Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-6505 State: PUBLISHED Published: 2024-07-05T13:51:38.241Z Last Updated: 2025-11-08T07:13:50.565Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H) Vendors: Red Hat Products: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 8 Advanced Virtualization, Red Hat Enterprise Linux 9 Problem Types: CWE-125 Description: A flaw was found in the virtio-net device in QEMU. When enabling the RSS feature on the virtio-net network card, the indirections_table data within RSS becomes controllable. Setting excessively large values may cause an index out-of-bounds issue, potentially
ta within RSS becomes controllable. Setting excessively large values may cause an index out-of-bounds issue, potentially resulting in heap overflow access. This flaw allows a privileged user in the guest to crash the QEMU process on the host. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://access.redhat.com/security/cve/CVE-2024-6505 - https://bugzilla.redhat.com/show_bug.cgi?id=2295760
CVE ID: CVE-2024-6506 State: PUBLISHED Published: 2024-07-04T12:52:15.521Z Last Updated: 2024-08-01T21:41:03.535Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L) Vendors: MRW Products: MRW plugin Problem Types: CWE-200 Description: Information exposure vulnerability in the MRW plugin, in its 5.4.3 version, affecting the "mrw_log" functionality. This vulnerability could allow a remote attacker to obtain other customers' order information and access sensitive information such as name and phone number. This vulnerability also allows an attacker to create or overwrite shipping labels. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: -
or overwrite shipping labels. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/information-exposure-vulnerability-mrw-plug
CVE ID: CVE-2024-6507 State: PUBLISHED Published: 2024-07-04T11:58:21.520Z Last Updated: 2024-11-25T12:51:41.531Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Problem Types: CWE-78 Description: Command injection when ingesting a remote Kaggle dataset due to a lack of input sanitization in the ingest_kaggle() API Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://research.jfrog.com/vulnerabilities/deeplake-kaggle-command-injection-jfsa-2024-001035320/ - https://github.com/activeloopai/deeplake/pull/2876
CVE ID: CVE-2024-6508 State: PUBLISHED Published: 2024-08-21T05:45:28.303Z Last Updated: 2025-11-11T15:29:16.771Z Severity: HIGH (CVSS 8 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H) Vendors: Red Hat Products: Red Hat OpenShift Container Platform 4.12, Red Hat OpenShift Container Platform 4.13, Red Hat OpenShift Container Platform 4.14, Red Hat OpenShift Container Platform 4.15, Red Hat OpenShift Container Platform 4.16, Red Hat OpenShift Container Platform 4.17 Problem Types: CWE-331 Description: An insufficient entropy vulnerability was found in the Openshift Console. In the authorization code type and implicit grant type, the OAuth2 protocol is vulnerable to a Cross-Site Request Forgery (
the authorization code type and implicit grant type, the OAuth2 protocol is vulnerable to a Cross-Site Request Forgery (CSRF) attack if the state parameter is used inefficiently. This flaw allows logging into the victim’s current application account using a third-party account without any restrictions. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://access.redhat.com/errata/RHSA-2024:10813 - https://access.redhat.com/errata/RHSA-2024:7922 - https://access.redhat.com/errata/RHSA-2024:8415 - https://access.redhat.com/errata/RHSA-2024:8991 - https://access.redhat.com/errata/RHSA-2024:9620 - https://access.redhat.com/errata/RHSA-2025:0014 - https://access.redhat.com/secu
cess.redhat.com/errata/RHSA-2024:9620 - https://access.redhat.com/errata/RHSA-2025:0014 - https://access.redhat.com/security/cve/CVE-2024-6508 - https://bugzilla.redhat.com/show_bug.cgi?id=2295777
CVE ID: CVE-2024-6509 State: PUBLISHED Published: 2024-09-10T04:58:28.559Z Last Updated: 2025-03-28T07:27:30.180Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: Axis Communications AB Products: AXIS OS Problem Types: CWE-155 Description: Marinus Pfund, member of the AXIS OS Bug Bounty Program, has found the VAPIX API alwaysmulti.cgi was vulnerable for file globbing which could lead to resource exhaustion of the Axis device. Axis has released patched AXIS OS versions for the highlighted flaw. Please refer to the Axis security advisory for more information and solution. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.axis.com/dam/
ore information and solution. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.axis.com/dam/public/f6/c6/f5/cve-2024-6509-en-US-458043.pdf
CVE ID: CVE-2024-6510 State: PUBLISHED Published: 2024-09-12T14:18:32.152Z Last Updated: 2024-09-12T15:12:46.476Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: AVG Products: Internet Security Problem Types: CWE-749, CWE-427, CWE-732 Description: Local Privilege Escalation in AVG Internet Security v24 on Windows allows a local unprivileged user to escalate privileges to SYSTEM via COM-Hijacking. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cirosec.de/sa/sa-2023-008
CVE ID: CVE-2024-6511 State: PUBLISHED Published: 2024-07-04T19:00:08.627Z Last Updated: 2024-08-01T21:41:03.826Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: y_project Products: RuoYi Problem Types: CWE-79 Description: A vulnerability classified as problematic was found in y_project RuoYi up to 4.7.9. Affected by this vulnerability is the function isJsonRequest of the component Content-Type Handler. The manipulation of the argument HttpHeaders.CONTENT_TYPE leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-270343. Additional Analyst Notes: - CIS
e public and may be used. The associated identifier of this vulnerability is VDB-270343. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.270343 - https://vuldb.com/?ctiid.270343 - https://gitee.com/y_project/RuoYi/issues/IA8O7O
CVE ID: CVE-2024-6512 State: PUBLISHED Published: 2024-09-25T13:55:28.818Z Last Updated: 2025-03-14T15:49:24.390Z Vendors: Devolutions Products: Devolutions Server Problem Types: CWE-863 Description: Authorization bypass in the PAM access request approval mechanism in Devolutions Server 2024.2.10 and earlier allows authenticated users with permissions to approve their own requests, bypassing intended security restrictions, via the PAM access request approval mechanism. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://devolutions.net/security/advisories/DEVO-2024-0013
CVE ID: CVE-2024-6513 State: REJECTED Published: N/A Last Updated: 2024-07-04T15:23:07.479Z Description: No description available.
CVE ID: CVE-2024-6515 State: PUBLISHED Published: 2024-12-05T12:22:36.946Z Last Updated: 2024-12-05T18:50:20.432Z Severity: CRITICAL (CVSS 9.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N) Vendors: ABB Products: ASPECT-Enterprise, NEXUS Series, MATRIX Series Problem Types: CWE-319 Description: Web browser interface may manipulate application username/password in clear text or Base64 encoding providing a higher probability of unintended credentails exposure. Affected products: ABB ASPECT - Enterprise v3.08.02; NEXUS Series v3.08.02; MATRIX Series v3.08.02 Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://search.abb.com/library/Download.aspx?DocumentID=9AKK108469A7497&La
Notes: - CISA ADP Vulnrichment: References: - https://search.abb.com/library/Download.aspx?DocumentID=9AKK108469A7497&LanguageCode=en&DocumentPartId=&Action=Launch
CVE ID: CVE-2024-6516 State: PUBLISHED Published: 2024-12-05T12:24:16.644Z Last Updated: 2024-12-05T18:50:07.866Z Severity: CRITICAL (CVSS 9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:L) Vendors: ABB Products: ASPECT-Enterprise, NEXUS Series, MATRIX Series Problem Types: CWE-79 Description: Cross Site Scripting vulnerabilities where found providing a potential for malicious scripts to be injected into a client browser. Affected products: ABB ASPECT - Enterprise v3.08.02; NEXUS Series v3.08.02; MATRIX Series v3.08.02 Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://search.abb.com/library/Download.aspx?DocumentID=9AKK108469A7497&LanguageCode=en&DocumentPartId=&Action=La
ces: - https://search.abb.com/library/Download.aspx?DocumentID=9AKK108469A7497&LanguageCode=en&DocumentPartId=&Action=Launch
CVE ID: CVE-2024-6517 State: PUBLISHED Published: 2024-09-26T06:00:02.953Z Last Updated: 2025-03-14T15:17:21.018Z Vendors: Unknown Products: Contact Form 7 Math Captcha Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Contact Form 7 Math Captcha WordPress plugin through 2.0.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/d04bab9c-7cb4-4d21-b70b-a4a7fabc3c20/
CVE ID: CVE-2024-6518 State: PUBLISHED Published: 2024-07-27T11:37:31.961Z Last Updated: 2024-08-01T21:41:03.487Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N) Vendors: techjewel Products: Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder Problem Types: CWE-79 Description: The Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 5.1.19 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Administrator-level access and above, to inje
output escaping. This makes it possible for authenticated attackers, with Administrator-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/66ca9c39-1ba0-4208-ae35-d2c3c9ea4eb9?source=cve - https://wordpress.org/plugins/fluentform/#developers - https://plugins.trac.wordpress.org/changeset/3125227/
CVE ID: CVE-2024-6519 State: PUBLISHED Published: 2024-10-21T14:36:40.115Z Last Updated: 2024-10-21T15:49:23.239Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: Red Hat Products: Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 8 Advanced Virtualization, Red Hat Enterprise Linux 9 Problem Types: CWE-416 Description: A use-after-free vulnerability was found in the QEMU LSI53C895A SCSI Host Bus Adapter emulation. This issue can lead to a crash or VM escape. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://access.redhat.com/security/cve/CVE-2024-6519 - https://bugzilla.redhat.com
CISA ADP Vulnrichment: References: - https://access.redhat.com/security/cve/CVE-2024-6519 - https://bugzilla.redhat.com/show_bug.cgi?id=2292089 - https://www.zerodayinitiative.com/advisories/ZDI-24-1382/
CVE ID: CVE-2024-6520 State: PUBLISHED Published: 2024-07-27T11:37:29.048Z Last Updated: 2024-08-01T21:41:03.483Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N) Vendors: techjewel Products: Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder Problem Types: CWE-79 Description: The Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 5.1.19 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Administrator-level access and above, to inje
output escaping. This makes it possible for authenticated attackers, with Administrator-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/0a30d35c-9883-4b0f-83a2-494401c45d8e?source=cve - https://wordpress.org/plugins/fluentform/#developers - https://plugins.trac.wordpress.org/changeset/3125227/
CVE ID: CVE-2024-6521 State: PUBLISHED Published: 2024-07-27T11:13:38.635Z Last Updated: 2024-08-01T21:41:03.539Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N) Vendors: techjewel Products: Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder Problem Types: CWE-79 Description: The Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 5.1.19 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Administrator-level access and above, to inje
output escaping. This makes it possible for authenticated attackers, with Administrator-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/be7c6cfa-6cac-46d2-8eb9-9fef8049f6e7?source=cve - https://wordpress.org/plugins/fluentform/#developers - https://plugins.trac.wordpress.org/changeset/3125227/
CVE ID: CVE-2024-6522 State: PUBLISHED Published: 2024-08-07T11:00:06.508Z Last Updated: 2024-08-07T13:17:59.476Z Severity: HIGH (CVSS 8.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N) Vendors: Webnus, webnus/ Products: Modern Events Calendar, Modern Events Calendar Lite Problem Types: CWE-918 Description: The Modern Events Calendar plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 7.12.1 via the 'mec_fes_form' AJAX function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify informa
ake web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/00bf8f2f-6ab4-4430-800b-5b97abe7589e?source=cve - https://wordpress.org/plugins/modern-events-calendar-lite/#developers - https://plugins.trac.wordpress.org/browser/modern-events-calendar-lite/trunk/app/features/fes.php#L54 - https://mec.webnus.net/change-log/
CVE ID: CVE-2024-6523 State: PUBLISHED Published: 2024-07-05T11:00:05.305Z Last Updated: 2024-08-01T21:41:03.907Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: ZKTeco Products: BioTime Problem Types: CWE-79 Description: A vulnerability was found in ZKTeco BioTime up to 9.5.2. It has been classified as problematic. Affected is an unknown function of the component system-group-add Handler. The manipulation of the argument user with the input <script>alert('XSS')</script> leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-270366 is the identifier assigned to this vulnerability. NOTE: The ven
been disclosed to the public and may be used. VDB-270366 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.270366 - https://vuldb.com/?ctiid.270366 - https://vuldb.com/?submit.364104 - https://gist.github.com/whiteman007/c8bf92b0294cd2f0cda6bfaca36f8f28
CVE ID: CVE-2024-6524 State: PUBLISHED Published: 2024-07-05T12:00:06.218Z Last Updated: 2024-08-01T21:41:03.538Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: n/a Products: ShopXO Problem Types: CWE-918 Description: A vulnerability was found in ShopXO up to 6.1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file extend/base/Uploader.php. The manipulation of the argument source leads to server-side request forgery. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-270367. NOTE: The original disclosure confuses CSRF with
be used. The associated identifier of this vulnerability is VDB-270367. NOTE: The original disclosure confuses CSRF with SSRF. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.270367 - https://vuldb.com/?ctiid.270367 - https://vuldb.com/?submit.365173 - https://github.com/J1rrY-learn/learn/blob/main/shopxo_ssrf.md
CVE ID: CVE-2024-6525 State: PUBLISHED Published: 2024-07-05T13:00:06.909Z Last Updated: 2024-08-01T21:41:03.833Z Severity: N/A (CVSS 3.3 AV:N/AC:L/Au:M/C:P/I:N/A:N) Vendors: D-Link Products: DAR-7000 Problem Types: CWE-502 Description: ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in D-Link DAR-7000 up to 20230922. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /log/decodmail.php. The manipulation of the argument file leads to deserialization. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-270368. NOTE: This vulnerability only affect
to the public and may be used. The identifier of this vulnerability is VDB-270368. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.270368 - https://vuldb.com/?ctiid.270368 - https://vuldb.com/?submit.368099 - https://github.com/flyyue2001/cve/blob/main/D-LINK%20-DAR-7000_rce_%20decodmail.md - https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10354
CVE ID: CVE-2024-6526 State: PUBLISHED Published: 2024-07-05T13:31:04.482Z Last Updated: 2024-08-01T21:41:03.521Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: CodeIgniter Products: Ecommerce-CodeIgniter-Bootstrap Problem Types: CWE-79 Description: A vulnerability classified as problematic has been found in CodeIgniter Ecommerce-CodeIgniter-Bootstrap up to 1998845073cf433bc6c250b0354461fbd84d0e03. This affects an unknown part. The manipulation of the argument search_title/catName/sub/name/categorie leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of the patch is 1b3da45308b
ttack remotely. The exploit has been disclosed to the public and may be used. The identifier of the patch is 1b3da45308bb6c3f55247d0e99620b600bd85277. It is recommended to apply a patch to fix this issue. The identifier VDB-270369 was assigned to this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.270369 - https://vuldb.com/?ctiid.270369 - https://vuldb.com/?submit.368472 - https://github.com/kirilkirkov/Ecommerce-CodeIgniter-Bootstrap/issues/263 - https://github.com/kirilkirkov/Ecommerce-CodeIgniter-Bootstrap/issues/263#issuecomment-2199387443 - https://github.com/kirilkirkov/Ecommerce-CodeIgniter-Bootstrap/comm
niter-Bootstrap/issues/263#issuecomment-2199387443 - https://github.com/kirilkirkov/Ecommerce-CodeIgniter-Bootstrap/commit/1b3da45308bb6c3f55247d0e99620b600bd85277
CVE ID: CVE-2024-6527 State: PUBLISHED Published: 2024-07-09T13:30:44.606Z Last Updated: 2024-08-01T21:41:03.528Z Vendors: Jan Syski Products: MegaBIP Problem Types: CWE-89 Description: SQL Injection vulnerability in parameter "w" in file "druk.php" in MegaBIP software allows unauthorized attacker to disclose the contents of the database and obtain administrator's token to modify the content of pages. This issue affects MegaBIP software versions through 5.13. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://cert.pl/en/posts/2024/07/CVE-2024-6527/ - https://cert.pl/posts/2024/07/CVE-2024-6527/ - https://megabip.pl/ - https://www.gov.pl/web/cyfr
024/07/CVE-2024-6527/ - https://cert.pl/posts/2024/07/CVE-2024-6527/ - https://megabip.pl/ - https://www.gov.pl/web/cyfryzacja/rekomendacja-pelnomocnika-rzadu-ds-cyberbezpieczenstwa-dotyczaca-biuletynow-informacji-publicznej
CVE ID: CVE-2024-6528 State: PUBLISHED Published: 2024-07-11T09:03:27.074Z Last Updated: 2024-08-01T21:41:03.525Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: Schneider Electric Products: Modicon Controllers M241 / M251, Modicon Controllers M258 / LMC058, Modicon Controllers M262 Problem Types: CWE-79 Description: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists that could cause a vulnerability leading to a cross-site scripting condition where attackers can have a victim’s browser run arbitrary JavaScript when they visit a page containing the injected payload. Additional Analyst Notes: - CIS
browser run arbitrary JavaScript when they visit a page containing the injected payload. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2024-191-04&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2024-191-04.pdf
CVE ID: CVE-2024-6529 State: PUBLISHED Published: 2024-08-01T06:00:05.939Z Last Updated: 2024-08-01T13:26:14.032Z Vendors: Unknown Products: Ultimate Classified Listings Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Ultimate Classified Listings WordPress plugin before 1.4 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/1a346c9a-cc1a-46b1-b27a-a77a38449933/
CVE ID: CVE-2024-6530 State: PUBLISHED Published: 2024-10-10T12:02:10.807Z Last Updated: 2024-10-10T13:32:29.455Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N) Vendors: GitLab Products: GitLab Problem Types: CWE-79 Description: A cross-site scripting issue has been discovered in GitLab affecting all versions starting from 17.1 prior 17.2.9, starting from 17.3 prior to 17.3.5, and starting from 17.4 prior to 17.4.2. When adding a authorizing an application, it can be made to render as HTML under specific circumstances. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/471049 - https://hackerone.com/reports/2
A ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/471049 - https://hackerone.com/reports/2567533
CVE ID: CVE-2024-6531 State: REJECTED Published: 2024-07-11T17:15:57.820Z Last Updated: 2025-08-01T17:12:55.431Z Description: No description available.