Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-2734 State: PUBLISHED Published: 2024-04-10T04:30:19.296Z Last Updated: 2024-08-01T19:25:41.312Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: boldthemes Products: Bold Page Builder Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's AI features all versions up to, and including, 4.8.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inj
supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/650b5677-7c70-415f-81bf-12514393e4c9?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3064413%40bold-page-builder&new=3064413%40bold-page-builder&sfp_email=&sfph_mail=
CVE ID: CVE-2024-2735 State: PUBLISHED Published: 2024-04-10T04:30:19.748Z Last Updated: 2024-08-01T19:25:41.808Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: boldthemes Products: Bold Page Builder Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Price List' element in all versions up to, and including, 4.8.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to
er supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/6cc4a67b-81fa-4ef6-9167-eab5cb9002ec?source=cve - https://plugins.trac.wordpress.org/changeset/3064413/bold-page-builder/trunk/bold-builder.php
CVE ID: CVE-2024-2736 State: PUBLISHED Published: 2024-04-10T04:30:20.195Z Last Updated: 2024-08-01T19:25:41.284Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: boldthemes Products: Bold Page Builder Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via HTML Tags in all versions up to, and including, 4.8.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrar
ributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/86cf664f-5de1-4692-96b3-2fd8ae35110b?source=cve - https://plugins.trac.wordpress.org/changeset/3064413/bold-page-builder/trunk/content_elements/bt_bb_headline/bt_bb_headline.php
CVE ID: CVE-2024-2738 State: PUBLISHED Published: 2024-04-09T18:58:55.481Z Last Updated: 2024-08-21T21:18:30.860Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: mbis Products: Permalink Manager Lite, Permalink Manager Pro Problem Types: CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) Description: The Permalink Manager Lite and Pro plugins for WordPress are vulnerable to Reflected Cross-Site Scripting via the ‘s’ parameter in multiple instances in all versions up to, and including, 2.4.3.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary w
cient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/7020d5a1-a4a6-489c-8615-bc7898553bcf?source=cve - https://gist.github.com/Xib3rR4dAr/561ac3c17b92cb55d3032504a076fa4b - https://gist.github.com/Xib3rR4dAr/b1eec00e844932c6f2f30a63024b404e - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3052848%40permalink-manager%2Ftrunk&
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3052848%40permalink-manager%2Ftrunk&old=3034660%40permalink-manager%2Ftrunk&sfp_email=&sfph_mail=
CVE ID: CVE-2024-2739 State: PUBLISHED Published: 2024-04-15T05:00:05.507Z Last Updated: 2025-03-20T19:02:32.490Z Vendors: Unknown Products: Advanced Search Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The Advanced Search WordPress plugin through 1.1.6 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://wpscan.com/vulnerability/5b84145b-f94e-4ea7-84d5-56cf776817a2/
CVE ID: CVE-2024-2740 State: PUBLISHED Published: 2024-03-21T11:40:25.565Z Last Updated: 2024-08-13T13:15:03.030Z Severity: HIGH (CVSS 7.7 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) Vendors: Planet Products: IGS-4215-16T2S Problem Types: CWE-200 Description: Information exposure vulnerability in Planet IGS-4215-16T2S, affecting firmware version 1.305b210528. This vulnerability could allow a remote attacker to access some administrative resources due to lack of proper management of the Switch web interface. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso-sci/multiple-vulnerabilities-planet-igs-4215
nrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso-sci/multiple-vulnerabilities-planet-igs-4215-16t2s
CVE ID: CVE-2024-2741 State: PUBLISHED Published: 2024-03-21T11:43:05.320Z Last Updated: 2024-08-13T13:14:50.284Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N) Vendors: Planet Products: IGS-4215-16T2S Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Planet IGS-4215-16T2S, affecting firmware version 1.305b210528. This vulnerability could allow a remote attacker to trick some authenticated users into performing actions in their session, such as adding or updating accounts through the Switch web interface. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/n
al Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso-sci/multiple-vulnerabilities-planet-igs-4215-16t2s
CVE ID: CVE-2024-2742 State: PUBLISHED Published: 2024-03-21T11:45:41.162Z Last Updated: 2024-08-13T13:14:59.139Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Planet Products: IGS-4215-16T2S Problem Types: CWE-78 Description: Operating system command injection vulnerability in Planet IGS-4215-16T2S, affecting firmware version 1.305b210528. An authenticated attacker could execute arbitrary code on the remote host by exploiting IP address functionality. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso-sci/multiple-vulnerabilities-planet-igs-4215-16t2s
CVE ID: CVE-2024-2743 State: PUBLISHED Published: 2024-09-12T16:57:23.260Z Last Updated: 2024-09-13T14:17:32.500Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: GitLab Products: GitLab Problem Types: CWE-863 Description: An issue was discovered in GitLab-EE starting with version 13.3 before 17.1.7, 17.2 before 17.2.5, and 17.3 before 17.3.2 that would allow an attacker to modify an on-demand DAST scan without permissions and leak variables. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/451014 - https://hackerone.com/reports/2411756
CVE ID: CVE-2024-2744 State: PUBLISHED Published: 2024-05-17T06:00:02.141Z Last Updated: 2025-03-27T16:35:16.736Z Vendors: Unknown Products: NextGEN Gallery Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The NextGEN Gallery WordPress plugin before 3.59.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://wpscan.com/vulnerability/a5579c15-50ba-4618-95e4-04b2033d721f/
CVE ID: CVE-2024-2745 State: PUBLISHED Published: 2024-04-02T09:51:52.370Z Last Updated: 2024-08-01T19:25:41.647Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: Rapid7 Products: InsightVM Problem Types: CWE-598 Description: Rapid7's InsightVM maintenance mode login page suffers from a sensitive information exposure vulnerability whereby, sensitive information is exposed through query strings in the URL when login is attempted before the page is fully loaded. This vulnerability allows attackers to acquire sensitive information such as passwords, auth tokens, usernames etc. The vulnerability is remediated in version 6.6.244. Additional Analyst Notes: - CISA ADP
s, auth tokens, usernames etc. The vulnerability is remediated in version 6.6.244. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://docs.rapid7.com/release-notes/insightvm/20240327/
CVE ID: CVE-2024-2746 State: PUBLISHED Published: 2024-05-08T01:55:10.092Z Last Updated: 2024-08-12T18:29:59.508Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: Fedora Products: dnf5daemon-server Problem Types: CWE-20 Description: Incomplete fix for CVE-2024-1929 The problem with CVE-2024-1929 was that the dnf5 D-Bus daemon accepted arbitrary configuration parameters from unprivileged users, which allowed a local root exploit by tricking the daemon into loading a user controlled "plugin". All of this happened before Polkit authentication was even started. The dnf5 library code does not check whether non-root users control the directory in question. On one han
even started. The dnf5 library code does not check whether non-root users control the directory in question. On one hand, this poses a Denial-of-Service attack vector by making the daemonoperate on a blocking file (e.g. named FIFO special file) or a very large file that causes an out-of-memory situation (e.g. /dev/zero). On the other hand, this can be used to let the daemon process privileged files like /etc/shadow. The file in question is parsed as an INI file. Error diagnostics resulting from parsing privileged files could cause information leaks, if these diagnostics are accessible to unprivileged users. In the case of libdnf5, no such user accessible diagnostics should exist, though. Al
e accessible to unprivileged users. In the case of libdnf5, no such user accessible diagnostics should exist, though. Also, a local attacker can place a valid repository configuration file in this directory. This configuration file allows to specify a plethora of additional configuration options. This makes various additional code paths in libdnf5 accessible to the attacker. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.openwall.com/lists/oss-security/2024/04/03/5
CVE ID: CVE-2024-2747 State: PUBLISHED Published: 2024-06-12T17:12:20.482Z Last Updated: 2024-08-19T17:40:23.892Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Schneider Electric Products: Easergy Studio Problem Types: CWE-428 Description: CWE-428: Unquoted search path or element vulnerability exists in Easergy Studio, which could cause privilege escalation when a valid user replaces a trusted file name on the system and reboots the machine. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2024-100-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2
wnload.schneider-electric.com/files?p_Doc_Ref=SEVD-2024-100-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2024-100-01.pdf
CVE ID: CVE-2024-2748 State: PUBLISHED Published: 2024-03-20T23:09:40.032Z Last Updated: 2024-08-02T19:20:10.085Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: GitHub Products: Enterprise Server Problem Types: CWE-352 Description: A Cross Site Request Forgery vulnerability was identified in GitHub Enterprise Server that allowed an attacker to execute unauthorized actions on behalf of an unsuspecting user. A mitigating factor is that user interaction is required. This vulnerability affected GitHub Enterprise Server 3.12.0 and was fixed in versions 3.12.1. This vulnerability was reported via the GitHub Bug Bounty program. Additional Analyst Notes: - CVE Prog
versions 3.12.1. This vulnerability was reported via the GitHub Bug Bounty program. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://docs.github.com/en/enterprise-server@3.12/admin/release-notes/#3.12.1
CVE ID: CVE-2024-2749 State: PUBLISHED Published: 2024-05-10T06:00:02.386Z Last Updated: 2024-08-01T19:25:41.264Z Vendors: Unknown Products: VikBooking Hotel Booking Engine & PMS Problem Types: CWE-284 Improper Access Control Description: The VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.6.8's access control mechanism fails to properly restrict access to its settings, permitting any users that can access a menu to manipulate requests and perform unauthorized actions such as editing, renaming or deleting (categories for example) despite initial settings prohibiting such access. This vulnerability resembles broken access control, enabling unauthorized users to modify critical
hibiting such access. This vulnerability resembles broken access control, enabling unauthorized users to modify critical VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.6.8 configurations. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://wpscan.com/vulnerability/c0640d3a-80b3-4cad-a3cf-fb5d86558e91/
CVE ID: CVE-2024-2750 State: PUBLISHED Published: 2024-05-02T16:51:56.433Z Last Updated: 2024-08-01T19:25:41.435Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: timstrifler Products: Exclusive Addons for Elementor Problem Types: CWE-87 Improper Neutralization of Alternate XSS Syntax Description: The Exclusive Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the URL attribute of the Button widget in all versions up to, and including, 2.6.9.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor access or higher, to inject arbitrary web scripts
. This makes it possible for authenticated attackers, with contributor access or higher, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/3011b783-e4b4-45d2-81af-2f8d166a30ac?source=cve - https://plugins.trac.wordpress.org/changeset/3072751/exclusive-addons-for-elementor/trunk/elements/button/button.php
CVE ID: CVE-2024-2751 State: PUBLISHED Published: 2024-05-02T16:52:49.617Z Last Updated: 2024-08-01T19:25:41.295Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: timstrifler Products: Exclusive Addons for Elementor Problem Types: CWE-20 Improper Input Validation Description: The Exclusive Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘exad_infobox_animating_mask_style’ parameter in all versions up to, and including, 2.6.9.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor access or higher, to inject arbitrary web scripts in pages t
s it possible for authenticated attackers, with contributor access or higher, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/e9ad2dff-0c6d-4d91-a35d-803b97def01f?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3065677%40exclusive-addons-for-elementor%2Ftrunk&old=3051927%40exclusive-addons-for-elementor%2Ftrunk&sfp_email=&sfph_mail=#file51
CVE ID: CVE-2024-2752 State: PUBLISHED Published: 2024-05-02T16:52:53.708Z Last Updated: 2024-08-01T19:25:41.330Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N) Vendors: wooassist Products: Where Did You Hear About Us Checkout Field for WooCommerce Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Where Did You Hear About Us Checkout Field for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via order meta in all versions up to, and including, 1.3.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with
.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with shop manager-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/fbee3720-6ab9-4470-b2d2-09824db8de4d?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3075865%40wc-customer-source%2Ftrunk&old=3054024%40wc-customer-source%2Ftrunk&sfp_email=&sfph_mail=
CVE ID: CVE-2024-2753 State: PUBLISHED Published: 2024-04-03T18:13:41.128Z Last Updated: 2024-08-30T21:20:32.821Z Severity: LOW (CVSS 2 CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:N/A:N) Vendors: Concrete CMS Products: Concrete CMS Problem Types: CWE-79 Description: Concrete CMS version 9 before 9.2.8 and previous versions prior to 8.5.16 is vulnerable to Stored XSS on the calendar color settings screen since Information input by the user is output without escaping. A rogue administrator could inject malicious javascript into the Calendar Color Settings screen which might be executed when users visit the affected page. The Concrete CMS security team gave this vulnerability a CVSS v3.1 score of 2.
cuted when users visit the affected page. The Concrete CMS security team gave this vulnerability a CVSS v3.1 score of 2.0 with a vector of AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:N/A:N&version=3.1 https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator Thank you Rikuto Tauchi for reporting Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://documentation.concretecms.org/developers/introduction/version-history/8516-release-notes?_gl=1*1oa3zn1*_ga*MTc1NDc0Njk2Mi4xNzA2ODI4MDU1*_ga_HFB3HPNNLS*MTcxMjE2NjYyNi4xMy4xLjE3MTIxNjY3MDcuMC4wLjA. - https://documentation.concretecms.org/9-x/developers/introduction/version-history/928-release-notes?_gl=1*1bcxp5s*_ga*MTc1NDc0
//documentation.concretecms.org/9-x/developers/introduction/version-history/928-release-notes?_gl=1*1bcxp5s*_ga*MTc1NDc0Njk2Mi4xNzA2ODI4MDU1*_ga_HFB3HPNNLS*MTcxMjE2NjYyNi4xMy4xLjE3MTIxNjY2ODEuMC4wLjA.
CVE ID: CVE-2024-2754 State: PUBLISHED Published: 2024-03-21T07:00:08.978Z Last Updated: 2024-08-01T19:25:41.660Z Severity: N/A (CVSS 5.8 AV:N/AC:L/Au:M/C:P/I:P/A:P) Vendors: SourceCodester Products: Complete E-Commerce Site Problem Types: CWE-434 Description: A vulnerability classified as critical has been found in SourceCodester Complete E-Commerce Site 1.0. Affected is an unknown function of the file /admin/users_photo.php. The manipulation of the argument photo leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-257544. Additional Analyst Notes: - CISA ADP Vul
the public and may be used. The identifier of this vulnerability is VDB-257544. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.257544 - https://vuldb.com/?ctiid.257544 - https://github.com/wkeyi0x1/vul-report/issues/4
CVE ID: CVE-2024-2756 State: PUBLISHED Published: 2024-04-29T03:34:16.912Z Last Updated: 2025-11-04T17:18:00.434Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N) Vendors: PHP Group Products: PHP Problem Types: CWE-20 Description: Due to an incomplete fix to CVE-2022-31629 https://github.com/advisories/GHSA-c43m-486j-j32p , network and same-site attackers can set a standard insecure cookie in the victim's browser which is treated as a __Host- or __Secure- cookie by PHP applications. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/php/php-src/security/advisories/GHSA-wpj3-hf5j-x4v4 - http://www.openwall.com/l
tainer: References: - https://github.com/php/php-src/security/advisories/GHSA-wpj3-hf5j-x4v4 - http://www.openwall.com/lists/oss-security/2024/04/12/11 - https://lists.debian.org/debian-lts-announce/2024/05/msg00005.html - https://security.netapp.com/advisory/ntap-20240510-0008/
CVE ID: CVE-2024-2757 State: PUBLISHED Published: 2024-04-29T03:49:15.519Z Last Updated: 2025-11-04T17:18:03.534Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: PHP Group Products: PHP Description: In PHP 8.3.* before 8.3.5, function mb_encode_mimeheader() runs endlessly for some inputs that contain long strings of non-space characters followed by a space. This could lead to a potential DoS attack if a hostile user sends data to an application that uses this function. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/php/php-src/security/advisories/GHSA-fjp9-9hwx-59fq - http://www.openwall.com/lists/o
: References: - https://github.com/php/php-src/security/advisories/GHSA-fjp9-9hwx-59fq - http://www.openwall.com/lists/oss-security/2024/04/12/11 - https://security.netapp.com/advisory/ntap-20240510-0011/
CVE ID: CVE-2024-2758 State: PUBLISHED Published: 2024-04-03T17:17:56.307Z Last Updated: 2025-02-13T17:46:31.765Z Vendors: Tempesta Products: Tempesta FW Problem Types: CWE-1188: Initialization of a Resource with an Insecure Default, CWE-204: Inadequate Information Flow Control Description: Tempesta FW rate limits are not enabled by default. They are either set too large to capture empty CONTINUATION frames attacks or too small to handle normal HTTP requests appropriately. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/tempesta-tech/tempesta/security/advisories/GHSA-3xwj-5ch3-q9p4 - https://www.kb.cert.org/vuls/id/421644 - http://
ub.com/tempesta-tech/tempesta/security/advisories/GHSA-3xwj-5ch3-q9p4 - https://www.kb.cert.org/vuls/id/421644 - http://www.openwall.com/lists/oss-security/2024/04/03/16