Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-9393 State: PUBLISHED Published: 2024-10-01T15:13:19.123Z Last Updated: 2025-11-03T22:33:27.062Z Vendors: Mozilla Products: Firefox, Firefox ESR, Thunderbird Problem Types: Cross-origin access to PDF contents through multipart responses Description: An attacker could, via a specially crafted multipart response, execute arbitrary JavaScript under the `resource://pdf.js` origin. This could allow them to access cross-origin PDF content. This access is limited to "same site" documents by the Site Isolation feature on desktop clients, but full cross-origin access is possible on Android versions. This vulnerability affects Firefox < 131, Firefox ESR < 128.3, Firefox ESR < 115.16,
s is possible on Android versions. This vulnerability affects Firefox < 131, Firefox ESR < 128.3, Firefox ESR < 115.16, Thunderbird < 128.3, and Thunderbird < 131. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1918301 - https://www.mozilla.org/security/advisories/mfsa2024-46/ - https://www.mozilla.org/security/advisories/mfsa2024-47/ - https://www.mozilla.org/security/advisories/mfsa2024-48/ - https://www.mozilla.org/security/advisories/mfsa2024-49/ - https://www.mozilla.org/security/advisories/mfsa2024-50/
CVE ID: CVE-2024-9394 State: PUBLISHED Published: 2024-10-01T15:13:19.407Z Last Updated: 2025-11-03T22:33:29.991Z Vendors: Mozilla Products: Firefox, Firefox ESR, Thunderbird Problem Types: Cross-origin access to JSON contents through multipart responses Description: An attacker could, via a specially crafted multipart response, execute arbitrary JavaScript under the `resource://devtools` origin. This could allow them to access cross-origin JSON content. This access is limited to "same site" documents by the Site Isolation feature on desktop clients, but full cross-origin access is possible on Android versions. This vulnerability affects Firefox < 131, Firefox ESR < 128.3, Firefox ESR < 115.
ccess is possible on Android versions. This vulnerability affects Firefox < 131, Firefox ESR < 128.3, Firefox ESR < 115.16, Thunderbird < 128.3, and Thunderbird < 131. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1918874 - https://www.mozilla.org/security/advisories/mfsa2024-46/ - https://www.mozilla.org/security/advisories/mfsa2024-47/ - https://www.mozilla.org/security/advisories/mfsa2024-48/ - https://www.mozilla.org/security/advisories/mfsa2024-49/ - https://www.mozilla.org/security/advisories/mfsa2024-50/
CVE ID: CVE-2024-9395 State: PUBLISHED Published: 2024-10-01T15:13:22.545Z Last Updated: 2024-11-08T21:20:45.130Z Vendors: Mozilla Products: Firefox Problem Types: Specially crafted filename could be used to obscure download type Description: A specially crafted filename containing a large number of spaces could obscure the file's extension when displayed in the download dialog. *This bug only affects Firefox for Android. Other versions of Firefox are unaffected.* This vulnerability affects Firefox < 131. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1906024 - https://www.mozilla.org/security/advisories/mfsa2024-46/
CVE ID: CVE-2024-9396 State: PUBLISHED Published: 2024-10-01T15:13:20.007Z Last Updated: 2024-10-01T19:14:43.201Z Vendors: Mozilla Products: Firefox, Firefox ESR, Thunderbird Problem Types: Potential memory corruption may occur when cloning certain objects Description: It is currently unknown if this issue is exploitable but a condition may arise where the structured clone of certain objects could lead to memory corruption. This vulnerability affects Firefox < 131, Firefox ESR < 128.3, Thunderbird < 128.3, and Thunderbird < 131. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1912471 - https://www.mozilla.org/security/advisories/m
ment: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1912471 - https://www.mozilla.org/security/advisories/mfsa2024-46/ - https://www.mozilla.org/security/advisories/mfsa2024-47/ - https://www.mozilla.org/security/advisories/mfsa2024-49/ - https://www.mozilla.org/security/advisories/mfsa2024-50/
CVE ID: CVE-2024-9397 State: PUBLISHED Published: 2024-10-01T15:13:20.274Z Last Updated: 2025-03-18T16:03:28.155Z Vendors: Mozilla Products: Firefox, Firefox ESR, Thunderbird Problem Types: Potential directory upload bypass via clickjacking Description: A missing delay in directory upload UI could have made it possible for an attacker to trick a user into granting permission via clickjacking. This vulnerability affects Firefox < 131, Firefox ESR < 128.3, Thunderbird < 128.3, and Thunderbird < 131. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1916659 - https://www.mozilla.org/security/advisories/mfsa2024-46/ - https://www.mozill
illa.mozilla.org/show_bug.cgi?id=1916659 - https://www.mozilla.org/security/advisories/mfsa2024-46/ - https://www.mozilla.org/security/advisories/mfsa2024-47/ - https://www.mozilla.org/security/advisories/mfsa2024-49/ - https://www.mozilla.org/security/advisories/mfsa2024-50/
CVE ID: CVE-2024-9398 State: PUBLISHED Published: 2024-10-01T15:13:20.488Z Last Updated: 2025-03-18T19:36:14.028Z Vendors: Mozilla Products: Firefox, Firefox ESR, Thunderbird Problem Types: External protocol handlers could be enumerated via popups Description: By checking the result of calls to `window.open` with specifically set protocol handlers, an attacker could determine if the application which implements that protocol handler is installed. This vulnerability affects Firefox < 131, Firefox ESR < 128.3, Thunderbird < 128.3, and Thunderbird < 131. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1881037 - https://www.mozilla.or
es: - CISA ADP Vulnrichment: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1881037 - https://www.mozilla.org/security/advisories/mfsa2024-46/ - https://www.mozilla.org/security/advisories/mfsa2024-47/ - https://www.mozilla.org/security/advisories/mfsa2024-49/ - https://www.mozilla.org/security/advisories/mfsa2024-50/
CVE ID: CVE-2024-9399 State: PUBLISHED Published: 2024-10-01T15:13:20.769Z Last Updated: 2025-03-14T15:39:43.465Z Vendors: Mozilla Products: Firefox, Firefox ESR, Thunderbird Problem Types: Specially crafted WebTransport requests could lead to denial of service Description: A website configured to initiate a specially crafted WebTransport session could crash the Firefox process leading to a denial of service condition. This vulnerability affects Firefox < 131, Firefox ESR < 128.3, Thunderbird < 128.3, and Thunderbird < 131. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1907726 - https://www.mozilla.org/security/advisories/mfsa20
References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1907726 - https://www.mozilla.org/security/advisories/mfsa2024-46/ - https://www.mozilla.org/security/advisories/mfsa2024-47/ - https://www.mozilla.org/security/advisories/mfsa2024-49/ - https://www.mozilla.org/security/advisories/mfsa2024-50/
CVE ID: CVE-2024-9400 State: PUBLISHED Published: 2024-10-01T15:13:20.979Z Last Updated: 2024-10-01T18:43:38.722Z Vendors: Mozilla Products: Firefox, Firefox ESR, Thunderbird Problem Types: Potential memory corruption during JIT compilation Description: A potential memory corruption vulnerability could be triggered if an attacker had the ability to trigger an OOM at a specific moment during JIT compilation. This vulnerability affects Firefox < 131, Firefox ESR < 128.3, Thunderbird < 128.3, and Thunderbird < 131. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1915249 - https://www.mozilla.org/security/advisories/mfsa2024-46/ - htt
- https://bugzilla.mozilla.org/show_bug.cgi?id=1915249 - https://www.mozilla.org/security/advisories/mfsa2024-46/ - https://www.mozilla.org/security/advisories/mfsa2024-47/ - https://www.mozilla.org/security/advisories/mfsa2024-49/ - https://www.mozilla.org/security/advisories/mfsa2024-50/
CVE ID: CVE-2024-9401 State: PUBLISHED Published: 2024-10-01T15:13:21.229Z Last Updated: 2025-11-03T22:33:31.442Z Vendors: Mozilla Products: Firefox, Firefox ESR, Thunderbird Problem Types: Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16, Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3 Description: Memory safety bugs present in Firefox 130, Firefox ESR 115.15, Firefox ESR 128.2, and Thunderbird 128.2. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 131, Firefox ESR < 128.3, Firefox ESR < 115.16, Thunderbird < 128.3, and Thund
ode. This vulnerability affects Firefox < 131, Firefox ESR < 128.3, Firefox ESR < 115.16, Thunderbird < 128.3, and Thunderbird < 131. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://bugzilla.mozilla.org/buglist.cgi?bug_id=1872744%2C1897792%2C1911317%2C1916476 - https://www.mozilla.org/security/advisories/mfsa2024-46/ - https://www.mozilla.org/security/advisories/mfsa2024-47/ - https://www.mozilla.org/security/advisories/mfsa2024-48/ - https://www.mozilla.org/security/advisories/mfsa2024-49/ - https://www.mozilla.org/security/advisories/mfsa2024-50/
CVE ID: CVE-2024-9402 State: PUBLISHED Published: 2024-10-01T15:13:21.493Z Last Updated: 2024-10-01T18:37:41.130Z Vendors: Mozilla Products: Firefox, Firefox ESR, Thunderbird Problem Types: Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3 Description: Memory safety bugs present in Firefox 130, Firefox ESR 128.2, and Thunderbird 128.2. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 131, Firefox ESR < 128.3, Thunderbird < 128.3, and Thunderbird < 131. Additional Analyst Notes: - CISA ADP Vulnrichmen
< 131, Firefox ESR < 128.3, Thunderbird < 128.3, and Thunderbird < 131. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://bugzilla.mozilla.org/buglist.cgi?bug_id=1872744%2C1897792%2C1911317%2C1913445%2C1914106%2C1914475%2C1914963%2C1915008%2C1916476 - https://www.mozilla.org/security/advisories/mfsa2024-46/ - https://www.mozilla.org/security/advisories/mfsa2024-47/ - https://www.mozilla.org/security/advisories/mfsa2024-49/ - https://www.mozilla.org/security/advisories/mfsa2024-50/
CVE ID: CVE-2024-9403 State: PUBLISHED Published: 2024-10-01T15:13:22.837Z Last Updated: 2025-03-19T18:05:46.429Z Vendors: Mozilla Products: Firefox, Thunderbird Problem Types: Memory safety bugs fixed in Firefox 131 and Thunderbird 131 Description: Memory safety bugs present in Firefox 130. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 131 and Thunderbird < 131. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1917807 - https://www.mozilla.org/security/advisories/mfsa2024-46/ - https:
https://bugzilla.mozilla.org/show_bug.cgi?id=1917807 - https://www.mozilla.org/security/advisories/mfsa2024-46/ - https://www.mozilla.org/security/advisories/mfsa2024-50/
CVE ID: CVE-2024-9404 State: PUBLISHED Published: 2024-12-04T03:54:32.073Z Last Updated: 2025-08-27T21:36:46.745Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Moxa Products: VPort 07-3 Series, EDS-608 Series, EDS-611 Series, EDS-616 Series, EDS-619 Series, EDS-405A Series, EDS-408A Series, EDS-505A Series, EDS-508A Series, EDS-510A Series, EDS-516A Series, EDS-518A Series, EDS-G509 Series, EDS-P510 Series, EDS-P510A Series, EDS-510E Series, EDS-518E Series, EDS-528E Series, EDS-G508E Series, EDS-G512E Series, EDS-G516E Series, EDS-P506E Series, ICS-G7526A Series, ICS-G7528A Series, ICS-G7748A Series, ICS-G7750A Series, ICS-G7752A Series, ICS-G7826A Series,
ries, ICS-G7526A Series, ICS-G7528A Series, ICS-G7748A Series, ICS-G7750A Series, ICS-G7752A Series, ICS-G7826A Series, ICS-G7828A Series, ICS-G7848A Series, ICS-G7850A Series, ICS-G7852A Series, IKS-G6524A Series, IKS-6726A Series, IKS-6728A Series, IKS-G6824A Series, SDS-3006 Series, SDS-3008 Series, SDS-3010 Series, SDS-3016 Series, SDS-G3006 Series, SDS-G3008 Series, SDS-G3010 Series, SDS-G3016 Series, PT-7728 Series, PT-7828 Series, PT-G503 Series, PT-G510 Series Problem Types: CWE-1287 Description: This vulnerability could lead to denial-of-service or service crashes. Exploitation of the moxa_cmd service, because of insufficient input validation, allows attackers to disrupt operations.
Exploitation of the moxa_cmd service, because of insufficient input validation, allows attackers to disrupt operations. If exposed to public networks, the vulnerability poses a significant remote threat, potentially allowing attackers to shut down affected systems. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.moxa.com/en/support/product-support/security-advisory/mpsa-240930-cve-2024-9404-denial-of-service-vulnerability-identified-in-the-vport-07-3-series - https://www.moxa.com/en/support/product-support/security-advisory/mpsa-240931-cve-2024-9404-denial-of-service-vulnerability-identified-in-multiple-eds,-ics,-iks,-and-sds-switches - https://www.moxa.com/en/s
-9404-denial-of-service-vulnerability-identified-in-multiple-eds,-ics,-iks,-and-sds-switches - https://www.moxa.com/en/support/product-support/security-advisory/mpsa-240933-cve-2024-9404-denial-of-service-vulnerability-identified-in-multiple-pt-switches
CVE ID: CVE-2024-9405 State: PUBLISHED Published: 2024-10-01T11:22:50.340Z Last Updated: 2024-10-01T13:21:08.955Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Pluck CMS Products: Pluck CMS Problem Types: CWE-23 Description: An incorrect limitation of a path to a restricted directory (path traversal) has been detected in Pluck CMS, affecting version 4.7.18. An unauthenticated attacker could extract sensitive information from the server via the absolute path of a file located in the same directory or subdirectory as the module, but not from recursive directories. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incib
m recursive directories. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/incorrect-limitation-path-restricted-directory-pluck-cms
CVE ID: CVE-2024-9407 State: PUBLISHED Published: 2024-10-01T20:13:29.588Z Last Updated: 2025-11-20T20:58:07.379Z Severity: MEDIUM (CVSS 4.7 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:L/A:N) Vendors: Red Hat Products: Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 9.4 Extended Update Support, Red Hat OpenShift Container Platform 4.16, Red Hat Enterprise Linux 10, Red Hat OpenShift Container Platform 4 Problem Types: CWE-20 Description: A vulnerability exists in the bind-propagation option of the Dockerfile RUN --mount instruction. The system does not properly validate the input passed to this option, allowing users to pass arbitrary parameters to the mount instr
es not properly validate the input passed to this option, allowing users to pass arbitrary parameters to the mount instruction. This issue can be exploited to mount sensitive directories from the host into a container during the build process and, in some cases, modify the contents of those mounted files. Even if SELinux is used, this vulnerability can bypass its protection by allowing the source directory to be relabeled to give the container access to host files. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2024:10147 - https://access.redhat.com/errata/RHSA-2024:8846 - https://access.redhat.com/errata/RHSA-2
t.com/errata/RHSA-2024:10147 - https://access.redhat.com/errata/RHSA-2024:8846 - https://access.redhat.com/errata/RHSA-2024:9051 - https://access.redhat.com/errata/RHSA-2024:9454 - https://access.redhat.com/errata/RHSA-2024:9459 - https://access.redhat.com/errata/RHSA-2024:9926 - https://access.redhat.com/security/cve/CVE-2024-9407 - https://bugzilla.redhat.com/show_bug.cgi?id=2315887
CVE ID: CVE-2024-9408 State: PUBLISHED Published: 2025-07-16T11:15:03.412Z Last Updated: 2025-07-16T15:53:13.391Z Vendors: Eclipse Foundation Products: Eclipse Glassfish Problem Types: CWE-918 Description: In Eclipse GlassFish since version 6.2.5 it is possible to perform a Server Side Request Forgery attack in specific endpoints. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitlab.eclipse.org/security/cve-assignement/-/issues/38
CVE ID: CVE-2024-9409 State: PUBLISHED Published: 2024-11-13T04:29:01.040Z Last Updated: 2024-11-13T14:43:17.912Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Schneider Electric Products: PowerLogic PM5320, PowerLogic PM5340, PowerLogic PM5341 Problem Types: CWE-400 Description: CWE-400: An Uncontrolled Resource Consumption vulnerability exists that could cause the device to become unresponsive resulting in communication loss when a large amount of IGMP packets is present in the network. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://download.schneider-electric.com/doc/SEVD-2024-317-01/SEVD-2024-317-01.pdf
CVE ID: CVE-2024-9410 State: PUBLISHED Published: 2024-10-04T13:23:19.190Z Last Updated: 2024-10-04T18:15:58.083Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: Ada Support Products: Ada.cx Sentry Component Problem Types: CWE-918 Description: Ada.cx's Sentry configuration allowed for blind server-side request forgeries (SSRF) through the use of a data scraping endpoint. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.tenable.com/security/research/tra-2024-41
CVE ID: CVE-2024-9411 State: PUBLISHED Published: 2024-10-01T20:00:13.540Z Last Updated: 2025-08-27T21:36:38.939Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: n/a Products: OFCMS Problem Types: CWE-79 Description: A vulnerability classified as problematic has been found in OFCMS 1.1.2. This affects the function add of the file /admin/system/dict/add.json?sqlid=system.dict.save. The manipulation of the argument dict_value leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.278973 - https://vuldb.com/?ctiid
Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.278973 - https://vuldb.com/?ctiid.278973 - https://gitee.com/oufu/ofcms/issues/IATECW
CVE ID: CVE-2024-9412 State: PUBLISHED Published: 2024-10-08T19:24:41.136Z Last Updated: 2024-10-08T20:01:06.815Z Vendors: Rockwell Automation Products: Verve® Asset Manager Problem Types: CWE-842 Description: An improper authorization vulnerability exists in the Rockwell Automation affected products that could allow an unauthorized user to sign in. While removal of all role mappings is unlikely, it could occur in the case of unexpected or accidental removal by the administrator. If exploited, an unauthorized user could access data they previously but should no longer have access to. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.rockwellautomation.com/en-us/tru
access to. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD%201704.html
CVE ID: CVE-2024-9413 State: PUBLISHED Published: 2024-11-13T16:09:26.331Z Last Updated: 2024-11-27T15:35:14.153Z Vendors: Arm Products: SCP-Firmware Problem Types: CWE-755 Description: The transport_message_handler function in SCP-Firmware release versions 2.11.0-2.15.0 does not properly handle errors, potentially allowing an Application Processor (AP) to cause a buffer overflow in System Control Processor (SCP) firmware. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://developer.arm.com/Arm%20Security%20Center/SCP-Firmware%20Vulnerability
CVE ID: CVE-2024-9414 State: PUBLISHED Published: 2024-10-17T15:59:24.981Z Last Updated: 2024-10-17T17:52:13.378Z Vendors: LCDS - Leão Consultoria e Desenvolvimento de Sistemas Ltda ME Products: LAquis SCADA Problem Types: CWE-79 Description: In LAquis SCADA version 4.7.1.511, a cross-site scripting vulnerability could allow an attacker to inject arbitrary code into a web page. This could allow an attacker to steal cookies, redirect users, or perform unauthorized actions. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-24-291-02
CVE ID: CVE-2024-9415 State: PUBLISHED Published: 2025-03-20T10:09:06.219Z Last Updated: 2025-03-20T18:58:16.596Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: transformeroptimus Products: transformeroptimus/superagi Problem Types: CWE-22 Description: A Path Traversal vulnerability exists in the file upload functionality of transformeroptimus/superagi version 0.0.14. This vulnerability allows an attacker to upload an arbitrary file to the server, potentially leading to remote code execution or overwriting any file on the server. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/31bdf98c-5205-4c48-9bc7-9e780ba63398
CVE ID: CVE-2024-9416 State: PUBLISHED Published: 2025-04-03T12:22:36.058Z Last Updated: 2025-04-03T13:16:35.129Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: wpchill Products: Modula Image Gallery Problem Types: CWE-79 Description: The Modula Image Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's bundled FancyBox JavaScript library (versions <= 5.0.36) due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses
contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/1954040c-2188-48b7-9f21-9a0c851c9165?source=cve - https://plugins.trac.wordpress.org/changeset/3160235/modula-best-grid-gallery
CVE ID: CVE-2024-9417 State: PUBLISHED Published: 2024-10-05T09:39:22.793Z Last Updated: 2024-10-07T14:18:17.516Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: hashthemes Products: Hash Form – Drag & Drop Form Builder Problem Types: CWE-434 Description: The Hash Form – Drag & Drop Form Builder plugin for WordPress is vulnerable to limited file uploads due to a misconfigured file type validation in the 'handleUpload' function in all versions up to, and including, 1.1.9. This makes it possible for unauthenticated attackers to upload files that are excluded from both the 'allowedExtensions' and 'unallowed_extensions' arrays on the affected site's server, incl
hat are excluded from both the 'allowedExtensions' and 'unallowed_extensions' arrays on the affected site's server, including files that may contain cross-site scripting. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/cad7731a-1f81-4055-9b49-15b35edd3fcf?source=cve - https://plugins.trac.wordpress.org/browser/hash-form/trunk/admin/classes/HashFormUploader.php#L107 - https://plugins.trac.wordpress.org/browser/hash-form/trunk/admin/classes/HashFormUploader.php#L135 - https://plugins.trac.wordpress.org/changeset/3161828/