Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
er to the Axis security advisory for more information and solution. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.axis.com/dam/public/e5/24/82/cve-2024-6476pdf-en-US-455104.pdf
CVE ID: CVE-2024-6477 State: PUBLISHED Published: 2024-08-03T06:00:05.955Z Last Updated: 2025-08-27T12:00:49.772Z Vendors: Unknown Products: UsersWP Problem Types: CWE-340 Generation of Predictable Numbers or Identifiers Description: The UsersWP WordPress plugin before 1.2.12 uses predictable filenames when an admin generates an export, which could allow unauthenticated attackers to download them and retrieve sensitive information such as IP, username, and email address Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/346c855a-4d42-4a87-aac9-e5bfc2242b16/
CVE ID: CVE-2024-6478 State: PUBLISHED Published: 2025-05-15T20:07:07.414Z Last Updated: 2025-05-20T19:24:39.604Z Vendors: Unknown Products: CTT Expresso para WooCommerce Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The CTT Expresso para WooCommerce WordPress plugin before 3.2.13 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/39a78741-eeae-4a27-8136-7d0bb0bf2263/
CVE ID: CVE-2024-6479 State: PUBLISHED Published: 2024-10-31T21:30:38.716Z Last Updated: 2024-11-01T13:12:48.208Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: shopitpress Products: SIP Reviews Shortcode for WooCommerce Problem Types: CWE-89 Description: The SIP Reviews Shortcode for WooCommerce plugin for WordPress is vulnerable to SQL Injection via the 'no_of_reviews' attribute in the woocommerce_reviews shortcode in all versions up to, and including, 1.2.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL
nt preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/a920a77a-681a-4309-bce2-1f77c11c8b29?source=cve - https://plugins.trac.wordpress.org/browser/sip-reviews-shortcode-woocommerce/trunk/public/partials/plugin-reviews-shortcode-display.php - https://plugins.trac.wordpress.org/browser/sip-reviews-shortcode-woocommerce/trunk/public/partials/plugin-reviews-shortcode-display.php#L331
CVE ID: CVE-2024-6480 State: PUBLISHED Published: 2024-10-31T21:30:37.857Z Last Updated: 2024-11-01T13:12:29.630Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: shopitpress Products: SIP Reviews Shortcode for WooCommerce Problem Types: CWE-89 Description: The SIP Reviews Shortcode for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'no_of_reviews' attribute in the woocommerce_reviews shortcode in all versions up to, and including, 1.2.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to in
supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/43aa28ec-6553-4527-a1d1-eb4a58533c5d?source=cve - https://plugins.trac.wordpress.org/browser/sip-reviews-shortcode-woocommerce/trunk/public/partials/plugin-reviews-shortcode-display.php - https://plugins.trac.wordpress.org/browser/sip-reviews-shortcode-woocommerce/trunk/public/partials/plugin-reviews-shortcode-display.php#L424
CVE ID: CVE-2024-6481 State: PUBLISHED Published: 2024-08-08T06:00:03.620Z Last Updated: 2024-08-08T13:16:42.199Z Vendors: Unknown Products: Search & Filter Pro Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Search & Filter Pro WordPress plugin before 2.5.18 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/53357868-2bcb-48eb-8abd-83186ff8d027/
CVE ID: CVE-2024-6482 State: PUBLISHED Published: 2024-09-14T12:31:08.795Z Last Updated: 2024-09-16T19:42:48.938Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: glboy Products: Login with phone number Problem Types: CWE-269 Description: The Login with phone number plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 1.7.49. This is due to a lack of validation and missing capability check on user-supplied data in the 'lwp_update_password_action' function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update their role to any other role, including Administrator. The vul
ackers, with Subscriber-level access and above, to update their role to any other role, including Administrator. The vulnerability was partially patched in version 1.7.40. The login with phone number pro plugin was required to exploit the vulnerability in versions 1.7.40 - 1.7.49. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/de7cde2c-142c-4004-9302-be335265d87d?source=cve - https://plugins.trac.wordpress.org/browser/login-with-phone-number/trunk/login-with-phonenumber.php#L3803 - https://plugins.trac.wordpress.org/changeset/3129185/
CVE ID: CVE-2024-6483 State: PUBLISHED Published: 2025-03-20T10:09:36.384Z Last Updated: 2025-03-20T18:37:01.937Z Severity: MEDIUM (CVSS 5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: aimhubio Products: aimhubio/aim Problem Types: CWE-23 Description: A vulnerability in the `runs/delete-batch` endpoint of aimhubio/aim version 3.19.3 allows for arbitrary file or directory deletion through path traversal. The endpoint does not mitigate path traversal when handling user-specified run-names, which are used to specify log/metadata files for deletion. This can be exploited to delete arbitrary files or directories, potentially causing denial of service or data loss. Additional Analyst No
ited to delete arbitrary files or directories, potentially causing denial of service or data loss. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/dc45d480-e579-4af4-8603-c52ecfd5e363
CVE ID: CVE-2024-6484 State: REJECTED Published: 2024-07-11T17:03:30.969Z Last Updated: 2025-08-01T17:09:30.604Z Description: No description available.
CVE ID: CVE-2024-6485 State: PUBLISHED Published: 2024-07-11T17:08:08.224Z Last Updated: 2025-11-03T19:34:34.709Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:L) Vendors: Bootstrap, Bootstrap-sass Products: Bootstrap, bootstrap-sass Problem Types: CWE-79 Description: A security vulnerability has been discovered in bootstrap that could enable Cross-Site Scripting (XSS) attacks. The vulnerability is associated with the data-loading-text attribute within the button plugin. This vulnerability can be exploited by injecting malicious JavaScript code into the attribute, which would then be executed when the button's loading state is triggered. Additional Analyst Notes: - CI
the attribute, which would then be executed when the button's loading state is triggered. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.herodevs.com/vulnerability-directory/cve-2024-6485
CVE ID: CVE-2024-6486 State: PUBLISHED Published: 2025-05-15T20:07:07.616Z Last Updated: 2025-05-20T19:24:28.330Z Vendors: Unknown Products: ImageMagick Engine Problem Types: CWE-78 OS Command Injection Description: The ImageMagick Engine ImageMagick Engine WordPress plugin before 1.7.11 for WordPress is vulnerable to OS Command Injection via the "cli_path" parameter. This allows authenticated attackers, with administrator-level permission to execute arbitrary OS commands on the server leading to remote code execution. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/a57c0c59-8b5c-4221-a9db-19f141650d9b/
CVE ID: CVE-2024-6487 State: PUBLISHED Published: 2024-07-29T06:00:08.552Z Last Updated: 2024-08-08T20:43:59.315Z Vendors: Unknown Products: Inline Related Posts Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Inline Related Posts WordPress plugin before 3.8.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://wpscan.com/vulnerability/eeec9608-a7b2-4926-bac2-4c81a65dd473/
CVE ID: CVE-2024-6488 State: REJECTED Published: N/A Last Updated: 2025-02-13T17:57:59.392Z Description: No description available.
CVE ID: CVE-2024-6489 State: PUBLISHED Published: 2024-07-20T06:43:48.168Z Last Updated: 2024-08-01T21:41:03.238Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: jetmonsters Products: Getwid – Gutenberg Blocks Problem Types: CWE-862 Description: The Getwid – Gutenberg Blocks plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the get_google_api_key function in all versions up to, and including, 2.0.10. This makes it possible for authenticated attackers, with Contributor-level access and above, to set the MailChimp API key. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: Refe
nd above, to set the MailChimp API key. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/fe391ac9-e3ea-48b3-8ffe-243972ce89f6?source=cve - https://plugins.trac.wordpress.org/changeset/3119180/getwid/trunk/includes/blocks/google-map.php
CVE ID: CVE-2024-6490 State: PUBLISHED Published: 2024-07-26T06:00:04.555Z Last Updated: 2024-08-01T21:41:03.422Z Vendors: Unknown Products: Master Slider Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: During testing of the Master Slider WordPress plugin through 3.9.10, a CSRF vulnerability was found, which allows an unauthorized user to manipulate requests on behalf of the victim and thereby delete all of the sliders inside Master Slider WordPress plugin through 3.9.10. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://wpscan.com/vulnerability/5a56e5aa-841d-4be5-84da-4c3b7602f053/
CVE ID: CVE-2024-6491 State: PUBLISHED Published: 2024-07-20T06:43:45.510Z Last Updated: 2024-08-01T21:41:03.418Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: jetmonsters Products: Getwid – Gutenberg Blocks Problem Types: CWE-862 Description: The Getwid – Gutenberg Blocks plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the mailchimp_api_key_manage function in all versions up to, and including, 2.0.10. This makes it possible for authenticated attackers, with Contributor-level access and above, to set the MailChimp API key. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container
cess and above, to set the MailChimp API key. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/fb2be4cd-2641-4f7f-993c-1c78e5a1d5da?source=cve - https://plugins.trac.wordpress.org/browser/getwid/trunk/includes/blocks/mailchimp.php#L190 - https://plugins.trac.wordpress.org/changeset/3119180/getwid/trunk/includes/blocks/mailchimp.php?contextall=1
CVE ID: CVE-2024-6492 State: PUBLISHED Published: 2024-07-16T18:16:36.780Z Last Updated: 2024-11-05T21:53:35.800Z Vendors: Devolutions Products: Remote Desktop Manager Description: Exposure of Sensitive Information in edge browser session proxy feature in Devolutions Remote Desktop Manager 2024.2.14.0 and earlier on Windows allows an attacker to intercept proxy credentials via a specially crafted website. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://devolutions.net/security/advisories/DEVO-2024-0012
CVE ID: CVE-2024-6493 State: PUBLISHED Published: 2024-09-13T06:00:02.277Z Last Updated: 2024-09-13T15:35:38.949Z Vendors: Unknown Products: NinjaTeam Header Footer Custom Code Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The NinjaTeam Header Footer Custom Code WordPress plugin before 1.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/0e3128ef-901a-42aa-9d74-c69d3241dc07/
CVE ID: CVE-2024-6494 State: PUBLISHED Published: 2024-08-07T06:00:06.219Z Last Updated: 2024-08-07T13:11:42.671Z Vendors: Unknown Products: WordPress File Upload Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The WordPress File Upload WordPress plugin before 4.24.8 does not properly sanitize and escape certain parameters, which could allow unauthenticated users to execute stored cross-site scripting (XSS) attacks. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/5b21a9be-b5fe-47ef-91c7-018dd42f763f/
CVE ID: CVE-2024-6495 State: PUBLISHED Published: 2024-07-12T12:46:55.285Z Last Updated: 2024-08-01T21:41:03.338Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: leap13 Products: Premium Addons for Elementor Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Premium Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Animated Text widget in all versions up to, and including, 4.10.36 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributo
ion and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/005fc05c-6d82-49ca-b114-a3e64a3a572f?source=cve - https://plugins.trac.wordpress.org/changeset/3115459/premium-addons-for-elementor
CVE ID: CVE-2024-6496 State: PUBLISHED Published: 2024-08-01T06:00:05.664Z Last Updated: 2024-08-07T13:39:08.900Z Vendors: Unknown Products: Light Poll Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The Light Poll WordPress plugin through 1.0.0 does not have CSRF checks when deleting polls, which could allow attackers to make logged in users perform such action via a CSRF attack Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/d598eabd-a87a-4e3e-be46-a5c5cc3f130e/
CVE ID: CVE-2024-6497 State: PUBLISHED Published: 2024-07-20T08:38:23.965Z Last Updated: 2024-08-09T18:47:36.343Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: cifi Products: SEO Plugin by Squirrly SEO Problem Types: CWE-89 Description: The SEO Plugin by Squirrly SEO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘url’ parameter in all versions up to, and including, 12.3.19 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additio
and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/bb3aa613-8f34-4d96-8ddf-41fcdcf65c59?source=cve - https://plugins.trac.wordpress.org/browser/squirrly-seo/trunk/controllers/Api.php#L267 - https://wordpress.org/plugins/squirrly-seo/#developers - https://plugins.trac.wordpress.org/changeset/3121853/
CVE ID: CVE-2024-6498 State: PUBLISHED Published: 2024-08-05T06:00:08.047Z Last Updated: 2024-09-06T16:30:58.855Z Vendors: Unknown Products: Chatbot for WordPress by Collect.chat ⚡️ Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Chatbot for WordPress by Collect.chat ⚡️ WordPress plugin before 2.4.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/eed58889-4be8-48df-9ef6-269df451e79e/
CVE ID: CVE-2024-6499 State: PUBLISHED Published: 2024-08-24T03:29:23.649Z Last Updated: 2024-08-28T16:02:32.188Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: maxfoundry Products: WordPress Button Plugin MaxButtons Problem Types: CWE-200 Description: The WordPress Button Plugin MaxButtons plugin for WordPress is vulnerable to information exposure in all versions up to, and including, 9.7.8. This makes it possible for unauthenticated attackers to obtain the full path to instances, which they may be able to use in combination with other vulnerabilities or to simplify reconnaissance work. On its own, this information is of very limited use. Additional Analys
lnerabilities or to simplify reconnaissance work. On its own, this information is of very limited use. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/fdd0694c-ea7e-4cf8-a8d8-82a2b02fecdf?source=cve - https://plugins.trac.wordpress.org/browser/maxbuttons/trunk/assets/libraries/font-awesome-5/convert.php - https://plugins.trac.wordpress.org/changeset/3140369/maxbuttons/tags/9.8.0/assets/libraries/font-awesome-5/convert.php
CVE ID: CVE-2024-6500 State: PUBLISHED Published: 2024-08-17T02:31:00.346Z Last Updated: 2024-08-20T19:06:38.179Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:H) Vendors: inspirelabs Products: InPost PL, InPost for WooCommerce Problem Types: CWE-862 Description: The InPost for WooCommerce plugin and InPost PL plugin for WordPress are vulnerable to unauthorized access and deletion of data due to a missing capability check on the 'parse_request' function in all versions up to, and including, 1.4.0 (for InPost for WooCommerce) as well as 1.4.4 (for InPost PL). This makes it possible for unauthenticated attackers to read and delete arbitrary files on Windows servers. On
Post PL). This makes it possible for unauthenticated attackers to read and delete arbitrary files on Windows servers. On Linux servers, only files within the WordPress install will be deleted, but all files can be read. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/7b57e750-71ec-4c52-999b-6c14a78c3bff?source=cve - https://plugins.trac.wordpress.org/browser/woo-inpost/trunk/classes/class-helper.php#L140 - https://plugins.trac.wordpress.org/browser/woo-inpost/trunk/classes/class-helper.php#L216 - https://plugins.trac.wordpress.org/browser/inpost-for-woocommerce/trunk/src/InspireLabs/WoocommerceInpost/EasyPack_Helper.p
ps://plugins.trac.wordpress.org/browser/inpost-for-woocommerce/trunk/src/InspireLabs/WoocommerceInpost/EasyPack_Helper.php#L267 - https://plugins.trac.wordpress.org/browser/inpost-for-woocommerce/trunk/src/InspireLabs/WoocommerceInpost/EasyPack_Helper.php#L75 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3115602%40inpost-for-woocommerce%2Ftrunk&old=3110579%40inpost-for-woocommerce%2Ftrunk&sfp_email=&sfph_mail= - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3125034%40woo-inpost%2Ftrunk&old=2886304%40woo-inpost%2Ftrunk&sfp_email=&sfph_mail=
CVE ID: CVE-2024-6501 State: PUBLISHED Published: 2024-07-09T19:27:11.133Z Last Updated: 2025-11-21T07:06:19.932Z Severity: LOW (CVSS 3.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L) Vendors: Red Hat Products: Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat OpenShift Container Platform 4 Problem Types: CWE-400 Description: A flaw was found in NetworkManager. When a system running NetworkManager with DEBUG logs enabled and an interface eth1 configured with LLDP enabled, a malicious user could inject a malformed LLDP packet. NetworkManager would crash, leading to a denial of service. Additional Analyst Notes: - CISA ADP V
alformed LLDP packet. NetworkManager would crash, leading to a denial of service. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2024:9317 - https://access.redhat.com/security/cve/CVE-2024-6501 - https://bugzilla.redhat.com/show_bug.cgi?id=2295734
CVE ID: CVE-2024-6502 State: PUBLISHED Published: 2024-08-22T15:30:52.480Z Last Updated: 2024-08-29T15:05:00.518Z Severity: MEDIUM (CVSS 5.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N) Vendors: GitLab Products: GitLab Problem Types: CWE-684 Description: An issue was discovered in GitLab CE/EE affecting all versions starting from 8.2 prior to 17.1.6 starting from 17.2 prior to 17.2.4, and starting from 17.3 prior to 17.3.1, which allows an attacker to create a branch with the same name as a deleted tag. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/470647 - https://hackerone.com/reports/2574561
CVE ID: CVE-2024-6504 State: PUBLISHED Published: 2024-07-18T09:32:03.231Z Last Updated: 2025-09-11T14:13:49.138Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L) Vendors: Rapid7 Products: InsightVM Problem Types: CWE-770 Description: Rapid7 InsightVM Console versions below 6.6.260 suffer from a protection mechanism failure whereby an attacker with network access to the InsightVM Console can cause it to overload or crash by sending repeated invalid REST requests in a short timeframe, to the Console's port 443 causing the console to enter an exception handling logging loop, exhausting the CPU. There is no indication that an attacker can use this method to escalate priv
handling logging loop, exhausting the CPU. There is no indication that an attacker can use this method to escalate privilege, acquire unauthorized access to data, or gain control of protected resources. This issue is fixed in version 6.6.261. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://docs.rapid7.com/release-notes/insightvm/20240717/