Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-12369 State: PUBLISHED Published: 2024-12-09T20:53:09.260Z Last Updated: 2025-11-11T16:07:38.116Z Severity: MEDIUM (CVSS 4.2 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N) Vendors: Red Hat Products: Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8, Red Hat Build of Keycloak, Red Hat JBoss Enterprise Application Platform 7 Problem Types: CWE-345 Description: A vulnerability was found in OIDC-Client. When using the RH SSO OIDC adapter with EAP 7.x or when using the elytron-oidc-client subsystem with EAP 8.x, authorization code injection attacks can occur, allowing an attacker to inject a stolen authorization code into the attacker's own session with the client with
occur, allowing an attacker to inject a stolen authorization code into the attacker's own session with the client with a victim's identity. This is usually done with a Man-in-the-Middle (MitM) or phishing attack. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://access.redhat.com/errata/RHSA-2025:3989 - https://access.redhat.com/security/cve/CVE-2024-12369 - https://bugzilla.redhat.com/show_bug.cgi?id=2331178 - https://github.com/wildfly-security/wildfly-elytron/commit/5ac5e6bbcba58883b3cebb2ddbcec4de140c5ceb - https://github.com/wildfly-security/wildfly-elytron/commit/d7754f5a6a91ceb0f4dbbbfe301991f6a55404cb - https://github.com/wildfly-security/wildfly-elytron/pull/
dfly-elytron/commit/d7754f5a6a91ceb0f4dbbbfe301991f6a55404cb - https://github.com/wildfly-security/wildfly-elytron/pull/2253 - https://github.com/wildfly-security/wildfly-elytron/pull/2261
CVE ID: CVE-2024-12370 State: PUBLISHED Published: 2025-01-17T08:25:38.307Z Last Updated: 2025-02-12T16:54:07.689Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: thimpress Products: WP Hotel Booking Problem Types: CWE-284 Description: The WP Hotel Booking plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check when adding rooms in all versions up to, and including, 2.1.5. This makes it possible for unauthenticated attackers to add rooms with custom prices. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/5df32365-5381-48e0-9313-7e83c4c
DP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/5df32365-5381-48e0-9313-7e83c4c6c440?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3210798%40wp-hotel-booking%2Ftags%2F2.1.5&new=3214765%40wp-hotel-booking%2Ftags%2F2.1.6
CVE ID: CVE-2024-12371 State: PUBLISHED Published: 2024-12-18T15:23:37.736Z Last Updated: 2024-12-18T19:59:35.810Z Vendors: Rockwell Automation Products: PM1k 1408-BC3A-485, PM1k 1408-BC3A-ENT, PM1k 1408-TS3A-485, PM1k 1408-TS3A-ENT, PM1k 1408-EM3A-485, PM1k 1408-EM3A-ENT, PM1k 1408-TR1A-485, PM1k 1408-TR2A-485, PM1k 1408-EM1A-485, PM1k 1408-EM2A-485, PM1k 1408-TR1A-ENT, PM1k 1408-TR2A-ENT, PM1k 1408-EM1A-ENT, PM1k 1408-EM2A-ENT Description: A device takeover vulnerability exists in the Rockwell Automation Power Monitor 1000. This vulnerability allows configuration of a new Policyholder user without any authentication via API. Policyholder user is the most privileged user that can perform ed
Policyholder user without any authentication via API. Policyholder user is the most privileged user that can perform edit operations, creating admin users and performing factory reset. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1714.html
CVE ID: CVE-2024-12372 State: PUBLISHED Published: 2024-12-18T15:28:25.266Z Last Updated: 2024-12-18T19:58:03.337Z Vendors: Rockwell Automation Products: PM1k 1408-BC3A-485, PM1k 1408-BC3A-ENT, PM1k 1408-TS3A-485, PM1k 1408-TS3A-ENT, PM1k 1408-EM3A-485, PM1k 1408-EM3A-ENT, PM1k 1408-TR1A-485, PM1k 1408-TR2A-485, PM1k 1408-EM1A-485, PM1k 1408-EM2A-485, PM1k 1408-TR1A-ENT, PM1k 1408-TR2A-ENT, PM1k 1408-EM1A-ENT, PM1k 1408-EM2A-ENT Description: A denial-of-service and possible remote code execution vulnerability exists in the Rockwell Automation Power Monitor 1000. The vulnerability results in corruption of the heap memory which may compromise the integrity of the system, potentially allowing f
bility results in corruption of the heap memory which may compromise the integrity of the system, potentially allowing for remote code execution or a denial-of-service attack. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1714.html
CVE ID: CVE-2024-12373 State: PUBLISHED Published: 2024-12-18T15:38:50.826Z Last Updated: 2024-12-18T19:56:35.445Z Vendors: Rockwell Automation Products: PM1k 1408-BC3A-485, PM1k 1408-BC3A-ENT, PM1k 1408-TS3A-485, PM1k 1408-TS3A-ENT, PM1k 1408-EM3A-485, PM1k 1408-EM3A-ENT, PM1k 1408-TR1A-485, PM1k 1408-TR2A-485, PM1k 1408-EM1A-485, PM1k 1408-EM2A-485, PM1k 1408-TR1A-ENT, PM1k 1408-TR2A-ENT, PM1k 1408-EM1A-ENT, PM1k 1408-EM2A-ENT Description: A denial-of-service vulnerability exists in the Rockwell Automation Power Monitor 1000. The vulnerability results in a buffer-overflow, potentially causing denial-of-service. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ro
, potentially causing denial-of-service. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1714.html
CVE ID: CVE-2024-12374 State: PUBLISHED Published: 2025-03-20T10:08:49.639Z Last Updated: 2025-03-20T19:02:09.492Z Severity: MEDIUM (CVSS 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: automatic1111 Products: automatic1111/stable-diffusion-webui Problem Types: CWE-79 Description: A stored cross-site scripting (XSS) vulnerability exists in automatic1111/stable-diffusion-webui version git 82a973c. An attacker can upload an HTML file, which the application interprets as content-type application/html. If a victim accesses the malicious link, it will execute arbitrary JavaScript in the victim's browser. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com
y JavaScript in the victim's browser. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/3dae386a-f442-4be6-87ef-956606c8a6ac
CVE ID: CVE-2024-12375 State: PUBLISHED Published: 2025-03-20T10:10:02.746Z Last Updated: 2025-03-20T14:36:35.294Z Severity: MEDIUM (CVSS 6.5 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: automatic1111 Products: automatic1111/stable-diffusion-webui Problem Types: CWE-36 Description: A local file inclusion vulnerability was identified in automatic1111/stable-diffusion-webui, affecting version git 82a973c. This vulnerability allows an attacker to read arbitrary files on the system by sending a specially crafted request to the application. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/21952043-395f-4cd3-9374-b73ab9612f27
CVE ID: CVE-2024-12376 State: PUBLISHED Published: 2025-03-20T10:10:28.790Z Last Updated: 2025-03-20T18:21:03.207Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: lm-sys Products: lm-sys/fastchat Problem Types: CWE-918 Description: A Server-Side Request Forgery (SSRF) vulnerability was identified in the lm-sys/fastchat web server, specifically in the affected version git 2c68a13. This vulnerability allows an attacker to access internal server resources and data that are otherwise inaccessible, such as AWS metadata credentials. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/c9cc3f28-ee9f-4d2d-9ee5-8c6455a11892
CVE ID: CVE-2024-12378 State: PUBLISHED Published: 2025-05-08T19:05:22.320Z Last Updated: 2025-05-08T19:18:27.314Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) Vendors: Arista Networks Products: CloudVision Portal Problem Types: CWE-319 Description: On affected platforms running Arista EOS with secure Vxlan configured, restarting the Tunnelsec agent will result in packets being sent over the secure Vxlan tunnels in the clear. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.arista.com/en/support/advisories-notices/security-advisory/21289-security-advisory-0113
CVE ID: CVE-2024-12379 State: PUBLISHED Published: 2025-02-12T15:02:32.062Z Last Updated: 2025-02-12T21:00:39.234Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: GitLab Products: GitLab Problem Types: CWE-770 Description: A denial of service vulnerability in GitLab CE/EE affecting all versions from 14.1 prior to 17.6.5, 17.7 prior to 17.7.4, and 17.8 prior to 17.8.2 allows an attacker to impact the availability of GitLab via unbounded symbol creation via the scopes parameter in a Personal Access Token. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/508559 - https://hackerone.com/reports/2871791
CVE ID: CVE-2024-12380 State: PUBLISHED Published: 2025-03-13T05:56:14.642Z Last Updated: 2025-03-14T14:35:18.525Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N) Vendors: GitLab Products: GitLab Problem Types: CWE-209 Description: An issue was discovered in GitLab EE/CE affecting all versions starting from 11.5 before 17.7.7, all versions starting from 17.8 before 17.8.5, all versions starting from 17.9 before 17.9.2. Certain user inputs in repository mirroring settings could potentially expose sensitive authentication information. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/508557 - https://hackeron
st Notes: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/508557 - https://hackerone.com/reports/2868951
CVE ID: CVE-2024-12381 State: PUBLISHED Published: 2024-12-11T17:52:05.116Z Last Updated: 2024-12-17T04:56:06.560Z Vendors: Google Products: Chrome Problem Types: CWE-843 Description: Type Confusion in V8 in Google Chrome prior to 131.0.6778.139 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2024/12/stable-channel-update-for-desktop_10.html - https://issues.chromium.org/issues/381696874
CVE ID: CVE-2024-12382 State: PUBLISHED Published: 2024-12-11T17:52:05.545Z Last Updated: 2024-12-17T04:56:07.762Z Vendors: Google Products: Chrome Problem Types: CWE-416 Description: Use after free in Translate in Google Chrome prior to 131.0.6778.139 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2024/12/stable-channel-update-for-desktop_10.html - https://issues.chromium.org/issues/379516109
CVE ID: CVE-2024-12383 State: PUBLISHED Published: 2025-01-07T05:23:56.899Z Last Updated: 2025-01-07T16:15:02.519Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: letscms Products: Binary MLM Woocommerce Problem Types: CWE-352 Description: The Binary MLM Woocommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0. This is due to missing or incorrect nonce validation on the 'bmw_display_pv_set_page' function and insufficient input sanitization and output escaping of the 'product_points' parameter. This makes it possible for unauthenticated attackers to inject arbitrary web scripts via a forged request
ts' parameter. This makes it possible for unauthenticated attackers to inject arbitrary web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/b061fbf2-4bb3-4ccc-ba90-1e947365435e?source=cve - https://plugins.trac.wordpress.org/browser/woo-binary-mlm/trunk/includes/admin/point_setting.php#L7 - https://plugins.trac.wordpress.org/browser/woo-binary-mlm/trunk/includes/admin/point_setting.php#L92 - https://plugins.trac.wordpress.org/browser/woo-binary-mlm/trunk/includes/admin/point_setting.php#L96
CVE ID: CVE-2024-12384 State: PUBLISHED Published: 2025-01-07T05:24:09.839Z Last Updated: 2025-01-07T16:13:01.518Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: letscms Products: Binary MLM Woocommerce Problem Types: CWE-79 Description: The Binary MLM Woocommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'page’ parameter in all versions up to, and including, 2.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Addit
in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/fdf6b2ea-5a6a-481b-9431-650c895f54ef?source=cve - https://plugins.trac.wordpress.org/browser/woo-binary-mlm/trunk/includes/admin/payout/payout-report.php#L44 - https://plugins.trac.wordpress.org/browser/woo-binary-mlm/trunk/includes/admin/payout/payout-report.php#L121 - https://plugins.trac.wordpress.org/browser/woo-binary-mlm/trunk/includes/admin/register-first-user.php#L82
CVE ID: CVE-2024-12385 State: PUBLISHED Published: 2025-01-18T07:05:08.582Z Last Updated: 2025-01-21T21:24:50.328Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: kevonadonis Products: WP Abstracts Problem Types: CWE-352 Description: The WP Abstracts plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.7.2. This is due to missing nonce validation on the wpabstracts_load_status() and wpabstracts_delete_abstracts() functions. This makes it possible for unauthenticated attackers to inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as cl
icious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/79af711e-d044-447e-9802-8be648a3843d?source=cve - https://plugins.trac.wordpress.org/browser/wp-abstracts-manuscripts-manager/trunk/abstracts/abstracts.manage.php#L205 - https://plugins.trac.wordpress.org/browser/wp-abstracts-manuscripts-manager/trunk/abstracts/abstracts.manage.php#L148 - https://wordpress.org/plugins/wp-abstracts-manuscripts-manager/#developers - https://plugins.trac.wordpress.org/changeset/3223874/
CVE ID: CVE-2024-12386 State: PUBLISHED Published: 2025-02-12T11:11:17.986Z Last Updated: 2025-02-12T16:06:36.273Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H) Vendors: kevonadonis Products: WP Abstracts Problem Types: CWE-352 Description: The WP Abstracts plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.7.3. This is due to missing nonce validation on multiple functions. This makes it possible for unauthenticated attackers to delete arbitrary accounts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnri
k a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/efd27466-f68e-4d8a-a1ec-90dbb6ff126b?source=cve - https://wordpress.org/plugins/wp-abstracts-manuscripts-manager/#developers - https://plugins.trac.wordpress.org/changeset/3238664/
CVE ID: CVE-2024-12387 State: PUBLISHED Published: 2025-03-20T10:11:21.371Z Last Updated: 2025-10-15T12:49:30.933Z Severity: MEDIUM (CVSS 6.5 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: binary-husky Products: binary-husky/gpt_academic Problem Types: CWE-409 Description: A vulnerability in the binary-husky/gpt_academic repository, as of commit git 3890467, allows an attacker to crash the server by uploading a specially crafted zip bomb. The server decompresses the uploaded file and attempts to load it into memory, which can lead to an out-of-memory crash. This issue arises due to improper input validation when handling compressed file uploads. Additional Analyst Notes: - CISA ADP V
ue arises due to improper input validation when handling compressed file uploads. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/02b4ab21-d29b-4cd7-ad80-f83081ce82a4
CVE ID: CVE-2024-12388 State: PUBLISHED Published: 2025-03-20T10:10:05.958Z Last Updated: 2025-10-15T12:50:17.063Z Severity: MEDIUM (CVSS 6.5 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: binary-husky Products: binary-husky/gpt_academic Problem Types: CWE-1333 Description: A vulnerability in binary-husky/gpt_academic version 310122f allows for a Regular Expression Denial of Service (ReDoS) attack. The application uses a regular expression to parse user input, which can take polynomial time to match certain crafted inputs. This allows an attacker to send a small malicious payload to the server, causing it to become unresponsive and unable to handle any requests from other users. Addi
icious payload to the server, causing it to become unresponsive and unable to handle any requests from other users. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/b1c01c94-e477-41db-9d17-601aa25e351c
CVE ID: CVE-2024-12389 State: PUBLISHED Published: 2025-03-20T10:10:43.404Z Last Updated: 2025-03-20T18:17:40.999Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: binary-husky Products: binary-husky/gpt_academic Problem Types: CWE-29 Description: A path traversal vulnerability exists in binary-husky/gpt_academic version git 310122f. The application supports the extraction of user-provided 7z files without proper validation. The Python py7zr package used for extraction does not guarantee that files will remain within the intended extraction directory. An attacker can exploit this vulnerability to perform arbitrary file writes, which can lead to remote code exec
rectory. An attacker can exploit this vulnerability to perform arbitrary file writes, which can lead to remote code execution. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/37afb1c9-bba9-47ee-8617-a5f715271654
CVE ID: CVE-2024-12390 State: PUBLISHED Published: 2025-03-20T10:10:36.486Z Last Updated: 2025-10-15T12:50:17.669Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: binary-husky Products: binary-husky/gpt_academic Problem Types: CWE-59 Description: A vulnerability in binary-husky/gpt_academic version git 310122f allows for remote code execution. The application supports the extraction of user-provided RAR files without proper validation. The Python rarfile module, which supports symlinks, can be exploited to perform arbitrary file writes. This can lead to remote code execution by writing to sensitive files such as SSH keys, crontab files, or the application's ow
can lead to remote code execution by writing to sensitive files such as SSH keys, crontab files, or the application's own code. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/1add2b26-460d-4aa5-8fda-ab045d153177
CVE ID: CVE-2024-12391 State: PUBLISHED Published: 2025-03-20T10:10:33.279Z Last Updated: 2025-10-15T12:50:18.175Z Severity: MEDIUM (CVSS 6.5 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: binary-husky Products: binary-husky/gpt_academic Problem Types: CWE-1333 Description: A vulnerability in binary-husky/gpt_academic, as of commit 310122f, allows for a Regular Expression Denial of Service (ReDoS) attack. The function '解析项目源码（手动指定和筛选源码文件类型）' permits the execution of user-provided regular expressions. Certain regular expressions can cause the Python RE engine to take exponential time to execute, leading to a Denial of Service (DoS) condition. An attacker who controls both the regular
exponential time to execute, leading to a Denial of Service (DoS) condition. An attacker who controls both the regular expression and the search string can exploit this vulnerability to hang the server for an arbitrary amount of time. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/70b3f4f0-6b1b-4563-a18c-fe46502e6ba0
CVE ID: CVE-2024-12392 State: PUBLISHED Published: 2025-03-20T10:11:36.215Z Last Updated: 2025-03-20T18:38:23.224Z Severity: MEDIUM (CVSS 6.5 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: binary-husky Products: binary-husky/gpt_academic Problem Types: CWE-918 Description: A Server-Side Request Forgery (SSRF) vulnerability exists in binary-husky/gpt_academic version git 310122f. The application has a functionality to download papers from arxiv.org, but the URL validation is incomplete. An attacker can exploit this vulnerability to make the application access any URL, including internal services, and read the response. This can be used to access data that are only accessible from the
, including internal services, and read the response. This can be used to access data that are only accessible from the server, such as AWS metadata credentials, and can escalate local exploits to network-based attacks. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/858de346-698e-4a72-a9e9-3dbd6c60ac18
CVE ID: CVE-2024-12393 State: PUBLISHED Published: 2024-12-09T23:20:31.719Z Last Updated: 2024-12-11T16:37:08.457Z Vendors: Drupal Products: Drupal Core Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Drupal Core allows Cross-Site Scripting (XSS).This issue affects Drupal Core: from 8.8.0 before 10.2.11, from 10.3.0 before 10.3.9, from 11.0.0 before 11.0.8. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.drupal.org/sa-core-2024-003
CVE ID: CVE-2024-12394 State: PUBLISHED Published: 2025-01-09T11:11:04.460Z Last Updated: 2025-01-09T14:27:41.200Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: jonathankissam Products: Action Network Problem Types: CWE-352 Description: The Action Network plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.4.4. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes:
ted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/c90dadc9-0109-4ebd-8135-3efd26682ad9?source=cve - https://wordpress.org/plugins/wp-action-network/#developers