Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-1931 State: PUBLISHED Published: 2024-03-07T09:17:13.072Z Last Updated: 2025-02-13T17:32:27.025Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: NLnet Labs Products: Unbound Problem Types: CWE-835 Description: NLnet Labs Unbound version 1.18.0 up to and including version 1.19.1 contain a vulnerability that can cause denial of service by a certain code path that can lead to an infinite loop. Unbound 1.18.0 introduced a feature that removes EDE records from responses with size higher than the client's advertised buffer size. Before removing all the EDE records however, it would try to see if trimming the extra text fields on those records would
fore removing all the EDE records however, it would try to see if trimming the extra text fields on those records would result in an acceptable size while still retaining the EDE codes. Due to an unchecked condition, the code that trims the text of the EDE records could loop indefinitely. This happens when Unbound would reply with attached EDE information on a positive reply and the client's buffer size is smaller than the needed space to include EDE records. The vulnerability can only be triggered when the 'ede: yes' option is used; non default configuration. From version 1.19.2 on, the code is fixed to avoid looping indefinitely. Additional Analyst Notes: - CVE Program Container: - CISA AD
1.19.2 on, the code is fixed to avoid looping indefinitely. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.nlnetlabs.nl/downloads/unbound/CVE-2024-1931.txt - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4VCBRQ7KMSIGBQ6A4SBL5PF326DIJIIV/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/B2JUIFPA7H75Q2W3VXW2TUNHK6NVGOX4/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RBR4H7RCVMJ6H76S4LLRSY5EBFTYWGXK/ - https://lists.freebsd.org/archives/freebsd-security/2024-July/000283.html - https://security.n
J6H76S4LLRSY5EBFTYWGXK/ - https://lists.freebsd.org/archives/freebsd-security/2024-July/000283.html - https://security.netapp.com/advisory/ntap-20240705-0006/
CVE ID: CVE-2024-1932 State: PUBLISHED Published: 2024-02-28T00:00:15.339Z Last Updated: 2024-08-11T14:31:08.334Z Severity: MEDIUM (CVSS 6.1 CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N) Vendors: freescout-helpdesk Products: freescout-helpdesk/freescout Problem Types: CWE-434 Description: Unrestricted Upload of File with Dangerous Type in freescout-helpdesk/freescout Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/fefd711e-3bf0-4884-9acc-167649c1f9a2
CVE ID: CVE-2024-1933 State: PUBLISHED Published: 2024-03-26T12:47:11.238Z Last Updated: 2024-08-05T14:04:34.250Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H) Vendors: TeamViewer Products: Remote Client Problem Types: CWE-61 Description: Insecure UNIX Symbolic Link (Symlink) Following in TeamViewer Remote Client prior Version 15.52 for macOS allows an attacker with unprivileged access, to potentially elevate privileges or conduct a denial-of-service-attack by overwriting the symlink. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.teamviewer.com/de/resources/trust-center/security-bulletins/tv-2024-1002/
CVE ID: CVE-2024-1934 State: PUBLISHED Published: 2024-04-09T18:59:05.625Z Last Updated: 2024-08-01T18:56:22.581Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) Vendors: smartersite Products: WP Compress – Image Optimizer [All-In-One] Problem Types: CWE-862 Missing Authorization Description: The WP Compress – Image Optimizer plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'wps_local_compress::__construct' function in all versions up to, and including, 6.11.10. This makes it possible for unauthenticated attackers to reset the CDN region and set a malicious URL to deliver images. Additional Analyst Notes:
unauthenticated attackers to reset the CDN region and set a malicious URL to deliver images. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/88a46a24-6d46-44cc-ac01-70a1c329cb51?source=cve - https://plugins.trac.wordpress.org/browser/wp-compress-image-optimizer/tags/6.10.35/addons/legacy/compress.php - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3054445@wp-compress-image-optimizer/trunk&old=3048575@wp-compress-image-optimizer/trunk&sfp_email=&sfph_mail=#file2
CVE ID: CVE-2024-1935 State: PUBLISHED Published: 2024-03-13T15:26:40.348Z Last Updated: 2024-08-01T18:56:22.530Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) Vendors: smub Products: Giveaways and Contests by RafflePress – Get More Website Traffic, Email Subscribers, and Social Followers Problem Types: CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) Description: The Giveaways and Contests by RafflePress – Get More Website Traffic, Email Subscribers, and Social Followers plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘parent_url’ parameter in all versions up to, and including, 1.12.5 due to insufficient
ed Cross-Site Scripting via the ‘parent_url’ parameter in all versions up to, and including, 1.12.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/29b471ac-3a08-42da-9907-670c3b3bae92?source=cve - https://plugins.trac.wordpress.org/browser/rafflepress/tags/1.12.5/resources/views/rafflepress-giveaway.php - https://plugins.trac.wordpress.org/changeset?old_path=/rafflepress/tags/1.12.
resources/views/rafflepress-giveaway.php - https://plugins.trac.wordpress.org/changeset?old_path=/rafflepress/tags/1.12.5&old=3043286&new_path=/rafflepress/tags/1.12.7&new=3043286&sfp_email=&sfph_mail=
CVE ID: CVE-2024-1936 State: PUBLISHED Published: 2024-03-04T21:31:54.044Z Last Updated: 2024-11-26T13:34:08.344Z Vendors: Mozilla Products: Thunderbird Problem Types: Leaking of encrypted email subjects to other conversations Description: The encrypted subject of an email message could be incorrectly and permanently assigned to an arbitrary other email message in Thunderbird's local cache. Consequently, when replying to the contaminated email message, the user might accidentally leak the confidential subject to a third-party. While this update fixes the bug and avoids future message contamination, it does not automatically repair existing contaminations. Users are advised to use the repair
re message contamination, it does not automatically repair existing contaminations. Users are advised to use the repair folder functionality, which is available from the context menu of email folders, which will erase incorrect subject assignments. This vulnerability affects Thunderbird < 115.8.1. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1860977 - https://lists.debian.org/debian-lts-announce/2024/03/msg00022.html - https://www.mozilla.org/security/advisories/mfsa2024-11/
CVE ID: CVE-2024-1937 State: PUBLISHED Published: 2024-07-16T08:32:32.361Z Last Updated: 2024-08-01T18:56:22.641Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L) Vendors: themefusecom Products: Brizy – Page Builder Problem Types: CWE-862 Missing Authorization Description: The Brizy – Page Builder plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'update_item' function in all versions up to, and including, 2.4.44. This makes it possible for authenticated attackers, with contributor access and above, to modify the content of arbitrary published posts, which includes the ability to insert malicious JavaScript.
nd above, to modify the content of arbitrary published posts, which includes the ability to insert malicious JavaScript. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/bb5f73c3-f40b-45d5-9947-c1a514d230f7?source=cve - https://plugins.trac.wordpress.org/changeset/3112878/brizy/trunk/editor/api.php
CVE ID: CVE-2024-1938 State: PUBLISHED Published: 2024-02-29T00:25:49.510Z Last Updated: 2025-02-13T17:32:27.642Z Vendors: Google Products: Chrome Problem Types: Type Confusion Description: Type Confusion in V8 in Google Chrome prior to 122.0.6261.94 allowed a remote attacker to potentially exploit object corruption via a crafted HTML page. (Chromium security severity: High) Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://chromereleases.googleblog.com/2024/02/stable-channel-update-for-desktop_27.html - https://issues.chromium.org/issues/324596281 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/
m.org/issues/324596281 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/L6KJCEJWJR5Z54Z75LRJGELDNMFDKLZG/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FGWSP5MIK7CDWJQHN2SJJX2YGSSS7E4O/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YTGM2WHYSZAUUPENB7YO6E5ONAKE6AKJ/
CVE ID: CVE-2024-1939 State: PUBLISHED Published: 2024-02-29T00:25:50.121Z Last Updated: 2025-02-13T17:32:28.249Z Vendors: Google Products: Chrome Problem Types: Type Confusion Description: Type Confusion in V8 in Google Chrome prior to 122.0.6261.94 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2024/02/stable-channel-update-for-desktop_27.html - https://issues.chromium.org/issues/323694592 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/L6
org/issues/323694592 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/L6KJCEJWJR5Z54Z75LRJGELDNMFDKLZG/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FGWSP5MIK7CDWJQHN2SJJX2YGSSS7E4O/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YTGM2WHYSZAUUPENB7YO6E5ONAKE6AKJ/
CVE ID: CVE-2024-1940 State: PUBLISHED Published: 2024-06-05T05:33:06.619Z Last Updated: 2024-08-01T18:56:22.552Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L) Vendors: themefusecom Products: Brizy – Page Builder Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Brizy – Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via post content in all versions up to, and including, 2.4.41 due to insufficient input sanitization performed only on the client side and insufficient output escaping. This makes it possible for authenticated attackers, with contributor access and ab
ide and insufficient output escaping. This makes it possible for authenticated attackers, with contributor access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/e056dcb5-a66b-4cd3-9a73-37f226015e09?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3055256%40brizy&new=3055256%40brizy&sfp_email=&sfph_mail=
CVE ID: CVE-2024-1941 State: PUBLISHED Published: 2024-03-01T00:17:22.486Z Last Updated: 2024-08-22T18:09:58.459Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Delta Electronics Products: CNCSoft-B Problem Types: CWE-121 Description: Delta Electronics CNCSoft-B versions 1.0.0.4 and prior are vulnerable to a stack-based buffer overflow, which may allow an attacker to execute arbitrary code. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-24-060-01
CVE ID: CVE-2024-1942 State: PUBLISHED Published: 2024-02-29T10:41:38.292Z Last Updated: 2024-08-12T13:16:32.143Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: Mattermost Products: Mattermost Problem Types: CWE-284 Description: Mattermost versions 8.1.x before 8.1.9, 9.2.x before 9.2.5, and 9.3.0 fail to sanitize the metadata on posts containing permalinks under specific conditions, which allows an authenticated attacker to access the contents of individual posts in channels they are not a member of. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://mattermost.com/security-updates
CVE ID: CVE-2024-1943 State: PUBLISHED Published: 2024-02-28T06:46:48.168Z Last Updated: 2024-08-01T18:56:22.392Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: wpmoose Products: Yuki Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The Yuki theme for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including 1.3.14. This is due to missing or incorrect nonce validation on the reset_customizer_options() function. This makes it possible for unauthenticated attackers to reset the themes settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a l
tings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/dfb760fb-f281-4649-9bd3-92f8e281f07e?source=cve - https://themes.trac.wordpress.org/changeset/218603/yuki/1.3.15/inc/extensions/class-reset-extension.php
CVE ID: CVE-2024-1944 State: REJECTED Published: N/A Last Updated: 2025-02-11T01:05:28.690Z Description: No description available.
CVE ID: CVE-2024-1945 State: PUBLISHED Published: 2024-05-02T16:51:41.117Z Last Updated: 2024-08-01T18:56:22.314Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H) Vendors: reputeinfosystems Products: Contact Form, Survey & Popup Form Plugin for WordPress – ARForms Form Builder Problem Types: CWE-862 Missing Authorization Description: The Contact Form, Survey & Popup Form Plugin for WordPress – ARForms Form Builder plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'arflite_remove_preview_data' function in all versions up to, and including, 1.6.4. This makes it possible for authenticated attackers, with subscriber acc
ion in all versions up to, and including, 1.6.4. This makes it possible for authenticated attackers, with subscriber access and above, to delete arbitrary site options, resulting in loss of availability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/026f8d9b-a66b-4a59-8375-fba587a4eef7?source=cve - https://plugins.trac.wordpress.org/browser/arforms-form-builder/tags/1.6.3/core/controllers/arfliteformcontroller.php
CVE ID: CVE-2024-1946 State: PUBLISHED Published: 2024-04-02T09:32:10.179Z Last Updated: 2024-08-01T18:56:22.504Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: studiopress Products: Genesis Blocks Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Genesis Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the block content in all versions up to, and including, 3.1.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor access and above, to inject arbitrary web scripts in pages that wil
ssible for authenticated attackers, with contributor access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/ce116ee1-f0ea-469b-8c17-8c17c76fdc66?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3059862%40genesis-blocks&new=3059862%40genesis-blocks&sfp_email=&sfph_mail=
CVE ID: CVE-2024-1947 State: PUBLISHED Published: 2024-05-23T11:02:21.780Z Last Updated: 2024-10-03T06:23:18.622Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: GitLab Products: GitLab Problem Types: CWE-409 Description: A denial of service (DoS) condition was discovered in GitLab CE/EE affecting all versions from 13.2.4 before 16.10.6, 16.11 before 16.11.3, and 17.0 before 17.0.1. By leveraging this vulnerability an attacker could create a DoS condition by sending crafted API calls. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/443559 - https://hackerone.com/reports/2
Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/443559 - https://hackerone.com/reports/2380264
CVE ID: CVE-2024-1948 State: PUBLISHED Published: 2024-04-09T18:58:54.533Z Last Updated: 2024-08-01T18:56:22.478Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: jetmonsters Products: Getwid – Gutenberg Blocks Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Getwid – Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the block content in all versions up to, and including, 2.0.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor access and above, to inject arbitrary web scr
ping. This makes it possible for authenticated attackers, with contributor access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/6cbe4748-6e87-4332-b84f-615aec67bcec?source=cve - https://plugins.trac.wordpress.org/changeset/3055393#file4
CVE ID: CVE-2024-1949 State: PUBLISHED Published: 2024-02-29T10:41:54.916Z Last Updated: 2024-08-01T18:56:22.631Z Severity: LOW (CVSS 2.6 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N) Vendors: Mattermost Products: Mattermost Problem Types: CWE-200 Description: A race condition in Mattermost versions 8.1.x before 8.1.9, and 9.4.x before 9.4.2 allows an authenticated attacker to gain unauthorized access to individual posts' contents via carefully timed post creation while another user deletes posts. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://mattermost.com/security-updates
CVE ID: CVE-2024-1950 State: PUBLISHED Published: 2024-03-13T15:27:23.100Z Last Updated: 2024-08-09T20:43:05.488Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: wpwax Products: Product Carousel Slider & Grid Ultimate for WooCommerce Problem Types: CWE-502 Deserialization of Untrusted Data Description: The Product Carousel Slider & Grid Ultimate for WooCommerce plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.9.7 via deserialization of untrusted input via shortcode. This makes it possible for authenticated attackers, with contributor access and above, to inject a PHP Object. No POP chain is present in the vulne
authenticated attackers, with contributor access and above, to inject a PHP Object. No POP chain is present in the vulnerable plugin. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/ed8636bf-229a-42a5-a19c-332679613dd2?source=cve - https://plugins.trac.wordpress.org/browser/woo-product-carousel-slider-and-grid-ultimate/tags/1.9.7/includes/classes/class-shortcode.php - https://plugins.trac.wordpress.org/brows
usel-slider-and-grid-ultimate/tags/1.9.7/includes/classes/class-shortcode.php - https://plugins.trac.wordpress.org/browser/woo-product-carousel-slider-and-grid-ultimate/tags/1.9.7/includes/classes/class-meta-box.php - https://plugins.trac.wordpress.org/changeset?old_path=/woo-product-carousel-slider-and-grid-ultimate/tags/1.9.7&old=3045923&new_path=/woo-product-carousel-slider-and-grid-ultimate/tags/1.9.8&new=3045923&sfp_email=&sfph_mail=
CVE ID: CVE-2024-1951 State: PUBLISHED Published: 2024-03-13T15:27:10.333Z Last Updated: 2024-08-08T18:37:17.663Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: wpwax Products: Logo Showcase Ultimate – Logo Carousel, Logo Slider & Logo Grid Problem Types: CWE-502 Deserialization of Untrusted Data Description: The Logo Showcase Ultimate – Logo Carousel, Logo Slider & Logo Grid plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.3.8 via deserialization via shortcode of untrusted input. This makes it possible for authenticated attackers, with contributor access and above, to inject a PHP Object. No POP chain is pres
it possible for authenticated attackers, with contributor access and above, to inject a PHP Object. No POP chain is present in the vulnerable plugin. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/a63b2091-1502-4d9f-98c4-ce9d2f923dc4?source=cve - https://plugins.trac.wordpress.org/browser/logo-showcase-ultimate/tags/1.3.8/classes/lcg-adl-metabox.php - https://plugins.trac.wordpress.org/browser/logo-showcase
logo-showcase-ultimate/tags/1.3.8/classes/lcg-adl-metabox.php - https://plugins.trac.wordpress.org/browser/logo-showcase-ultimate/tags/1.3.8/classes/lcg-shortcode.php - https://plugins.trac.wordpress.org/changeset?old_path=/logo-showcase-ultimate/tags/1.3.8&old=3045923&new_path=/logo-showcase-ultimate/tags/1.3.9&new=3045923&sfp_email=&sfph_mail=
CVE ID: CVE-2024-1952 State: PUBLISHED Published: 2024-02-29T10:42:15.362Z Last Updated: 2025-04-22T15:52:35.817Z Severity: LOW (CVSS 3.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: Mattermost Products: Mattermost Problem Types: CWE-200 Description: Mattermost version 8.1.x before 8.1.9 fails to sanitize data associated with permalinks when a plugin updates an ephemeral post, allowing an authenticated attacker who can control the ephemeral post update to access individual posts' contents in channels they are not a member of. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://mattermost.com/security-updates