Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-29201 State: PUBLISHED Published: 2024-03-29T14:57:40.323Z Last Updated: 2025-03-25T19:38:50.208Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: jumpserver Products: jumpserver Problem Types: CWE-94 Description: JumpServer is an open source bastion host and an operation and maintenance security audit system. Attackers can bypass the input validation mechanism in JumpServer's Ansible to execute arbitrary code within the Celery container. Since the Celery container runs with root privileges and has database access, attackers could steal sensitive information from all hosts or manipulate the database. This vulnerability is fixed in v3.10.7. A
s could steal sensitive information from all hosts or manipulate the database. This vulnerability is fixed in v3.10.7. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/jumpserver/jumpserver/security/advisories/GHSA-pjpp-cm9x-6rwj - https://www.sonarsource.com/blog/diving-into-jumpserver-attackers-gateway-to-internal-networks-2-2
CVE ID: CVE-2024-29202 State: PUBLISHED Published: 2024-03-29T14:57:43.606Z Last Updated: 2025-03-25T19:57:03.512Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: jumpserver Products: jumpserver Problem Types: CWE-94 Description: JumpServer is an open source bastion host and an operation and maintenance security audit system. Attackers can exploit a Jinja2 template injection vulnerability in JumpServer's Ansible to execute arbitrary code within the Celery container. Since the Celery container runs with root privileges and has database access, attackers could steal sensitive information from all hosts or manipulate the database. This vulnerability is fixed i
ss, attackers could steal sensitive information from all hosts or manipulate the database. This vulnerability is fixed in v3.10.7. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/jumpserver/jumpserver/security/advisories/GHSA-2vvr-vmvx-73ch - https://www.sonarsource.com/blog/diving-into-jumpserver-attackers-gateway-to-internal-networks-2-2
CVE ID: CVE-2024-29203 State: PUBLISHED Published: 2024-03-26T13:23:53.673Z Last Updated: 2024-08-06T14:37:35.656Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) Vendors: tinymce Products: tinymce Problem Types: CWE-79 Description: TinyMCE is an open source rich text editor. A cross-site scripting (XSS) vulnerability was discovered in TinyMCE’s content insertion code. This allowed `iframe` elements containing malicious code to execute when inserted into the editor. These `iframe` elements are restricted in their permissions by same-origin browser protections, but could still trigger operations such as downloading of malicious assets. This vulnerability is fixed in 6
rotections, but could still trigger operations such as downloading of malicious assets. This vulnerability is fixed in 6.8.1. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/tinymce/tinymce/security/advisories/GHSA-438c-3975-5x3f - https://github.com/tinymce/tinymce/commit/bcdea2ad14e3c2cea40743fb48c63bba067ae6d1 - https://www.tiny.cloud/docs/tinymce/6/6.8.1-release-notes/#new-convert_unsafe_embeds-option-that-controls-whether-object-and-embed-elements-will-be-converted-to-more-restrictive-alternatives-namely-img-for-image-mime-types-video-for-video-mime-types-audio-audio-mime-types-or-iframe-for-other-or-unspecified-mime-types - h
for-image-mime-types-video-for-video-mime-types-audio-audio-mime-types-or-iframe-for-other-or-unspecified-mime-types - https://www.tiny.cloud/docs/tinymce/7/7.0-release-notes/#sandbox_iframes-editor-option-is-now-defaulted-to-true
CVE ID: CVE-2024-29204 State: PUBLISHED Published: 2024-04-19T01:10:11.799Z Last Updated: 2024-08-02T01:10:55.201Z Severity: CRITICAL (CVSS 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Ivanti Products: Avalanche Description: A Heap Overflow vulnerability in WLAvalancheService component of Ivanti Avalanche before 6.4.3 allows a remote unauthenticated attacker to execute arbitrary commands Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://forums.ivanti.com/s/article/Avalanche-6-4-3-Security-Hardening-and-CVEs-addressed?language=en_US
CVE ID: CVE-2024-29205 State: PUBLISHED Published: 2024-04-24T23:12:51.923Z Last Updated: 2024-10-03T21:30:48.706Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Ivanti, Ivanti Products: Connect Secure, Policy Secure Description: An Improper Check for Unusual or Exceptional Conditions vulnerability in the web component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) allows a remote unauthenticated attacker to send specially crafted requests in-order-to cause service disruptions. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://forums.ivanti.com/s/article/SA-CVE-2024-21894-Heap-Overflow
Vulnrichment: - CVE Program Container: References: - https://forums.ivanti.com/s/article/SA-CVE-2024-21894-Heap-Overflow-CVE-2024-22052-Null-Pointer-Dereference-CVE-2024-22053-Heap-Overflow-and-CVE-2024-22023-XML-entity-expansion-or-XXE-for-Ivanti-Connect-Secure-and-Ivanti-Policy-Secure-Gateways?language=en_US
CVE ID: CVE-2024-29206 State: PUBLISHED Published: 2024-05-07T16:40:02.543Z Last Updated: 2024-08-02T01:10:55.425Z Severity: LOW (CVSS 2.2 CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N) Vendors: Ubiquiti Inc Products: UniFi Connect EV Station, UniFi Connect EV Station Pro, UniFi Access G2 Reader Pro , UniFi Access Reader Pro , UniFi Access Intercom, UniFi Access Intercom Viewer, UniFi Connect Display, UniFi Connect Display Cast Description: An Improper Access Control could allow a malicious actor authenticated in the API to enable Android Debug Bridge (ADB) and make unsupported changes to the system. Affected Products: UniFi Connect EV Station (Version 1.1.18 and earlier) UniFi Connect EV Sta
ted changes to the system. Affected Products: UniFi Connect EV Station (Version 1.1.18 and earlier) UniFi Connect EV Station Pro (Version 1.1.18 and earlier) UniFi Access G2 Reader Pro (Version 1.2.172 and earlier) UniFi Access Reader Pro (Version 2.7.238 and earlier) UniFi Access Intercom (Version 1.0.66 and earlier) UniFi Access Intercom Viewer (Version 1.0.5 and earlier) UniFi Connect Display (Version 1.9.324 and earlier) UniFi Connect Display Cast (Version 1.6.225 and earlier) Mitigation: Update UniFi Connect Application to Version 3.10.7 or later. Update UniFi Connect EV Station to Version 1.2.15 or later. Update UniFi Connect EV Station Pro to Version 1.2.15 or later. Update UniFi Acce
EV Station to Version 1.2.15 or later. Update UniFi Connect EV Station Pro to Version 1.2.15 or later. Update UniFi Access G2 Reader Pro Version 1.3.37 or later. Update UniFi Access Reader Pro Version 2.8.19 or later. Update UniFi Access Intercom Version 1.1.32 or later. Update UniFi Access Intercom Viewer Version 1.1.6 or later. Update UniFi Connect Display to Version 1.11.348 or later. Update UniFi Connect Display Cast to Version 1.8.255 or later. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://community.ui.com/releases/Security-Advisory-bulletin-039-039/44e24007-2c2c-4ac0-bebf-3f19b9b24f09
CVE ID: CVE-2024-29207 State: PUBLISHED Published: 2024-05-07T16:40:02.502Z Last Updated: 2024-08-02T01:10:55.406Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Ubiquiti Inc Products: UniFi Connect Application, UniFi Connect EV Station, UniFi Connect EV Station Pro , UniFi Connect Display, UniFi Connect Display Cast Description: An Improper Certificate Validation could allow a malicious actor with access to an adjacent network to take control of the system. Affected Products: UniFi Connect Application (Version 3.7.9 and earlier) UniFi Connect EV Station (Version 1.1.18 and earlier) UniFi Connect EV Station Pro (Version 1.1.18 and earlier) UniFi Connect Displ
ct EV Station (Version 1.1.18 and earlier) UniFi Connect EV Station Pro (Version 1.1.18 and earlier) UniFi Connect Display (Version 1.9.324 and earlier) UniFi Connect Display Cast (Version 1.6.225 and earlier) Mitigation: Update UniFi Connect Application to Version 3.10.7 or later. Update UniFi Connect EV Station to Version 1.2.15 or later. Update UniFi Connect EV Station Pro to Version 1.2.15 or later. Update UniFi Connect Display to Version 1.11.348 or later. Update UniFi Connect Display Cast to Version 1.8.255 or later. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://community.ui.com/releases/Security-Advisory-bulletin-039-039/44e24007-2c2
- CVE Program Container: References: - https://community.ui.com/releases/Security-Advisory-bulletin-039-039/44e24007-2c2c-4ac0-bebf-3f19b9b24f09
CVE ID: CVE-2024-29208 State: PUBLISHED Published: 2024-05-07T16:40:02.495Z Last Updated: 2024-08-02T01:10:54.459Z Severity: LOW (CVSS 2.2 CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N) Vendors: Ubiquiti Inc Products: Update UniFi Connect EV Station, Update UniFi Connect EV Station Pro, Update UniFi Connect Display, Update UniFi Connect Display Cast Description: An Unverified Password Change could allow a malicious actor with API access to the device to change the system password without knowing the previous password. Affected Products: UniFi Connect EV Station (Version 1.1.18 and earlier) UniFi Connect EV Station Pro (Version 1.1.18 and earlier) UniFi Connect Display (Version 1.9.324 and ear
18 and earlier) UniFi Connect EV Station Pro (Version 1.1.18 and earlier) UniFi Connect Display (Version 1.9.324 and earlier) UniFi Connect Display Cast (Version 1.6.225 and earlier) Mitigation: Update UniFi Connect Application to Version 3.10.7 or later. Update UniFi Connect EV Station to Version 1.2.15 or later. Update UniFi Connect EV Station Pro to Version 1.2.15 or later. Update UniFi Connect Display to Version 1.11.348 or later. Update UniFi Connect Display Cast to Version 1.8.255 or later. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://community.ui.com/releases/Security-Advisory-bulletin-039-039/44e24007-2c2c-4ac0-bebf-3f19b9b24f09
CVE ID: CVE-2024-29209 State: PUBLISHED Published: 2024-05-07T16:53:43.419Z Last Updated: 2024-08-08T14:57:28.514Z Severity: MEDIUM (CVSS 6 CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L) Vendors: KnowBe4 Products: Phish Alert Button (PAB) for Outlook, Second Chance Client, PasswordIQ (PIQ) Client Description: A medium severity vulnerability has been identified in the update mechanism of the Phish Alert Button for Outlook, which could allow an attacker to remotely execute arbitrary code on the host machine. The vulnerability arises from the application's failure to securely verify the authenticity and integrity of the update server. The application periodically checks for updates by querying a
erify the authenticity and integrity of the update server. The application periodically checks for updates by querying a specific URL. However, this process does not enforce strict SSL/TLS verification, nor does it validate the digital signature of the received update files. An attacker with the capability to perform DNS spoofing can exploit this weakness. By manipulating DNS responses, the attacker can redirect the application's update requests to a malicious server under their control. Once the application queries the spoofed update URL, the malicious server can respond with a crafted update package. Since the application fails to properly verify the authenticity of the update file, it wil
ith a crafted update package. Since the application fails to properly verify the authenticity of the update file, it will accept and execute the package, leading to arbitrary code execution on the host machine. Impact: Successful exploitation of this vulnerability allows an attacker to execute code with elevated privileges, potentially leading to data theft, installation of further malware, or other malicious activities on the host system. Affected Products: Phish Alert Button (PAB) for Outlook versions 1.10.0-1.10.11 Second Chance Client versions 2.0.0-2.0.9 PIQ Client versions 1.0.0-1.0.15 Remediation: Automated updates will be pushed to address this issue. Users of affected versions shoul
sions 1.0.0-1.0.15 Remediation: Automated updates will be pushed to address this issue. Users of affected versions should verify the latest version is applied and, if not, apply the latest updates provided by KnowBe4, which addresses this vulnerability by implementing proper SSL/TLS checks of the update server. It is also recommended to ensure DNS settings are secure to prevent DNS spoofing attacks. Workarounds: Use secure corporate networks or VPN services to secure network communications, which can help mitigate the risk of DNS spoofing. Credits: This vulnerability was discovered by Ceri Coburn at Pen Test Partners, who reported it responsibly to the vendor. Additional Analyst Notes: - CVE
scovered by Ceri Coburn at Pen Test Partners, who reported it responsibly to the vendor. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.knowbe4.com/hc/en-us/articles/28959755127955-CVE-2024-29209
CVE ID: CVE-2024-29210 State: PUBLISHED Published: 2024-05-07T16:53:43.381Z Last Updated: 2024-08-02T01:10:55.244Z Severity: LOW (CVSS 2.8 CVSS:3.0/AV:L/AC:L/PR:H/UI:R/S:C/C:N/I:L/A:N) Vendors: KnowBe4 Products: Phish Alert Button (PAB) for Outlook, Phish Alert Button (PAB) f, Second Chance Client, PasswordIQ (PIQ) Client Description: A local privilege escalation (LPE) vulnerability has been identified in Phish Alert Button for Outlook (PAB), specifically within its configuration management functionalities. This vulnerability allows a regular user to modify the application's configuration file to redirect update checks to an arbitrary server, which can then be exploited in conjunction with C
s configuration file to redirect update checks to an arbitrary server, which can then be exploited in conjunction with CVE-2024-29209 to execute arbitrary code with elevated privileges. The issue stems from improper permission settings on the application's configuration file, which is stored in a common directory accessible to all users. This file includes critical parameters, such as the update server URL. By default, the application does not enforce adequate access controls on this file, allowing non-privileged users to modify it without administrative consent. An attacker with regular user access can alter the update server URL specified in the configuration file to point to a malicious s
r with regular user access can alter the update server URL specified in the configuration file to point to a malicious server. When the application performs its next update check, it will contact the attacker-controlled server. If the system is also vulnerable to CVE-2024-29209, the attacker can deliver a malicious update package that, when executed, grants them elevated privileges. Impact: This vulnerability can lead to a regular user executing code with administrative privileges. This can result in unauthorized access to sensitive data, installation of additional malware, and a full takeover of the affected system. Affected Products: Phish Alert Button (PAB) for Outlook versions 1.10.0-1.1
and a full takeover of the affected system. Affected Products: Phish Alert Button (PAB) for Outlook versions 1.10.0-1.10.11 Second Chance Client versions 2.0.0-2.0.9 PIQ Client versions 1.0.0-1.0.15 Remediation: KnowBe4 has released a patch that corrects the permission settings on the configuration file to prevent unauthorized modifications. Automated updates will be pushed to address this issue. Users of affected versions should verify the latest version is applied and, if not, apply the latest updates provided by KnowBe4. Workarounds: Manually set the correct permissions on the configuration file to restrict write access to administrators only. Credits: This vulnerability was discovered b
on the configuration file to restrict write access to administrators only. Credits: This vulnerability was discovered by Ceri Coburn at Pen Test Partners, who reported it responsibly to the vendor. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://support.knowbe4.com/hc/en-us/articles/28959854203923-CVE-2024-29210
CVE ID: CVE-2024-29211 State: PUBLISHED Published: 2024-11-13T01:54:45.547Z Last Updated: 2024-11-13T16:49:48.676Z Severity: HIGH (CVSS 7.1 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H) Vendors: Ivanti Products: Secure Access Client Description: A race condition in Ivanti Secure Access Client before version 22.7R4 allows a local authenticated attacker to modify sensitive configuration files. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-ICS-Ivanti-Policy-Secure-IPS-Ivanti-Secure-Access-Client-ISAC-Multiple-CVEs
CVE ID: CVE-2024-29212 State: PUBLISHED Published: 2024-05-13T01:07:49.112Z Last Updated: 2024-08-02T01:10:54.643Z Severity: CRITICAL (CVSS 9.9 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: Veeam Products: Service Provider Console Description: Due to an unsafe de-serialization method used by the Veeam Service Provider Console(VSPC) server in communication between the management agent and its components, under certain conditions, it is possible to perform Remote Code Execution (RCE) on the VSPC server machine. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.veeam.com/kb4575
CVE ID: CVE-2024-29213 State: PUBLISHED Published: 2024-10-18T23:06:49.569Z Last Updated: 2024-10-21T17:16:00.310Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Ivanti Products: DSM Description: Ivanti DSM < version 2024.2 allows authenticated users on the local machine to run code with elevated privileges due to insecure ACL via unspecified attack vector. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://forums.ivanti.com/s/article/SA-2024-07-12-CVE-2024-29213
CVE ID: CVE-2024-29214 State: PUBLISHED Published: 2025-02-12T21:19:29.642Z Last Updated: 2025-11-03T20:37:09.676Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: n/a Products: Intel(R) Processors Problem Types: Escalation of Privilege, CWE-20 Description: Improper input validation in UEFI firmware CseVariableStorageSmm for some Intel(R) Processors may allow a privileged user to potentially enable escalation of privilege via local access. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01139.html
CVE ID: CVE-2024-29215 State: PUBLISHED Published: 2024-05-26T13:33:41.791Z Last Updated: 2024-08-02T01:10:54.568Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: Mattermost Products: Mattermost Problem Types: CWE-284 Description: Mattermost versions 9.5.x <= 9.5.3, 9.7.x <= 9.7.1, 9.6.x <= 9.6.1, 8.1.x <= 8.1.12 fail to enforce proper access control which allows a user to run a slash command in a channel they are not a member of via linking a playbook run to that channel and running a slash command as a playbook task command. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://mattermost.com/security-updates
CVE ID: CVE-2024-29216 State: PUBLISHED Published: 2024-03-25T06:10:18.614Z Last Updated: 2024-11-07T16:54:34.686Z Vendors: Sangoma Technologies Products: cg6kwin2k.sys Problem Types: Exposed IOCTL with Insufficient Access Control Description: Exposed IOCTL with insufficient access control issue exists in cg6kwin2k.sys prior to 2.1.7.0. By sending a specific IOCTL request, a user without the administrator privilege may perform I/O to arbitrary hardware port or physical address, resulting in erasing or altering the firmware. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://sangomakb.atlassian.net/wiki/spaces/DVC/pages/45351279/Natural+Access+So
- CISA ADP Vulnrichment: References: - https://sangomakb.atlassian.net/wiki/spaces/DVC/pages/45351279/Natural+Access+Software+Download - https://jvn.jp/en/vu/JVNVU90671953/
CVE ID: CVE-2024-29217 State: PUBLISHED Published: 2024-04-21T16:04:10.514Z Last Updated: 2025-02-13T17:47:40.145Z Vendors: Apache Software Foundation Products: Apache Answer Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache Answer.This issue affects Apache Answer: before 1.3.0. XSS attack when user changes personal website. A logged-in user, when modifying their personal website, can input malicious code in the website to create such an attack. Users are recommended to upgrade to version [1.3.0], which fixes the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: Refe
version [1.3.0], which fixes the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://lists.apache.org/thread/nc0g1borr0d3wx25jm39pn7nyf268n0x - http://www.openwall.com/lists/oss-security/2024/04/19/1
CVE ID: CVE-2024-29218 State: PUBLISHED Published: 2024-04-15T10:37:59.927Z Last Updated: 2024-09-25T03:52:10.512Z Vendors: KEYENCE CORPORATION Products: KV STUDIO, KV REPLAY VIEWER, VT5-WX15/WX12 Problem Types: CWE-787 Description: Out-of-bounds write vulnerability exists in KV STUDIO Ver.11.64 and earlier, KV REPLAY VIEWER Ver.2.64 and earlier, and VT5-WX15/WX12 Ver.6.02 and earlier, which may lead to information disclosure or arbitrary code execution by having a user of the affected product open a specially crafted file. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.keyence.com/kv_vulnerability240924_en - https://jvn.jp/en/vu/JVNVU95
- CVE Program Container: References: - https://www.keyence.com/kv_vulnerability240924_en - https://jvn.jp/en/vu/JVNVU95439120/
CVE ID: CVE-2024-29219 State: PUBLISHED Published: 2024-04-15T10:41:33.292Z Last Updated: 2025-09-19T17:21:43.118Z Vendors: KEYENCE CORPORATION Products: KV STUDIO, KV REPLAY VIEWER, VT5-WX15/WX12 Problem Types: CWE-125 Description: Out-of-bounds read vulnerability exists in KV STUDIO Ver.11.64 and earlier and KV REPLAY VIEWER Ver.2.64 and earlier, and VT5-WX15/WX12 Ver.6.02 and earlier, which may lead to information disclosure or arbitrary code execution by having a user of the affected product open a specially crafted file. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.keyence.com/kv_vulnerability240924_en - https://jvn.jp/en/vu/JVNVU
t: - CVE Program Container: References: - https://www.keyence.com/kv_vulnerability240924_en - https://jvn.jp/en/vu/JVNVU95439120/
CVE ID: CVE-2024-29220 State: PUBLISHED Published: 2024-04-11T02:29:10.868Z Last Updated: 2024-11-26T17:59:14.210Z Vendors: Saturday Drive Products: Ninja Forms Problem Types: Cross-site scripting (XSS) Description: Ninja Forms prior to 3.8.1 contains a cross-site scripting vulnerability in custom fields for labels. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who is accessing to the website using the product. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://wordpress.org/plugins/ninja-forms/ - https://ninjaforms.com/ - https://jvn.jp/en/jp/JVN50361500/