Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-1533 State: PUBLISHED Published: 2024-05-02T16:52:22.761Z Last Updated: 2024-08-01T18:40:21.392Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: averta Products: Shortcodes and extra features for Phlox theme Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Shortcodes and extra features for Phlox theme plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the HTML Element in all versions up to, and including, 2.15.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor access or
input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor access or higher, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Requires Elementor and the Phlox theme to be installed. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/8bcd2c5e-4969-4530-b3ab-930c5051d8f1?source=cve - https://wordpress.org/plugins/auxin-elements/
CVE ID: CVE-2024-1534 State: PUBLISHED Published: 2024-03-07T09:33:52.780Z Last Updated: 2024-08-01T18:40:21.358Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: pluggabl Products: Booster for WooCommerce Problem Types: CWE-20 Improper Input Validation Description: The Booster for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 7.1.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that wi
or authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/56dc5138-c864-4e36-8b7d-38ac49589c06?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3046146%40woocommerce-jetpack%2Ftrunk&old=3034358%40woocommerce-jetpack%2Ftrunk&sfp_email=&sfph_mail=
CVE ID: CVE-2024-1535 State: PUBLISHED Published: 2024-03-13T15:26:43.832Z Last Updated: 2024-08-01T18:40:21.420Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: collizo4sky Products: Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and
ugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 4.15.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/38ec1a6b-f5ee-446a-9e6c-3485dafb85ac?source=cve - https://github.com/WordpressPluginDirectory/wp-user-avatar/blob/fde360946c86d
b-f5ee-446a-9e6c-3485dafb85ac?source=cve - https://github.com/WordpressPluginDirectory/wp-user-avatar/blob/fde360946c86d67610d8f95a82752199ce25b39a/wp-user-avatar/src/ShortcodeParser/Builder/FieldsShortcodeCallback.php#L952 - https://plugins.trac.wordpress.org/changeset/3047008/wp-user-avatar/trunk/src/ShortcodeParser/Builder/FieldsShortcodeCallback.php
CVE ID: CVE-2024-1536 State: PUBLISHED Published: 2024-03-13T15:26:34.059Z Last Updated: 2024-08-01T18:40:21.339Z Severity: HIGH (CVSS 7.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L) Vendors: wpdevteam Products: Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's event calendar widget in all versions up to, and including, 5.9.9 due to insufficient i
-Site Scripting via the plugin's event calendar widget in all versions up to, and including, 5.9.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/12dc9e63-17bb-4755-be3c-ae8b26edd3cd?source=cve - https://plugins.trac.wordpress.org/changeset/3037755/essential-addons-for-elementor-lite/tags/5.9.10/includes/Element
- https://plugins.trac.wordpress.org/changeset/3037755/essential-addons-for-elementor-lite/tags/5.9.10/includes/Elements/Event_Calendar.php
CVE ID: CVE-2024-1537 State: PUBLISHED Published: 2024-03-13T15:26:59.753Z Last Updated: 2024-08-01T18:40:21.396Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: wpdevteam Products: Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Data Table widget in all versions up to, and including, 5.9.9 due to insufficient inp
ss-Site Scripting via the plugin's Data Table widget in all versions up to, and including, 5.9.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/81a48c61-4191-4252-9230-9df8fc5e3443?source=cve - https://plugins.trac.wordpress.org/changeset/3037755/essential-addons-for-elementor-lite/tags/5.9.10/includes/Elements/
https://plugins.trac.wordpress.org/changeset/3037755/essential-addons-for-elementor-lite/tags/5.9.10/includes/Elements/Data_Table.php
CVE ID: CVE-2024-1538 State: PUBLISHED Published: 2024-03-21T03:32:42.789Z Last Updated: 2024-08-05T20:10:01.569Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: mndpsingh287 Products: File Manager Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The File Manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 7.2.4. This is due to missing or incorrect nonce validation on the wp_file_manager page that includes files through the 'lang' parameter. This makes it possible for unauthenticated attackers to include local JavaScript files that can be leveraged to achieve RCE via a forged reque
for unauthenticated attackers to include local JavaScript files that can be leveraged to achieve RCE via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. This issue was partially patched in version 7.2.4, and fully patched in 7.2.5. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/57cc15a6-2cf5-481f-bb81-ada48aa74009?source=cve - https://plugins.trac.wordpress.org/changeset/3051451/wp-file-manager
CVE ID: CVE-2024-1539 State: PUBLISHED Published: 2025-02-05T09:46:46.182Z Last Updated: 2025-02-05T14:30:37.885Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: GitLab Products: GitLab Problem Types: CWE-862 Description: An issue has been discovered in GitLab EE affecting all versions starting from 15.2 prior to 16.9.7, starting from 16.10 prior to 16.10.5, and starting from 16.11 prior to 16.11.2. It was possible to disclose updates to issues to a banned group member using the API. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/442049 - https://hackerone.com/reports/2369988
CVE ID: CVE-2024-1540 State: PUBLISHED Published: 2024-03-27T15:54:27.999Z Last Updated: 2024-08-21T14:52:17.246Z Severity: HIGH (CVSS 8.6 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L) Vendors: gradio-app Products: gradio-app/gradio Problem Types: CWE-77 Description: A command injection vulnerability exists in the deploy+test-visual.yml workflow of the gradio-app/gradio repository, due to improper neutralization of special elements used in a command. This vulnerability allows attackers to execute unauthorized commands, potentially leading to unauthorized modification of the base repository or secrets exfiltration. The issue arises from the unsafe handling of GitHub context information within
base repository or secrets exfiltration. The issue arises from the unsafe handling of GitHub context information within a `run` operation, where expressions inside `${{ }}` are evaluated and substituted before script execution. Remediation involves setting untrusted input values to intermediate environment variables to prevent direct influence on script generation. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/0e39e974-9a66-476f-91f5-3f37abb03d77 - https://github.com/gradio-app/gradio/commit/d56bb28df80d8db1f33e4acf4f6b2c4f87cb8b28
CVE ID: CVE-2024-1541 State: PUBLISHED Published: 2024-03-13T15:27:15.628Z Last Updated: 2024-08-01T18:40:21.404Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: britner Products: Gutenberg Blocks by Kadence Blocks – Page Builder Features Problem Types: CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) Description: The Gutenberg Blocks by Kadence Blocks – Page Builder Features plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the htmlTag attribute in all versions up to, and including, 3.2.23 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, wi
.2.23 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/d0913632-85c5-4835-b606-4eca51df2496?source=cve - https://plugins.trac.wordpress.org/browser/kadence-blocks/tags/3.2.21/includes/blocks/class-kadence-blocks-advanced-heading-block.php#L418 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3041366%40kadence-blocks%
ck.php#L418 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3041366%40kadence-blocks%2Ftrunk&old=3036979%40kadence-blocks%2Ftrunk&sfp_email=&sfph_mail=
CVE ID: CVE-2024-1543 State: PUBLISHED Published: 2024-08-29T22:43:35.775Z Last Updated: 2024-08-30T14:19:32.248Z Severity: MEDIUM (CVSS 4.1 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N) Vendors: wolfSSL Products: wolfSSL Problem Types: CWE-208 Description: The side-channel protected T-Table implementation in wolfSSL up to version 5.6.5 protects against a side-channel attacker with cache-line resolution. In a controlled environment such as Intel SGX, an attacker can gain a per instruction sub-cache-line resolution allowing them to break the cache-line-level protection. For details on the attack refer to: https://doi.org/10.46586/tches.v2024.i1.457-500 Additional Analyst Notes: - CISA ADP Vul
details on the attack refer to: https://doi.org/10.46586/tches.v2024.i1.457-500 Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/wolfSSL/wolfssl/blob/master/ChangeLog.md#wolfssl-release-566-dec-19-2023
CVE ID: CVE-2024-1544 State: PUBLISHED Published: 2024-08-27T18:44:52.770Z Last Updated: 2024-08-27T19:14:35.190Z Severity: MEDIUM (CVSS 4.1 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N) Vendors: wolfSSL Products: wolfSSL Problem Types: CWE-203 Description: Generating the ECDSA nonce k samples a random number r and then truncates this randomness with a modular reduction mod n where n is the order of the elliptic curve. Meaning k = r mod n. The division used during the reduction estimates a factor q_e by dividing the upper two digits (a digit having e.g. a size of 8 byte) of r by the upper digit of n and then decrements q_e in a loop until it has the correct size. Observing the number of time
r by the upper digit of n and then decrements q_e in a loop until it has the correct size. Observing the number of times q_e is decremented through a control-flow revealing side-channel reveals a bias in the most significant bits of k. Depending on the curve this is either a negligible bias or a significant bias large enough to reconstruct k with lattice reduction methods. For SECP160R1, e.g., we find a bias of 15 bits. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/wolfSSL/wolfssl/releases/tag/v5.7.2-stable
CVE ID: CVE-2024-1545 State: PUBLISHED Published: 2024-08-29T23:02:48.312Z Last Updated: 2024-08-30T14:19:19.372Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:L/A:L) Vendors: WolfSSL Products: wolfCrypt Problem Types: CWE-1256, CWE-252 Description: Fault Injection vulnerability in RsaPrivateDecryption function in wolfssl/wolfcrypt/src/rsa.c in WolfSSL wolfssl5.6.6 on Linux/Windows allows remote attacker co-resides in the same system with a victim process to disclose information and escalate privileges via Rowhammer fault injection to the RsaKey structure. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/wolfSSL/wolfssl/releases/tag/v5.7
e. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/wolfSSL/wolfssl/releases/tag/v5.7.0-stable
CVE ID: CVE-2024-1546 State: PUBLISHED Published: 2024-02-20T13:21:34.136Z Last Updated: 2025-02-13T17:27:37.804Z Vendors: Mozilla Products: Firefox, Firefox ESR, Thunderbird Problem Types: Out-of-bounds memory read in networking channels Description: When storing and re-accessing data on a networking channel, the length of buffers may have been confused, resulting in an out-of-bounds memory read. This vulnerability affects Firefox < 123, Firefox ESR < 115.8, and Thunderbird < 115.8. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1843752 - https://www.mozilla.org/security/advisories/mfsa2024-05/ - https:/
ttps://bugzilla.mozilla.org/show_bug.cgi?id=1843752 - https://www.mozilla.org/security/advisories/mfsa2024-05/ - https://www.mozilla.org/security/advisories/mfsa2024-06/ - https://www.mozilla.org/security/advisories/mfsa2024-07/ - https://lists.debian.org/debian-lts-announce/2024/03/msg00000.html - https://lists.debian.org/debian-lts-announce/2024/03/msg00001.html
CVE ID: CVE-2024-1547 State: PUBLISHED Published: 2024-02-20T13:21:34.611Z Last Updated: 2025-03-28T17:34:22.227Z Vendors: Mozilla Products: Firefox, Firefox ESR, Thunderbird Problem Types: Alert dialog could have been spoofed on another site Description: Through a series of API calls and redirects, an attacker-controlled alert dialog could have been displayed on another website (with the victim website's URL shown). This vulnerability affects Firefox < 123, Firefox ESR < 115.8, and Thunderbird < 115.8. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1877879 - https://www.mozilla.org/security/advisories/mf
ner: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1877879 - https://www.mozilla.org/security/advisories/mfsa2024-05/ - https://www.mozilla.org/security/advisories/mfsa2024-06/ - https://www.mozilla.org/security/advisories/mfsa2024-07/ - https://lists.debian.org/debian-lts-announce/2024/03/msg00000.html - https://lists.debian.org/debian-lts-announce/2024/03/msg00001.html
CVE ID: CVE-2024-1548 State: PUBLISHED Published: 2024-02-20T13:21:34.997Z Last Updated: 2025-02-13T17:27:38.998Z Vendors: Mozilla Products: Firefox, Firefox ESR, Thunderbird Problem Types: Fullscreen Notification could have been hidden by select element Description: A website could have obscured the fullscreen notification by using a dropdown select input element. This could have led to user confusion and possible spoofing attacks. This vulnerability affects Firefox < 123, Firefox ESR < 115.8, and Thunderbird < 115.8. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1832627 - https://www.mozilla.org/securi
E Program Container: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1832627 - https://www.mozilla.org/security/advisories/mfsa2024-05/ - https://www.mozilla.org/security/advisories/mfsa2024-06/ - https://www.mozilla.org/security/advisories/mfsa2024-07/ - https://lists.debian.org/debian-lts-announce/2024/03/msg00000.html - https://lists.debian.org/debian-lts-announce/2024/03/msg00001.html
CVE ID: CVE-2024-1549 State: PUBLISHED Published: 2024-02-20T13:21:35.339Z Last Updated: 2025-02-13T17:27:39.512Z Vendors: Mozilla Products: Firefox, Firefox ESR, Thunderbird Problem Types: Custom cursor could obscure the permission dialog Description: If a website set a large custom cursor, portions of the cursor could have overlapped with the permission dialog, potentially resulting in user confusion and unexpected granted permissions. This vulnerability affects Firefox < 123, Firefox ESR < 115.8, and Thunderbird < 115.8. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1833814 - https://www.mozilla.org/s
- CISA ADP Vulnrichment: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1833814 - https://www.mozilla.org/security/advisories/mfsa2024-05/ - https://www.mozilla.org/security/advisories/mfsa2024-06/ - https://www.mozilla.org/security/advisories/mfsa2024-07/ - https://lists.debian.org/debian-lts-announce/2024/03/msg00000.html - https://lists.debian.org/debian-lts-announce/2024/03/msg00001.html
CVE ID: CVE-2024-1550 State: PUBLISHED Published: 2024-02-20T13:21:35.887Z Last Updated: 2025-03-27T20:05:58.389Z Vendors: Mozilla Products: Firefox, Firefox ESR, Thunderbird Problem Types: Mouse cursor re-positioned unexpectedly could have led to unintended permission grants Description: A malicious website could have used a combination of exiting fullscreen mode and `requestPointerLock` to cause the user's mouse to be re-positioned unexpectedly, which could have led to user confusion and inadvertently granting permissions they did not intend to grant. This vulnerability affects Firefox < 123, Firefox ESR < 115.8, and Thunderbird < 115.8. Additional Analyst Notes: - CISA ADP Vulnrichment: -
ffects Firefox < 123, Firefox ESR < 115.8, and Thunderbird < 115.8. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1860065 - https://www.mozilla.org/security/advisories/mfsa2024-05/ - https://www.mozilla.org/security/advisories/mfsa2024-06/ - https://www.mozilla.org/security/advisories/mfsa2024-07/ - https://lists.debian.org/debian-lts-announce/2024/03/msg00000.html - https://lists.debian.org/debian-lts-announce/2024/03/msg00001.html
CVE ID: CVE-2024-1551 State: PUBLISHED Published: 2024-02-20T13:21:36.343Z Last Updated: 2025-02-13T17:27:40.658Z Vendors: Mozilla Products: Firefox, Firefox ESR, Thunderbird Problem Types: Multipart HTTP Responses would accept the Set-Cookie header in response parts Description: Set-Cookie response headers were being incorrectly honored in multipart HTTP responses. If an attacker could control the Content-Type response header, as well as control part of the response body, they could inject Set-Cookie response headers that would have been honored by the browser. This vulnerability affects Firefox < 123, Firefox ESR < 115.8, and Thunderbird < 115.8. Additional Analyst Notes: - CISA ADP Vulnri
ability affects Firefox < 123, Firefox ESR < 115.8, and Thunderbird < 115.8. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1864385 - https://www.mozilla.org/security/advisories/mfsa2024-05/ - https://www.mozilla.org/security/advisories/mfsa2024-06/ - https://www.mozilla.org/security/advisories/mfsa2024-07/ - https://lists.debian.org/debian-lts-announce/2024/03/msg00000.html - https://lists.debian.org/debian-lts-announce/2024/03/msg00001.html
CVE ID: CVE-2024-1552 State: PUBLISHED Published: 2024-02-20T13:21:36.729Z Last Updated: 2025-03-27T14:51:49.616Z Vendors: Mozilla Products: Firefox, Firefox ESR, Thunderbird Problem Types: Incorrect code generation on 32-bit ARM devices Description: Incorrect code generation could have led to unexpected numeric conversions and potential undefined behavior.*Note:* This issue only affects 32-bit ARM devices. This vulnerability affects Firefox < 123, Firefox ESR < 115.8, and Thunderbird < 115.8. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1874502 - https://www.mozilla.org/security/advisories/mfsa2024-05/
ences: - https://bugzilla.mozilla.org/show_bug.cgi?id=1874502 - https://www.mozilla.org/security/advisories/mfsa2024-05/ - https://www.mozilla.org/security/advisories/mfsa2024-06/ - https://www.mozilla.org/security/advisories/mfsa2024-07/ - https://lists.debian.org/debian-lts-announce/2024/03/msg00000.html - https://lists.debian.org/debian-lts-announce/2024/03/msg00001.html
CVE ID: CVE-2024-1553 State: PUBLISHED Published: 2024-02-20T13:21:37.066Z Last Updated: 2025-03-13T14:20:51.105Z Vendors: Mozilla Products: Firefox, Firefox ESR, Thunderbird Problem Types: Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8, and Thunderbird 115.8 Description: Memory safety bugs present in Firefox 122, Firefox ESR 115.7, and Thunderbird 115.7. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 123, Firefox ESR < 115.8, and Thunderbird < 115.8. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: Referenc
R < 115.8, and Thunderbird < 115.8. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://bugzilla.mozilla.org/buglist.cgi?bug_id=1855686%2C1867982%2C1871498%2C1872296%2C1873521%2C1873577%2C1873597%2C1873866%2C1874080%2C1874740%2C1875795%2C1875906%2C1876425%2C1878211%2C1878286 - https://www.mozilla.org/security/advisories/mfsa2024-05/ - https://www.mozilla.org/security/advisories/mfsa2024-06/ - https://www.mozilla.org/security/advisories/mfsa2024-07/ - https://lists.debian.org/debian-lts-announce/2024/03/msg00000.html - https://lists.debian.org/debian-lts-announce/2024/03/msg00001.html