Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-38770 State: PUBLISHED Published: 2024-08-01T20:57:05.246Z Last Updated: 2024-08-07T18:20:36.779Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Revmakx Products: Backup and Staging by WP Time Capsule Problem Types: CWE-269 Description: Improper Privilege Management vulnerability in Revmakx Backup and Staging by WP Time Capsule allows Privilege Escalation, Authentication Bypass.This issue affects Backup and Staging by WP Time Capsule: from n/a through 1.22.20. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/wp-time-capsule/wordpress-backup-and-staging-by-wp-time-capsule-plugin
: - https://patchstack.com/database/vulnerability/wp-time-capsule/wordpress-backup-and-staging-by-wp-time-capsule-plugin-1-22-20-authentication-bypass-and-privilege-escalation-vulnerability?_s_id=cve
CVE ID: CVE-2024-38771 State: PUBLISHED Published: 2024-11-01T14:17:58.553Z Last Updated: 2024-11-05T15:43:10.070Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L) Vendors: Atarim Products: Atarim Problem Types: CWE-862 Description: Missing Authorization vulnerability in Atarim allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Atarim: from n/a through 4.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/atarim-visual-collaboration/wordpress-atarim-plugin-4-0-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2024-38772 State: PUBLISHED Published: 2024-08-01T20:49:54.842Z Last Updated: 2024-08-01T21:02:25.756Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: Crocoblock Products: JetWidgets for Elementor and WooCommerce Problem Types: CWE-22 Description: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Crocoblock JetWidgets for Elementor and WooCommerce allows PHP Local File Inclusion.This issue affects JetWidgets for Elementor and WooCommerce: from n/a through 1.1.7. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/jetwoo-widgets-for-elementor/w
tes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/jetwoo-widgets-for-elementor/wordpress-jetwidgets-for-elementor-and-woocommerce-plugin-1-1-7-contributor-limited-local-file-inclusion-vulnerability?_s_id=cve
CVE ID: CVE-2024-38773 State: PUBLISHED Published: 2024-07-22T10:07:53.644Z Last Updated: 2024-08-02T04:19:20.408Z Severity: CRITICAL (CVSS 9.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L) Vendors: Adrian Tobey Products: FormLift for Infusionsoft Web Forms Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Adrian Tobey FormLift for Infusionsoft Web Forms allows Blind SQL Injection.This issue affects FormLift for Infusionsoft Web Forms: from n/a through 7.5.17. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/formlift/wor
CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/formlift/wordpress-formlift-plugin-7-5-17-unauthenticated-blind-sql-injection-vulnerability?_s_id=cve
CVE ID: CVE-2024-38774 State: PUBLISHED Published: 2024-11-01T14:17:57.950Z Last Updated: 2024-11-01T19:27:05.574Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L) Vendors: SiteGround Products: SiteGround Security Problem Types: CWE-862 Description: Missing Authorization vulnerability in SiteGround SiteGround Security allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SiteGround Security: from n/a through 1.5.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/sg-security/wordpress-security-optimizer-plugin-1-5-0-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2024-38775 State: PUBLISHED Published: 2024-08-01T20:48:05.783Z Last Updated: 2024-08-02T15:29:40.069Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: WebAppick Products: CTX Feed Problem Types: CWE-269 Description: Improper Privilege Management vulnerability in WebAppick CTX Feed allows Privilege Escalation.This issue affects CTX Feed: from n/a through 6.5.6. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/webappick-product-feed-for-woocommerce/wordpress-ctx-feed-plugin-6-5-6-arbitrary-options-update-vulnerability?_s_id=cve
CVE ID: CVE-2024-38776 State: PUBLISHED Published: 2024-08-02T07:25:53.919Z Last Updated: 2024-08-02T17:37:34.998Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: Martin Gibson Products: WP GoToWebinar Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Martin Gibson WP GoToWebinar allows Cross-Site Scripting (XSS).This issue affects WP GoToWebinar: from n/a through 15.7. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/wp-gotowebinar/wordpress-wp-gotowebinar-plugin-15-7-csrf-to-xss-vulnerability?_s_id=cve
CVE ID: CVE-2024-38777 State: PUBLISHED Published: 2024-11-01T14:17:57.331Z Last Updated: 2024-11-01T19:28:11.175Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: CreativeMotion Products: Titan Anti-spam & Security Problem Types: CWE-862 Description: Missing Authorization vulnerability in CreativeMotion Titan Anti-spam & Security allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Titan Anti-spam & Security: from n/a through 7.3.6. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/anti-spam/wordpress-titan-anti-spam-security-plugin-7-3-5-broken-access-control-
//patchstack.com/database/vulnerability/anti-spam/wordpress-titan-anti-spam-security-plugin-7-3-5-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2024-38778 State: PUBLISHED Published: 2025-01-02T12:58:33.218Z Last Updated: 2025-01-02T14:52:00.586Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: Epsiloncool Products: WP Fast Total Search Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Epsiloncool WP Fast Total Search.This issue affects WP Fast Total Search: from n/a through 1.69.234. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/fulltext-search/vulnerability/wordpress-wp-fast-total-search-1-69-234-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2024-38780 State: PUBLISHED Published: 2024-06-21T11:15:12.892Z Last Updated: 2025-11-04T17:21:57.330Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: dma-buf/sw-sync: don't enable IRQ from sync_print_obj() Since commit a6aa8fca4d79 ("dma-buf/sw-sync: Reduce irqsave/irqrestore from known context") by error replaced spin_unlock_irqrestore() with spin_unlock_irq() for both sync_debugfs_show() and sync_print_obj() despite sync_print_obj() is called from sync_debugfs_show(), lockdep complains inconsistent lock state warning. Use plain spin_{lock,unlock}() for sync_print_obj(), for sync_debugfs_show() is already using spi
nt lock state warning. Use plain spin_{lock,unlock}() for sync_print_obj(), for sync_debugfs_show() is already using spin_{lock,unlock}_irq(). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/1ff116f68560a25656933d5a18e7619cb6773d8a - https://git.kernel.org/stable/c/165b25e3ee9333f7b04f8db43895beacb51582ed - https://git.kernel.org/stable/c/ae6fc4e6a3322f6d1c8ff59150d8469487a73dd8 - https://git.kernel.org/stable/c/9d75fab2c14a25553a1664586ed122c316bd1878 - https://git.kernel.org/stable/c/242b30466879e6defa521573c27e12018276c33a - https://git.kernel.org/stable/c/a4ee78244445ab73af22bfc5a5fc543963b25aef - https://git.kerne
efa521573c27e12018276c33a - https://git.kernel.org/stable/c/a4ee78244445ab73af22bfc5a5fc543963b25aef - https://git.kernel.org/stable/c/8a283cdfc8beeb14024387a925247b563d614e1e - https://git.kernel.org/stable/c/b794918961516f667b0c745aebdfebbb8a98df39
CVE ID: CVE-2024-38781 State: PUBLISHED Published: 2024-07-21T21:15:36.446Z Last Updated: 2024-08-02T04:19:20.290Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: ArtistScope Products: CopySafe Web Protection Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in ArtistScope CopySafe Web Protection allows Reflected XSS.This issue affects CopySafe Web Protection: from n/a through 3.15. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/wp-copysafe-web/wordpress-copysafe-web-protection-plugi
ner: References: - https://patchstack.com/database/vulnerability/wp-copysafe-web/wordpress-copysafe-web-protection-plugin-3-15-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2024-38782 State: PUBLISHED Published: 2024-07-21T21:13:35.392Z Last Updated: 2024-08-02T04:19:20.253Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: MapsMarker.com e.U. Products: Leaflet Maps Marker Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in MapsMarker.Com e.U. Leaflet Maps Marker allows Stored XSS.This issue affects Leaflet Maps Marker: from n/a through 3.12.9. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/leaflet-maps-marker/wordpress-leaflet-maps-marker-
ontainer: References: - https://patchstack.com/database/vulnerability/leaflet-maps-marker/wordpress-leaflet-maps-marker-plugin-3-12-9-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2024-38783 State: PUBLISHED Published: 2024-11-01T14:17:56.733Z Last Updated: 2024-11-05T19:47:13.607Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: Tyche Softwares Products: Arconix FAQ Problem Types: CWE-862 Description: Missing Authorization vulnerability in Tyche Softwares Arconix FAQ allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Arconix FAQ: from n/a through 1.9.4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/arconix-faq/wordpress-arconix-faq-plugin-1-9-4-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2024-38784 State: PUBLISHED Published: 2024-07-21T21:11:55.481Z Last Updated: 2024-08-02T04:19:20.293Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: Livemesh Products: Livemesh Addons for Beaver Builder Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Livemesh Livemesh Addons for Beaver Builder allows Stored XSS.This issue affects Livemesh Addons for Beaver Builder: from n/a through 3.6.1. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/addons-for-beaver-builder/wo
hment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/addons-for-beaver-builder/wordpress-livemesh-addons-for-beaver-builder-plugin-3-6-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2024-38785 State: PUBLISHED Published: 2024-07-21T21:10:09.429Z Last Updated: 2024-08-02T04:19:20.229Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: Jegstudio Products: Gutenverse Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Jegstudio Gutenverse allows Stored XSS.This issue affects Gutenverse: from n/a through 1.9.2. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/gutenverse/wordpress-gutenverse-plugin-1-9-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2024-38786 State: PUBLISHED Published: 2024-07-21T21:08:44.925Z Last Updated: 2024-08-02T04:19:20.406Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: BurgerThemes Products: CoziPress Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in BurgerThemes CoziPress allows Stored XSS.This issue affects CoziPress: from n/a through 1.0.30. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/cozipress/wordpress-cozipress-theme-1-0-30-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2024-38787 State: PUBLISHED Published: 2024-08-13T10:33:21.336Z Last Updated: 2024-08-14T18:28:29.746Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Codection Products: Import and export users and customers Problem Types: CWE-200 Description: Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Codection Import and export users and customers allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Import and export users and customers: from n/a through 1.26.8. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/import-users-from-csv-with-me
otes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/import-users-from-csv-with-meta/wordpress-import-and-export-users-and-customers-plugin-1-26-8-sensitive-information-via-imported-file-vulnerability?_s_id=cve
CVE ID: CVE-2024-38788 State: PUBLISHED Published: 2024-07-22T10:06:00.992Z Last Updated: 2024-08-02T04:19:20.557Z Severity: HIGH (CVSS 7.6 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L) Vendors: Bởi Admin 2020 Products: UiPress lite Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Bởi Admin 2020 UiPress lite allows SQL Injection.This issue affects UiPress lite: from n/a through 3.4.06. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/uipress-lite/wordpress-uipress-lite-plugin-3-4-06-sql-injection-vulnerability?_s_id=cve
CVE ID: CVE-2024-38789 State: PUBLISHED Published: 2025-01-02T12:01:08.872Z Last Updated: 2025-01-03T18:58:08.852Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L) Vendors: Marco Milesi Products: Telegram Bot & Channel Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Marco Milesi Telegram Bot & Channel allows Cross Site Request Forgery.This issue affects Telegram Bot & Channel: from n/a through 3.8.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/telegram-bot/vulnerability/wordpress-telegram-bot-channel-plugin-3-8-2-cross-site-request-forgery-csrf-vulnerability?_s
/telegram-bot/vulnerability/wordpress-telegram-bot-channel-plugin-3-8-2-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2024-38790 State: PUBLISHED Published: 2025-01-02T12:01:09.453Z Last Updated: 2025-01-02T14:52:04.593Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N) Vendors: Smartsupp Products: Smartsupp – live chat, chatbots, AI and lead generation Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Smartsupp Smartsupp – live chat, chatbots, AI and lead generation allows Cross Site Request Forgery.This issue affects Smartsupp – live chat, chatbots, AI and lead generation: from n/a through 3.6. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/smartsupp-live-chat/vulnerab
es: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/smartsupp-live-chat/vulnerability/wordpress-smartsupp-plugin-3-6-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2024-38791 State: PUBLISHED Published: 2024-08-01T20:46:22.846Z Last Updated: 2024-08-06T20:36:31.079Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: Jordy Meow Products: AI Engine: ChatGPT Chatbot Problem Types: CWE-918 Description: Server-Side Request Forgery (SSRF) vulnerability in Jordy Meow AI Engine: ChatGPT Chatbot allows Server Side Request Forgery.This issue affects AI Engine: ChatGPT Chatbot: from n/a through 2.4.7. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/ai-engine/wordpress-ai-engine-plugin-2-4-7-server-side-request-forgery-ssrf-vulnerability?_s_id=cve
CVE ID: CVE-2024-38792 State: PUBLISHED Published: 2024-11-01T14:17:56.151Z Last Updated: 2024-11-01T18:40:01.060Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: ConveyThis Translate Team Products: Language Translate Widget for WordPress – ConveyThis Problem Types: CWE-862 Description: Missing Authorization vulnerability in ConveyThis Translate Team Language Translate Widget for WordPress – ConveyThis allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Language Translate Widget for WordPress – ConveyThis: from n/a through 234. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vuln
m n/a through 234. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/conveythis-translate/wordpress-conveythis-translate-plugin-234-non-arbitrary-options-update-vulnerability?_s_id=cve
CVE ID: CVE-2024-38793 State: PUBLISHED Published: 2024-08-29T14:07:29.803Z Last Updated: 2024-08-29T14:31:01.988Z Severity: HIGH (CVSS 8.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L) Vendors: PriceListo Products: Best Restaurant Menu by PriceListo Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in PriceListo Best Restaurant Menu by PriceListo allows SQL Injection.This issue affects Best Restaurant Menu by PriceListo: from n/a through 1.4.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/best-restaurant-menu-by-pricelisto/wordpress-best-resta
ent: References: - https://patchstack.com/database/vulnerability/best-restaurant-menu-by-pricelisto/wordpress-best-restaurant-menu-by-pricelisto-plugin-1-4-1-sql-injection-vulnerability?_s_id=cve
CVE ID: CVE-2024-38794 State: PUBLISHED Published: 2024-11-01T14:17:55.538Z Last Updated: 2024-11-01T18:41:03.977Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: MediaRon LLC Products: Custom Query Blocks Problem Types: CWE-862 Description: Missing Authorization vulnerability in MediaRon LLC Custom Query Blocks allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Custom Query Blocks: from n/a through 5.2.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/post-type-archive-mapping/wordpress-custom-query-blocks-plugin-5-2-0-broken-access-control-vulnerability?_s_id=cv
bility/post-type-archive-mapping/wordpress-custom-query-blocks-plugin-5-2-0-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2024-38795 State: PUBLISHED Published: 2024-08-29T14:08:46.179Z Last Updated: 2024-08-29T14:30:25.589Z Severity: CRITICAL (CVSS 9.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L) Vendors: CridioStudio Products: ListingPro Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in CridioStudio ListingPro allows SQL Injection.This issue affects ListingPro: from n/a through 2.9.4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/listingpro-plugin/wordpress-listingpro-plugin-2-9-3-unauthenticated-sql-injection-vulnerability?_s_id=cve
CVE ID: CVE-2024-38796 State: PUBLISHED Published: 2024-09-27T21:45:00.730Z Last Updated: 2025-11-03T19:30:19.044Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:L) Vendors: TianoCore Products: EDK2 Problem Types: CWE-122 Description: EDK2 contains a vulnerability in the PeCoffLoaderRelocateImage(). An Attacker may cause memory corruption due to an overflow via an adjacent network. A successful exploit of this vulnerability may lead to a loss of Confidentiality, Integrity, and/or Availability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/tianocore/edk2/security/advisories/GHSA-xpcr-7hjq-m6qm
CVE ID: CVE-2024-38797 State: PUBLISHED Published: 2025-04-07T17:18:01.014Z Last Updated: 2025-04-08T16:00:53.582Z Severity: MEDIUM (CVSS 4.6 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L) Vendors: TianoCore Products: EDK2 Problem Types: CWE-125 Description: EDK2 contains a vulnerability in the HashPeImageByType(). A user may cause a read out of bounds when a corrupted data pointer and length are sent via an adjecent network. A successful exploit of this vulnerability may lead to a loss of Integrity and/or Availability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/tianocore/edk2/security/advisories/GHSA-4wjw-6xmf-44xf
CVE ID: CVE-2024-38805 State: PUBLISHED Published: 2025-08-12T14:13:28.174Z Last Updated: 2025-08-12T14:34:39.772Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H) Vendors: TianoCore Products: EDK2 Problem Types: CWE-190 Description: EDK2 contains a vulnerability in BIOS where a user may cause an Integer Overflow or Wraparound by network means. A successful exploitation of this vulnerability may lead to denial of service. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/tianocore/edk2/security/advisories/GHSA-p7wp-52j7-6r5x
CVE ID: CVE-2024-38806 State: PUBLISHED Published: 2024-07-18T18:41:33.779Z Last Updated: 2024-08-02T04:19:20.500Z Severity: LOW (CVSS 3.9 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L) Vendors: n/a Products: UAA Problem Types: CWE-440 Description: Failure to properly synchronize user's permissions in UAA in Cloud Foundry Foundation v40.17.0 https://github.com/cloudfoundry/cf-deployment/releases/tag/v40.17.0 , potentially resulting in users retaining access rights they should not have. This can allow them to perform operations beyond their intended permissions. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.cloudfoundry.org/blog/cve-2024-
alyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.cloudfoundry.org/blog/cve-2024-38806-uaa-failure-to-remove-shadow-users-access
CVE ID: CVE-2024-38807 State: PUBLISHED Published: 2024-08-23T08:26:11.826Z Last Updated: 2025-03-27T16:36:21.258Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N) Vendors: Spring Products: Spring Boot Description: Applications that use spring-boot-loader or spring-boot-loader-classic and contain custom code that performs signature verification of nested jar files may be vulnerable to signature forgery where content that appears to have been signed by one signer has, in fact, been signed by another. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://spring.io/security/cve-2024-38807