Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-3648 State: PUBLISHED Published: 2024-05-23T06:46:01.621Z Last Updated: 2024-08-01T20:19:59.752Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: sharethis Products: ShareThis Share Buttons Problem Types: CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) Description: The ShareThis Share Buttons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'sharethis-inline-button' shortcode in all versions up to, and including, 2.3.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor
on and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/03b37c90-4bb5-4003-a440-3fb57a5c1cae?source=cve - https://plugins.trac.wordpress.org/changeset/3089529/sharethis-share-buttons
CVE ID: CVE-2024-3649 State: PUBLISHED Published: 2024-05-02T16:52:12.668Z Last Updated: 2024-08-01T20:19:59.929Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: smub Products: Contact Form by WPForms – Drag & Drop Form Builder for WordPress Problem Types: CWE-472 External Control of Assumed-Immutable Web Parameter Description: The Contact Form by WPForms – Drag & Drop Form Builder for WordPress plugin for WordPress is vulnerable to price manipulation in versions up to, and including, 1.8.7.2. This is due to a lack of controls on several product parameters. This makes it possible for unauthenticated attackers to manipulate prices, product information, and qu
oduct parameters. This makes it possible for unauthenticated attackers to manipulate prices, product information, and quantities for purchases made via the Stripe payment integration. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/68a509ae-9943-4b9a-8ede-2b5732e96e6d?source=cve - https://plugins.trac.wordpress.org/changeset/3075634 - https://plugins.trac.wordpress.org/changeset/3075634/wpforms-lite/trunk/assets/js/integrations/stripe/wpforms-stripe-payment-element.js
CVE ID: CVE-2024-3650 State: PUBLISHED Published: 2024-05-02T16:52:25.574Z Last Updated: 2024-08-01T20:20:00.573Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: xpeedstudio Products: ElementsKit Elementor addons and Templates Library Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The ElementsKit Elementor addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Image Accordion widget in all versions 3.0.7 through 3.1.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and
sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/93dcbab7-fdf5-4631-8605-77f8f190512d?source=cve - https://plugins.trac.wordpress.org/changeset/3078160/elementskit-lite
CVE ID: CVE-2024-3651 State: PUBLISHED Published: 2024-07-07T17:22:10.032Z Last Updated: 2025-11-04T22:06:20.751Z Severity: MEDIUM (CVSS 6.2 CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: kjd Products: kjd/idna Problem Types: CWE-1333 Description: A vulnerability was identified in the kjd/idna library, specifically within the `idna.encode()` function, affecting version 3.6. The issue arises from the function's handling of crafted input strings, which can lead to quadratic complexity and consequently, a denial of service condition. This vulnerability is triggered by a crafted input that causes the `idna.encode()` function to process the input with considerable computational load, sign
a crafted input that causes the `idna.encode()` function to process the input with considerable computational load, significantly increasing the processing time in a quadratic manner relative to the input size. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://huntr.com/bounties/93d78d07-d791-4b39-a845-cbfabc44aadb - https://github.com/kjd/idna/commit/1d365e17e10d72d0b7876316fc7b9ca0eebdd38d
CVE ID: CVE-2024-3652 State: PUBLISHED Published: 2024-04-11T01:32:13.433Z Last Updated: 2025-02-13T17:52:56.700Z Vendors: The Libreswan Project (www.libreswan.org) Products: libreswan Problem Types: IKEv1 with default AH/ESP configuration can cause libreswan to abort and restart Description: The Libreswan Project was notified of an issue causing libreswan to restart when using IKEv1 without specifying an esp= line. When the peer requests AES-GMAC, libreswan's default proposal handler causes an assertion failure and crashes and restarts. IKEv2 connections are not affected. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://libreswan.org/security
Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://libreswan.org/security/CVE-2024-3652 - http://www.openwall.com/lists/oss-security/2024/04/18/2
CVE ID: CVE-2024-3653 State: PUBLISHED Published: 2024-07-08T21:21:20.899Z Last Updated: 2025-11-07T18:44:40.524Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: Red Hat Products: Red Hat build of Quarkus 3.8.6.redhat, Red Hat JBoss Enterprise Application Platform 7, Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8, Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9, Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7, Red Hat JBoss Enterprise Application Platform 8, OpenShift Serverless, Red Hat build of Apache Camel 4 for Quarkus 3, Red Hat build of Apache Camel for Spring Boot 4, Red Hat build of Apache Camel - HawtIO 4, Red
e Camel 4 for Quarkus 3, Red Hat build of Apache Camel for Spring Boot 4, Red Hat build of Apache Camel - HawtIO 4, Red Hat build of Apicurio Registry 2, Red Hat Build of Keycloak, Red Hat build of OptaPlanner 8, Red Hat build of Quarkus, Red Hat Data Grid 8, Red Hat Fuse 7, Red Hat Integration Camel K 1, Red Hat Integration Camel Quarkus 2, Red Hat JBoss Data Grid 7, Red Hat JBoss Enterprise Application Platform Expansion Pack, Red Hat JBoss Fuse Service Works 6, Red Hat Process Automation 7, Red Hat Single Sign-On 7, streams for Apache Kafka Problem Types: CWE-401 Description: A vulnerability was found in Undertow. This issue requires enabling the learning-push handler in the server's conf
tion: A vulnerability was found in Undertow. This issue requires enabling the learning-push handler in the server's config, which is disabled by default, leaving the maxAge config in the handler unconfigured. The default is -1, which makes the handler vulnerable. If someone overwrites that config, the server is not subject to the attack. The attacker needs to be able to reach the server with a normal HTTP request. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2024:4392 - https://access.redhat.com/errata/RHSA-2024:5143 - https://access.redhat.com/errata/RHSA-2024:5144 - https://access.redhat.com/errata/RHSA-2024
com/errata/RHSA-2024:5143 - https://access.redhat.com/errata/RHSA-2024:5144 - https://access.redhat.com/errata/RHSA-2024:5145 - https://access.redhat.com/errata/RHSA-2024:5147 - https://access.redhat.com/errata/RHSA-2024:6437 - https://access.redhat.com/security/cve/CVE-2024-3653 - https://bugzilla.redhat.com/show_bug.cgi?id=2274437
CVE ID: CVE-2024-3654 State: PUBLISHED Published: 2024-04-19T12:38:48.895Z Last Updated: 2024-08-01T20:20:00.468Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L) Vendors: Teimas Global Products: Teixo Problem Types: CWE-79 Description: An XSS vulnerability has been found in Teimas Global's Teixo, version 1.42.42-stable. This vulnerability could allow an attacker to send a specially crafted JavaScript payload via the "seconds" parameter in the program's URL, resulting in a possible takeover of a registered user's session. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/cross-s
CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/cross-site-scripting-vulnerability-teixo-teimas-global
CVE ID: CVE-2024-3655 State: PUBLISHED Published: 2024-09-03T09:32:48.831Z Last Updated: 2024-09-30T15:19:48.037Z Vendors: Arm Ltd Products: Bifrost GPU Kernel Driver, Valhall GPU Kernel Driver, Arm 5th Gen GPU Architecture Kernel Driver Problem Types: CWE-416 Description: Use After Free vulnerability in Arm Ltd Bifrost GPU Kernel Driver, Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Gen GPU Architecture Kernel Driver allows a local non-privileged user to make improper GPU memory processing operations to gain access to already freed memory.This issue affects Bifrost GPU Kernel Driver: from r43p0 through r49p0; Valhall GPU Kernel Driver: from r43p0 through r49p0; Arm 5th Gen GPU Architec
U Kernel Driver: from r43p0 through r49p0; Valhall GPU Kernel Driver: from r43p0 through r49p0; Arm 5th Gen GPU Architecture Kernel Driver: from r43p0 through r49p0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://developer.arm.com/Arm%20Security%20Center/Mali%20GPU%20Driver%20Vulnerabilities
CVE ID: CVE-2024-3656 State: PUBLISHED Published: 2024-10-09T18:59:11.101Z Last Updated: 2025-11-20T07:13:33.991Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) Vendors: Red Hat Products: Red Hat Build of Keycloak, Red Hat Single Sign-On 7, Red Hat JBoss Enterprise Application Platform 8 Problem Types: CWE-200 Description: A flaw was found in Keycloak. Certain endpoints in Keycloak's admin REST API allow low-privilege users to access administrative functionalities. This flaw allows users to perform actions reserved for administrators, potentially leading to data breaches or system compromise. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container:
ding to data breaches or system compromise. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2024:3572 - https://access.redhat.com/errata/RHSA-2024:3575 - https://access.redhat.com/security/cve/CVE-2024-3656 - https://bugzilla.redhat.com/show_bug.cgi?id=2274403 - https://github.com/advisories/GHSA-2cww-fgmg-4jqc
CVE ID: CVE-2024-3657 State: PUBLISHED Published: 2024-05-28T12:53:03.399Z Last Updated: 2025-11-06T20:56:31.849Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Red Hat Products: Red Hat Directory Server 11.5 E4S for RHEL 8, Red Hat Directory Server 11.7 for RHEL 8, Red Hat Directory Server 11.8 for RHEL 8, Red Hat Directory Server 11.9 for RHEL 8, Red Hat Directory Server 12.2 EUS for RHEL 9, Red Hat Directory Server 12.4 for RHEL 9, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 8.8 Extended Update Support, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 9.2 Extended Update Support, Red Hat Enterprise Linux 10, Red Hat
, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 9.2 Extended Update Support, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6 Problem Types: CWE-20 Description: A flaw was found in 389-ds-base. A specially-crafted LDAP query can potentially cause a failure on the directory server, leading to a denial of service Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2024:3591 - https://access.redhat.com/errata/RHSA-2024:3837 - https://access.redhat.com/errata/RHSA-2024:4092 - https://access.redhat.com/errata/RHSA-2024:4209 - https://access.redhat.com/errata/RHSA-2024:4210 - https://access.redhat.com/errata/
s.redhat.com/errata/RHSA-2024:4209 - https://access.redhat.com/errata/RHSA-2024:4210 - https://access.redhat.com/errata/RHSA-2024:4235 - https://access.redhat.com/errata/RHSA-2024:4633 - https://access.redhat.com/errata/RHSA-2024:5690 - https://access.redhat.com/errata/RHSA-2024:6576 - https://access.redhat.com/errata/RHSA-2024:7458 - https://access.redhat.com/errata/RHSA-2025:1632 - https://access.redhat.com/security/cve/CVE-2024-3657 - https://bugzilla.redhat.com/show_bug.cgi?id=2274401
CVE ID: CVE-2024-3658 State: REJECTED Published: 2024-05-18T09:39:39.516Z Last Updated: 2024-05-28T14:41:50.015Z Description: No description available.
CVE ID: CVE-2024-3659 State: PUBLISHED Published: 2024-08-08T12:24:46.674Z Last Updated: 2025-11-17T16:15:49.160Z Vendors: KAON Group Products: AR2140 Problem Types: CWE-78 Description: Firmware in KAON AR2140 routers, prior to versions 3.2.50 and 4.2.16, is vulnerable to a shell command injection via sending a crafted request to one of the endpoints. In order to exploit this vulnerability, one has to have access to the administrative portal of the router. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert.pl/en/posts/2024/08/CVE-2024-3659 - https://cert.pl/posts/2024/08/CVE-2024-3659
CVE ID: CVE-2024-3660 State: PUBLISHED Published: 2024-04-16T20:09:26.220Z Last Updated: 2025-02-13T17:52:58.005Z Vendors: tensorflow Products: keras Problem Types: CWE-502 Deserialization of Untrusted Data, CWE-94 Improper Control of Generation of Code ('Code Injection') Description: A arbitrary code injection vulnerability in TensorFlow's Keras framework (<2.13) allows attackers to execute arbitrary code with the same permissions as the application using a model that allow arbitrary code irrespective of the application. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://kb.cert.org/vuls/id/253266 - https://www.kb.cert.org/vuls/id/253266
CVE ID: CVE-2024-3661 State: PUBLISHED Published: 2024-05-06T18:31:21.217Z Last Updated: 2024-08-28T19:09:06.995Z Severity: HIGH (CVSS 7.6 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L) Vendors: IETF Products: DHCP Problem Types: CWE-306, CWE-501 Description: DHCP can add routes to a client’s routing table via the classless static route option (121). VPN-based security solutions that rely on routes to redirect traffic can be forced to leak traffic over the physical interface. An attacker on the same local network can read, disrupt, or possibly modify network traffic that was expected to be protected by the VPN. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: Refere
expected to be protected by the VPN. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://datatracker.ietf.org/doc/html/rfc2131#section-7 - https://datatracker.ietf.org/doc/html/rfc3442#section-7 - https://tunnelvisionbug.com/ - https://www.leviathansecurity.com/research/tunnelvision - https://news.ycombinator.com/item?id=40279632 - https://arstechnica.com/security/2024/05/novel-attack-against-virtually-all-vpn-apps-neuters-their-entire-purpose/ - https://krebsonsecurity.com/2024/05/why-your-vpn-may-not-be-as-secure-as-it-claims/ - https://issuetracker.google.com/issues/263721377 - https://mullvad.net/en/blog/evaluating-the-impact-of-tunnelvision
/ - https://issuetracker.google.com/issues/263721377 - https://mullvad.net/en/blog/evaluating-the-impact-of-tunnelvision - https://www.zscaler.com/blogs/security-research/cve-2024-3661-k-tunnelvision-exposes-vpn-bypass-vulnerability - https://lowendtalk.com/discussion/188857/a-rogue-dhcp-server-within-your-network-can-and-will-hijack-your-vpn-traffic - https://news.ycombinator.com/item?id=40284111 - https://www.agwa.name/blog/post/hardening_openvpn_for_def_con - https://www.theregister.com/2024/05/07/vpn_tunnelvision_dhcp/ - https://support.citrix.com/article/CTX677069/cloud-software-group-security-advisory-for-cve20243661 - https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2024-00009 - ht
d-software-group-security-advisory-for-cve20243661 - https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2024-00009 - https://bst.cisco.com/quickview/bug/CSCwk05814 - https://security.paloaltonetworks.com/CVE-2024-3661 - https://fortiguard.fortinet.com/psirt/FG-IR-24-170 - https://my.f5.com/manage/s/article/K000139553
CVE ID: CVE-2024-3662 State: PUBLISHED Published: 2024-04-13T08:41:30.091Z Last Updated: 2024-08-01T20:20:00.431Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: wpzoom Products: WPZOOM Social Feed Widget & Block Problem Types: CWE-862 Missing Authorization Description: The WPZOOM Social Feed Widget & Block plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the wpzoom_instagram_clear_data() function in all versions up to, and including, 2.1.13. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete all Instagram images installed on the site. Additional Analyst Notes: -
ith subscriber-level access and above, to delete all Instagram images installed on the site. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/e3a70510-51c8-49c3-933b-79e79dfb8611?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3069664%40instagram-widget-by-wpzoom&new=3069664%40instagram-widget-by-wpzoom&sfp_email=&sfph_mail=
CVE ID: CVE-2024-3663 State: PUBLISHED Published: 2024-05-22T06:50:32.363Z Last Updated: 2024-08-01T20:20:01.201Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: rico-macchi Products: WP Scraper Problem Types: CWE-862 Missing Authorization Description: The WP Scraper plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the wp_scraper_multi_scrape_action() function in all versions up to, and including, 5.7. This makes it possible for authenticated attackers, with subscriber-level access and above, to create arbitrary pages and posts. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: Reference
create arbitrary pages and posts. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/1a4bc52d-5771-4e7b-a394-772f2a5edbd7?source=cve - https://plugins.trac.wordpress.org/browser/wp-scraper/trunk/wp-scraper.php#L1426
CVE ID: CVE-2024-3664 State: PUBLISHED Published: 2024-04-23T07:36:28.308Z Last Updated: 2024-08-01T20:20:00.507Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: hinjiriyo Products: Quick Featured Images Problem Types: CWE-862 Missing Authorization Description: The Quick Featured Images plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the set_thumbnail and delete_thumbnail functions in all versions up to, and including, 13.7.0. This makes it possible for authenticated attackers, with contributor-level access and above, to delete thumbnails and add thumbnails to posts they did not author. Additional
th contributor-level access and above, to delete thumbnails and add thumbnails to posts they did not author. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/5dbbd1a0-de05-4510-b06b-8bc396b65a97?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3075135%40quick-featured-images&new=3075135%40quick-featured-images&sfp_email=&sfph_mail=
CVE ID: CVE-2024-3665 State: PUBLISHED Published: 2024-04-23T09:32:54.173Z Last Updated: 2024-08-01T20:20:00.706Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: rankmath Products: Rank Math SEO with AI Best SEO Tools Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Rank Math SEO with AI SEO Tools plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's HowTo and FAQ widgets in all versions up to, and including, 1.0.216 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, w
nput sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/21341d9c-9f04-4bc6-b9fc-6fa8afd3cf5c?source=cve - https://plugins.trac.wordpress.org/browser/seo-by-rank-math/tags/1.0.216/includes/modules/schema/blocks/class-block-faq.php#L186 - https://plugins.trac.wordpress.org/browser/seo-by-rank-math/tags/1.0.216/includes/modules/schema/blocks/class
php#L186 - https://plugins.trac.wordpress.org/browser/seo-by-rank-math/tags/1.0.216/includes/modules/schema/blocks/class-block-howto.php#L239 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3069711%40seo-by-rank-math&new=3069711%40seo-by-rank-math&sfp_email=&sfph_mail=#file6 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3069711%40seo-by-rank-math&new=3069711%40seo-by-rank-math&sfp_email=&sfph_mail=#file7
CVE ID: CVE-2024-3666 State: PUBLISHED Published: 2024-05-22T07:37:25.224Z Last Updated: 2024-08-01T20:19:59.907Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: wpopal Products: Opal Estate Pro – Property Management and Submission Problem Types: CWE-87 Improper Neutralization of Alternate XSS Syntax Description: The Opal Estate Pro – Property Management and Submission plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the agent latitude and longitude parameters in all versions up to, and including, 1.7.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor access
ent input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/c4d5d58f-913a-4a26-8b2a-bfdd08033993?source=cve - https://wordpress.org/plugins/opal-estate-pro/
CVE ID: CVE-2024-3667 State: PUBLISHED Published: 2024-06-05T05:33:07.081Z Last Updated: 2024-08-01T20:19:59.960Z Severity: HIGH (CVSS 7.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L) Vendors: themefusecom Products: Brizy – Page Builder Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Brizy – Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Link To' field of multiple widgets in all versions up to, and including, 2.4.43 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level