Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
it possible for authenticated attackers, with subscriber access or higher, to interact with questions in courses in which they are not enrolled including private courses. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/e8a7c04a-1fa0-434d-8161-7a32cefb44c4?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3037911%40tutor%2Ftrunk&old=3020286%40tutor%2Ftrunk&sfp_email=&sfph_mail=#file12
CVE ID: CVE-2024-1134 State: PUBLISHED Published: 2024-05-24T05:30:53.488Z Last Updated: 2024-08-01T18:26:30.512Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: rainbowgeek Products: SEOPress – On-site SEO Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The SEOPress – On-site SEO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the SEO title and description parameters as well as others in all versions up to, and including, 7.5.2.1 due to insufficient input sanitization and output escaping. This makes it possible for attackers, with contributor access or higher, to i
nt input sanitization and output escaping. This makes it possible for attackers, with contributor access or higher, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/bc3910e4-649f-45ab-876a-a4b04afac8d2?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3056025%40wp-seopress%2Ftrunk&old=3047913%40wp-seopress%2Ftrunk&sfp_email=&sfph_mail=
CVE ID: CVE-2024-1135 State: PUBLISHED Published: 2024-04-16T00:00:14.938Z Last Updated: 2025-02-13T17:27:34.444Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) Vendors: benoitc Products: benoitc/gunicorn Problem Types: CWE-444 Description: Gunicorn fails to properly validate Transfer-Encoding headers, leading to HTTP Request Smuggling (HRS) vulnerabilities. By crafting requests with conflicting Transfer-Encoding headers, attackers can bypass security restrictions and access restricted endpoints. This issue is due to Gunicorn's handling of Transfer-Encoding headers, where it incorrectly processes requests with multiple, conflicting Transfer-Encoding headers, treating
ncoding headers, where it incorrectly processes requests with multiple, conflicting Transfer-Encoding headers, treating them as chunked regardless of the final encoding specified. This vulnerability allows for a range of attacks including cache poisoning, session manipulation, and data exposure. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://huntr.com/bounties/22158e34-cfd5-41ad-97e0-a780773d96c1 - https://lists.debian.org/debian-lts-announce/2024/06/msg00027.html
CVE ID: CVE-2024-1136 State: PUBLISHED Published: 2024-02-28T08:33:13.484Z Last Updated: 2025-04-22T15:58:35.494Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: wpshopmart Products: Coming Soon Page & Maintenance Mode Problem Types: CWE-862 Missing Authorization Description: The Coming Soon Page & Maintenance Mode plugin for WordPress is vulnerable to unauthorized access of data due to an improperly implemented URL check in the wpsm_coming_soon_redirect function in all versions up to, and including, 2.2.1. This makes it possible for unauthenticated attackers to view a site with maintenance mode or coming-soon mode enabled to view the site's content. Additio
enticated attackers to view a site with maintenance mode or coming-soon mode enabled to view the site's content. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/e3c52d6e-b3f4-4ba8-aee4-b9f11704e1de?source=cve - https://plugins.trac.wordpress.org/browser/responsive-coming-soon/trunk/redirect.php#L11
CVE ID: CVE-2024-1137 State: PUBLISHED Published: 2024-03-12T17:31:19.481Z Last Updated: 2024-10-31T14:50:46.546Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: TIBCO Software Inc. Products: TIBCO ActiveSpaces - Enterprise Edition Problem Types: This impact of this vulnerability includes the theoretical possibility of bypassing table access controls. The attacker cannot actively make queries, but may observe the results of queries by other clients, even though the attacker does not have permission to access that data. Description: The Proxy and Client components of TIBCO Software Inc.'s TIBCO ActiveSpaces - Enterprise Edition contain a vulnerability that th
y and Client components of TIBCO Software Inc.'s TIBCO ActiveSpaces - Enterprise Edition contain a vulnerability that theoretically allows an Active Spaces client to passively observe data traffic to other clients. Affected releases are TIBCO Software Inc.'s TIBCO ActiveSpaces - Enterprise Edition: versions 4.4.0 through 4.9.0. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://community.tibco.com/advisories/tibco-security-advisory-march-12-2024-tibco-activespaces-cve-2024-1137-r208/
CVE ID: CVE-2024-1138 State: PUBLISHED Published: 2024-03-12T17:30:15.100Z Last Updated: 2025-03-28T18:59:24.770Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: TIBCO Software Inc. Products: TIBCO FTL - Enterprise Edition Problem Types: Successful exploitation of this vulnerability may result in an authenticated but unprivileged user arbitrarily reconfiguring FTL clients attached to the same ftlserver. Description: The FTL Server component of TIBCO Software Inc.'s TIBCO FTL - Enterprise Edition contains a vulnerability that allows a low privileged attacker with network access to execute a privilege escalation on the affected ftlserver. Affected releases are T
ileged attacker with network access to execute a privilege escalation on the affected ftlserver. Affected releases are TIBCO Software Inc.'s TIBCO FTL - Enterprise Edition: versions 6.10.1 and below. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://community.tibco.com/advisories/tibco-security-advisory-march-12-2024-tibco-ftl-cve-2024-1138-r207/
CVE ID: CVE-2024-1139 State: PUBLISHED Published: 2024-04-25T16:25:01.080Z Last Updated: 2025-11-20T07:11:38.778Z Severity: HIGH (CVSS 7.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) Vendors: Red Hat Products: Red Hat OpenShift Container Platform 4.12, Red Hat OpenShift Container Platform 4.13, Red Hat OpenShift Container Platform 4.14, Red Hat OpenShift Container Platform 4.15, Red Hat Advanced Cluster Management for Kubernetes 2, Red Hat OpenShift Container Platform 3.11 Problem Types: CWE-200 Description: A credentials leak vulnerability was found in the cluster monitoring operator in OCP. This issue may allow a remote attacker who has basic login credentials to check the pod manifest t
ring operator in OCP. This issue may allow a remote attacker who has basic login credentials to check the pod manifest to discover a repository pull secret. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2024:1887 - https://access.redhat.com/errata/RHSA-2024:1891 - https://access.redhat.com/errata/RHSA-2024:2047 - https://access.redhat.com/errata/RHSA-2024:2782 - https://access.redhat.com/security/cve/CVE-2024-1139 - https://bugzilla.redhat.com/show_bug.cgi?id=2262158
CVE ID: CVE-2024-1140 State: PUBLISHED Published: 2024-02-13T15:05:22.732Z Last Updated: 2025-05-19T16:41:25.346Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H) Vendors: Filseclab Products: Twister Antivirus Problem Types: CWE-125 Description: Twister Antivirus v8.17 is vulnerable to an Out-of-bounds Read vulnerability by triggering the 0x801120B8 IOCTL code of the filmfd.sys driver. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fluidattacks.com/advisories/fitzgerald/ - http://www.filseclab.com/en-us/products/twister.htm
CVE ID: CVE-2024-1141 State: PUBLISHED Published: 2024-02-01T14:21:37.758Z Last Updated: 2025-11-20T18:21:09.704Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: Red Hat Products: Red Hat OpenStack Platform 17.1 for RHEL 9, Red Hat OpenStack Platform 16.1, Red Hat OpenStack Platform 16.2, Red Hat OpenStack Platform 18.0 Problem Types: CWE-779 Description: A vulnerability was found in python-glance-store. The issue occurs when the package logs the access_key for the glance-store when the DEBUG log level is enabled. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2024:2732 - https:
- CISA ADP Vulnrichment: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2024:2732 - https://access.redhat.com/security/cve/CVE-2024-1141 - https://bugzilla.redhat.com/show_bug.cgi?id=2258836
CVE ID: CVE-2024-1142 State: PUBLISHED Published: 2024-03-06T20:08:21.962Z Last Updated: 2024-08-05T17:56:48.953Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L) Vendors: Sonatype Products: IQ Server Problem Types: CWE-22 Description: Path Traversal in Sonatype IQ Server from version 143 allows remote authenticated attackers to overwrite or delete files via a specially crafted request. Version 171 fixes this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.sonatype.com/hc/en-us/articles/27034479038739-CVE-2024-1142-Sonatype-IQ-Server-Path-Traversal-2024-03-06
CVE ID: CVE-2024-1143 State: PUBLISHED Published: 2024-02-02T06:01:39.341Z Last Updated: 2025-06-03T18:49:03.700Z Severity: CRITICAL (CVSS 9.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N) Vendors: LINE Corporation Products: Central Dogma Problem Types: na Description: Central Dogma versions prior to 0.64.1 is vulnerable to Cross-Site Scripting (XSS), which could allow for the leakage of user sessions and subsequent authentication bypass. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/line/centraldogma/security/advisories/GHSA-34q3-p352-c7q8
CVE ID: CVE-2024-1144 State: PUBLISHED Published: 2024-03-19T11:32:49.261Z Last Updated: 2024-08-01T18:26:30.513Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) Vendors: Devklan Products: Alma Blog Problem Types: CWE-284 Description: Improper access control vulnerability in Devklan's Alma Blog that affects versions 2.1.10 and earlier. This vulnerability could allow an unauthenticated user to access the application's functionalities without the need for credentials. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-alma-devklan-blog
CVE ID: CVE-2024-1145 State: PUBLISHED Published: 2024-03-19T11:35:46.187Z Last Updated: 2024-08-02T15:12:00.863Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Devklan Products: Alma Blog Problem Types: CWE-204 Description: User enumeration vulnerability in Devklan's Alma Blog that affects versions 2.1.10 and earlier. This vulnerability could allow a remote user to retrieve all valid users registered in the application just by looking at the request response. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-alma-devklan-blog
CVE ID: CVE-2024-1146 State: PUBLISHED Published: 2024-03-19T11:37:18.313Z Last Updated: 2024-08-01T18:26:30.513Z Severity: MEDIUM (CVSS 5.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N) Vendors: Devklan Products: Alma Blog Problem Types: CWE-79 Description: Cross-Site Scripting vulnerability in Devklan's Alma Blog that affects versions 2.1.10 and earlier. This vulnerability could allow an attacker to store a malicious JavaScript payload within the application by adding the payload to 'Community Description' or 'Community Rules'. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilitie
hment: - CVE Program Container: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-alma-devklan-blog
CVE ID: CVE-2024-1147 State: PUBLISHED Published: 2024-03-21T07:33:20.350Z Last Updated: 2024-11-11T20:23:44.626Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: OpenText Products: PVCS Version Manager Problem Types: CWE-287 Description: Weak access control in OpenText PVCS Version Manager allows potential bypassing of authentication and download of files. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://portal.microfocus.com/s/article/KM000026669
CVE ID: CVE-2024-1148 State: PUBLISHED Published: 2024-03-21T07:34:35.081Z Last Updated: 2024-11-11T20:24:46.094Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: OpenText Products: PVCS Version Manager Problem Types: CWE-287 Description: Weak access control in OpenText PVCS Version Manager allows potential bypassing of authentication and uploading of files. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://portal.microfocus.com/s/article/KM000026669
CVE ID: CVE-2024-1149 State: PUBLISHED Published: 2024-02-08T13:01:03.806Z Last Updated: 2025-05-15T19:40:41.899Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Snow Software Products: Inventory Agent Problem Types: CWE-347 Description: Improper Verification of Cryptographic Signature vulnerability in Snow Software Inventory Agent on MacOS, Snow Software Inventory Agent on Windows, Snow Software Inventory Agent on Linux allows File Manipulation through Snow Update Packages.This issue affects Inventory Agent: through 6.12.0; Inventory Agent: through 6.14.5; Inventory Agent: through 6.7.2. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichme
through 6.14.5; Inventory Agent: through 6.7.2. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://community.snowsoftware.com/s/feed/0D5Td000004YtMcKAK
CVE ID: CVE-2024-1150 State: PUBLISHED Published: 2024-02-08T13:06:16.747Z Last Updated: 2024-08-01T18:26:30.515Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Snow Software Products: Inventory Agent Problem Types: CWE-347 Description: Improper Verification of Cryptographic Signature vulnerability in Snow Software Inventory Agent on Unix allows File Manipulation through Snow Update Packages.This issue affects Inventory Agent: through 7.3.1. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://community.snowsoftware.com/s/feed/0D5Td000004YtMcKAK
CVE ID: CVE-2024-1151 State: PUBLISHED Published: 2024-02-11T14:29:48.797Z Last Updated: 2025-11-07T15:28:04.303Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: Red Hat Products: Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 9.2 Extended Update Support, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8 Problem Types: CWE-121 Description: A vulnerability was reported in the Open vSwitch sub-component in the Linux Kernel. The flaw occurs when a recursive operation of code push recursively calls into the code block. The OVS module does not validate the stack depth, pushing too many frames and causing a stack overflow. As
e code block. The OVS module does not validate the stack depth, pushing too many frames and causing a stack overflow. As a result, this can lead to a crash or other related issues. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2024:4823 - https://access.redhat.com/errata/RHSA-2024:4831 - https://access.redhat.com/errata/RHSA-2024:9315 - https://access.redhat.com/security/cve/CVE-2024-1151 - https://bugzilla.redhat.com/show_bug.cgi?id=2262241 - https://lore.kernel.org/all/20240207132416.1488485-1-aconole@redhat.com/
CVE ID: CVE-2024-1153 State: PUBLISHED Published: 2024-06-27T13:09:28.115Z Last Updated: 2025-10-14T12:36:56.615Z Severity: MEDIUM (CVSS 4.6 CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Talya Informatics Products: Travel APPS Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Talya Informatics Travel APPS allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Travel APPS: before v17.0.68. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.usom.gov.tr/bildirim/tr-24-0809
CVE ID: CVE-2024-1155 State: PUBLISHED Published: 2024-02-20T14:34:08.556Z Last Updated: 2024-08-01T18:26:30.614Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: NI Products: SystemLink Server, FlexLogger Problem Types: CWE-276 Description: Incorrect permissions in the installation directories for shared SystemLink Elixir based services may allow an authenticated user to potentially enable escalation of privilege via local access. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/incorrect-permissions-for-shared-systemlink-elix
upport/security/available-critical-and-security-updates-for-ni-software/incorrect-permissions-for-shared-systemlink-elixir-based-service.html
CVE ID: CVE-2024-1156 State: PUBLISHED Published: 2024-02-20T14:37:07.095Z Last Updated: 2024-08-26T16:53:40.189Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: NI Products: SystemLink Server, FlexLogger Problem Types: CWE-276 Description: Incorrect directory permissions for the shared NI RabbitMQ service may allow a local authenticated user to read RabbitMQ configuration information and potentially enable escalation of privileges. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/incorrect-permissions-for-shared-systemlink-el
/support/security/available-critical-and-security-updates-for-ni-software/incorrect-permissions-for-shared-systemlink-elixir-based-service.html
CVE ID: CVE-2024-1157 State: PUBLISHED Published: 2024-02-13T09:31:27.725Z Last Updated: 2024-08-01T18:33:24.087Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: boldthemes Products: Bold Page Builder Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's button URL in all versions up to, and including, 4.8.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scrip
makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/e166a7db-45f7-4a0d-9966-dbec9ade204a?source=cve - https://plugins.trac.wordpress.org/browser/bold-page-builder/trunk/content_elements/bt_bb_button/bt_bb_button.php#L161 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3034441%40bold-page-builder&new=3034441%40bold-page-builder&sfp_email=&sfph_mail=
CVE ID: CVE-2024-1158 State: PUBLISHED Published: 2024-03-13T15:26:34.952Z Last Updated: 2024-08-08T20:16:25.515Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: svenl77 Products: Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC) Problem Types: CWE-862 Missing Authorization Description: The Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC) plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the buddyforms_new_page function in all versions up to, and including, 2.8.7. This ma
e to a missing capability check on the buddyforms_new_page function in all versions up to, and including, 2.8.7. This makes it possible for authenticated attackers, with subscriber access or higher, to create pages with arbitrary titles. These pages are published. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/198cb3bb-73fe-45ae-b8e0-b7ee8dda9547?source=cve - https://plugins.trac.wordpress.org/browser/buddyforms/trunk/includes/admin/admin-ajax.php?rev=2820257#L80 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3046092%40buddyforms%2Ftrunk&old=3031945%40buddy
lugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3046092%40buddyforms%2Ftrunk&old=3031945%40buddyforms%2Ftrunk&sfp_email=&sfph_mail=
CVE ID: CVE-2024-1159 State: PUBLISHED Published: 2024-02-13T09:31:28.196Z Last Updated: 2024-08-01T18:33:24.159Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: boldthemes Products: Bold Page Builder Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 4.8.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions
ser supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/e71386ea-0546-4aa7-b77a-e1824e80accc?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3034441%40bold-page-builder&new=3034441%40bold-page-builder&sfp_email=&sfph_mail=
CVE ID: CVE-2024-1160 State: PUBLISHED Published: 2024-02-13T09:31:27.103Z Last Updated: 2024-08-01T18:33:24.812Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: boldthemes Products: Bold Page Builder Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Icon Link in all versions up to, and including, 4.8.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web script
akes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/818d3418-8e14-49b9-a112-8eab9eb3c283?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3034441%40bold-page-builder&new=3034441%40bold-page-builder&sfp_email=&sfph_mail=