data is deleted so no evidence would exist that the exfiltration occured. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/8978ab27-710c-44ce-bfd8-a2ea416dc786 - https://github.com/mintplex-labs/anything-llm/commit/08d33cfd8fc47c5052b6ea29597c964a9da641e2
CVE ID: CVE-2024-0766 State: PUBLISHED Published: 2024-02-28T08:33:11.015Z Last Updated: 2024-08-08T18:47:21.137Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: envothemes Products: Envo&#039;s Elementor Templates & Widgets for WooCommerce Problem Types: CWE-284 Improper Access Control Description: The Envo's Elementor Templates & Widgets for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the templates_ajax_request function in all versions up to, and including, 1.4.4. This makes it possible for subscribers and higher to create templates. Additional Analyst Notes: - CVE Program Contain
. This makes it possible for subscribers and higher to create templates. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/996c7433-dd82-4216-86b9-005f43c06c3a?source=cve - https://plugins.trac.wordpress.org/browser/envo-elementor-for-woocommerce/trunk/includes/admin/include/template-library.php
CVE ID: CVE-2024-0767 State: PUBLISHED Published: 2024-02-28T08:33:13.010Z Last Updated: 2024-08-01T18:18:18.686Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: envothemes Products: Envo&#039;s Elementor Templates & Widgets for WooCommerce Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The Envo's Elementor Templates & Widgets for WooCommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.4.4. This is due to missing or incorrect nonce validation on the ajax_plugin_activation function. This makes it possible for unauthenticated attackers to activate arbitrary installed plugins via a
activation function. This makes it possible for unauthenticated attackers to activate arbitrary installed plugins via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/cca71257-05dc-43d5-8de6-faf0a2feab2e?source=cve - https://plugins.trac.wordpress.org/browser/envo-elementor-for-woocommerce/trunk/includes/admin/include/template-library.php#L332
CVE ID: CVE-2024-0768 State: PUBLISHED Published: 2024-02-28T08:33:08.602Z Last Updated: 2024-08-01T18:18:18.745Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: envothemes Products: Envo&#039;s Elementor Templates & Widgets for WooCommerce Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The Envo's Elementor Templates & Widgets for WooCommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to and including 1.4.4. This is due to missing or incorrect nonce validation on the ajax_theme_activation function. This makes it possible for unauthenticated attackers to activate arbitrary installed themes via a forg
ivation function. This makes it possible for unauthenticated attackers to activate arbitrary installed themes via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/6504ae5c-a36d-495e-aa93-40a3753857c6?source=cve - https://plugins.trac.wordpress.org/browser/envo-elementor-for-woocommerce/trunk/includes/admin/include/template-library.php#L367
CVE ID: CVE-2024-0769 State: PUBLISHED Published: 2024-01-21T08:00:05.383Z Last Updated: 2025-10-21T23:05:27.747Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: D-Link Products: DIR-859 Problem Types: CWE-22 Description: ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in D-Link DIR-859 1.06B01. It has been rated as critical. Affected by this issue is some unknown functionality of the file /hedwig.cgi of the component HTTP POST Request Handler. The manipulation of the argument service with the input ../../../../htdocs/webinc/getcfg/DHCPS6.BRIDGE-1.xml leads to path traversal. The attack may be launched remotely. The exploit has been disclosed to th