Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
database/wordpress/plugin/sticky-social-icons/vulnerability/wordpress-sticky-social-icons-plugin-1-2-1-stored-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2024-52492 State: PUBLISHED Published: 2024-12-02T13:48:53.721Z Last Updated: 2024-12-02T15:40:25.083Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: Gopi Ramasamy Products: Image horizontal reel scroll slideshow Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Gopi Ramasamy Image horizontal reel scroll slideshow allows Stored XSS.This issue affects Image horizontal reel scroll slideshow: from n/a through 13.4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/image-horizontal-reel-scroll-slidesh
SA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/image-horizontal-reel-scroll-slideshow/vulnerability/wordpress-image-horizontal-reel-scroll-slideshow-plugin-13-4-stored-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2024-52493 State: PUBLISHED Published: 2024-12-02T13:48:53.183Z Last Updated: 2024-12-02T15:40:24.936Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: Josh Leuze Products: Meteor Slides Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Josh Leuze Meteor Slides allows Stored XSS.This issue affects Meteor Slides: from n/a through 1.5.7. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/meteor-slides/vulnerability/wordpress-meteor-slides-plugin-1-5-7-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2024-52494 State: PUBLISHED Published: 2024-12-02T13:48:52.639Z Last Updated: 2024-12-02T15:40:24.768Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: Matt Varone, Tim Berneman Products: Dynamic "To Top" Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Matt Varone, Tim Berneman Dynamic "To Top" allows Stored XSS.This issue affects Dynamic "To Top": from 3.5.2 through n/a. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/dynamic-to-top/vulnerability/wordpress-dynamic-to-top-plugin-3-5-2-cross-site
//patchstack.com/database/wordpress/plugin/dynamic-to-top/vulnerability/wordpress-dynamic-to-top-plugin-3-5-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2024-52495 State: PUBLISHED Published: 2024-11-28T10:43:36.584Z Last Updated: 2024-11-28T12:15:16.475Z Severity: HIGH (CVSS 8.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L) Vendors: Eniture Technology Products: Distance Based Shipping Calculator Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Eniture Technology Distance Based Shipping Calculator allows SQL Injection.This issue affects Distance Based Shipping Calculator: from n/a through 2.0.21. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/distance-based-shipping-calculator/
ISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/distance-based-shipping-calculator/vulnerability/wordpress-distance-based-shipping-calculator-plugin-2-0-21-sql-injection-vulnerability?_s_id=cve
CVE ID: CVE-2024-52496 State: PUBLISHED Published: 2024-11-28T10:41:56.928Z Last Updated: 2024-11-29T17:17:06.324Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: AbsolutePlugins Products: Absolute Addons For Elementor Problem Types: CWE-98 Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AbsolutePlugins Absolute Addons For Elementor allows Local Code Inclusion.This issue affects Absolute Addons For Elementor: from n/a through 1.0.14. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/absolute-addons/vulnerability/
: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/absolute-addons/vulnerability/wordpress-absolute-addons-for-elementor-plugin-1-0-14-local-file-inclusion-vulnerability?_s_id=cve
CVE ID: CVE-2024-52497 State: PUBLISHED Published: 2024-11-28T10:39:56.999Z Last Updated: 2024-11-29T17:19:19.111Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: quomodosoft Products: Shopready Problem Types: CWE-98 Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in quomodosoft Shopready allows PHP Local File Inclusion.This issue affects Shopready: from n/a through 3.5. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/shopready-elementor-addon/vulnerability/wordpress-shopready-plugin-3-5-local-file-inclusion-vulne
abase/wordpress/plugin/shopready-elementor-addon/vulnerability/wordpress-shopready-plugin-3-5-local-file-inclusion-vulnerability?_s_id=cve
CVE ID: CVE-2024-52498 State: PUBLISHED Published: 2024-11-28T10:38:55.224Z Last Updated: 2024-11-29T18:52:13.083Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Softpulse Infotech Products: SP Blog Designer Problem Types: CWE-35 Description: Path Traversal: '.../...//' vulnerability in Softpulse Infotech SP Blog Designer allows PHP Local File Inclusion.This issue affects SP Blog Designer: from n/a through 1.0.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/sp-blog-designer/vulnerability/wordpress-sp-blog-designer-plugin-1-0-0-local-file-inclusion-vulnerability?_s_id=cve
CVE ID: CVE-2024-52499 State: PUBLISHED Published: 2024-11-28T10:38:06.524Z Last Updated: 2024-11-29T18:54:04.436Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Kardi Products: Pricing table addon for elementor Problem Types: CWE-98 Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Kardi Pricing table addon for elementor allows PHP Local File Inclusion.This issue affects Pricing table addon for elementor: from n/a through 1.0.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/pricing-table-addon-for-elementor/v
ISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/pricing-table-addon-for-elementor/vulnerability/wordpress-pricing-table-addon-for-elementor-plugin-1-0-0-local-file-inclusion-vulnerability?_s_id=cve
CVE ID: CVE-2024-52500 State: PUBLISHED Published: 2025-02-14T12:45:33.196Z Last Updated: 2025-02-14T13:33:37.114Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:L) Vendors: monetagwp Products: Monetag Official Plugin Problem Types: CWE-862 Description: Missing Authorization vulnerability in monetagwp Monetag Official Plugin allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Monetag Official Plugin: from n/a through 1.1.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/monetag-official/vulnerability/wordpress-monetag-official-plugin-plugin-1-1-3-broken-access-contr
abase/wordpress/plugin/monetag-official/vulnerability/wordpress-monetag-official-plugin-plugin-1-1-3-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2024-52501 State: PUBLISHED Published: 2024-11-28T10:37:16.693Z Last Updated: 2024-11-29T19:28:51.028Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: webbytemplate Products: Office Locator Problem Types: CWE-98 Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in webbytemplate Office Locator.This issue affects Office Locator: from n/a through 1.3.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/office-locator/vulnerability/wordpress-office-locator-plugin-1-2-0-local-file-inclusion-vulnerability?_s_id=
ress/plugin/office-locator/vulnerability/wordpress-office-locator-plugin-1-2-0-local-file-inclusion-vulnerability?_s_id=cve
CVE ID: CVE-2024-52502 State: PUBLISHED Published: 2024-12-02T13:48:52.108Z Last Updated: 2024-12-02T15:40:24.602Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: Imbasynergy Products: ImbaChat Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Imbasynergy ImbaChat allows DOM-Based XSS.This issue affects ImbaChat: from n/a through 3.1.4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/imbachat-widget/vulnerability/wordpress-imbachat-plugin-3-1-4-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2024-52503 State: PUBLISHED Published: 2024-12-02T13:48:51.570Z Last Updated: 2024-12-02T18:59:13.944Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: Tailored Web Services Products: Tailored Tools Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tailored Web Services Tailored Tools allows Stored XSS.This issue affects Tailored Tools: from n/a through 1.8.4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/tailored-tools/vulnerability/wordpress-tailored-tools-plugin-1-8-4-cross-site-scripting-xss
om/database/wordpress/plugin/tailored-tools/vulnerability/wordpress-tailored-tools-plugin-1-8-4-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2024-52504 State: PUBLISHED Published: 2025-08-12T11:16:48.226Z Last Updated: 2025-08-12T19:15:53.642Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Siemens Products: SIPROTEC 4 6MD61, SIPROTEC 4 6MD63, SIPROTEC 4 6MD66, SIPROTEC 4 6MD665, SIPROTEC 4 7SA522, SIPROTEC 4 7SA6, SIPROTEC 4 7SD5, SIPROTEC 4 7SD610, SIPROTEC 4 7SJ61, SIPROTEC 4 7SJ62, SIPROTEC 4 7SJ63, SIPROTEC 4 7SJ64, SIPROTEC 4 7SJ66, SIPROTEC 4 7SS52, SIPROTEC 4 7ST6, SIPROTEC 4 7UM61, SIPROTEC 4 7UM62, SIPROTEC 4 7UT612, SIPROTEC 4 7UT613, SIPROTEC 4 7UT63, SIPROTEC 4 7VE6, SIPROTEC 4 7VK61, SIPROTEC 4 7VU683, SIPROTEC 4 Compact 7RW80, SIPROTEC 4 Compact 7SD80, SIPROTEC 4 Compact
TEC 4 7VE6, SIPROTEC 4 7VK61, SIPROTEC 4 7VU683, SIPROTEC 4 Compact 7RW80, SIPROTEC 4 Compact 7SD80, SIPROTEC 4 Compact 7SJ80, SIPROTEC 4 Compact 7SJ81, SIPROTEC 4 Compact 7SK80, SIPROTEC 4 Compact 7SK81 Problem Types: CWE-754 Description: A vulnerability has been identified in SIPROTEC 4 6MD61 (All versions), SIPROTEC 4 6MD63 (All versions), SIPROTEC 4 6MD66 (All versions), SIPROTEC 4 6MD665 (All versions), SIPROTEC 4 7SA522 (All versions), SIPROTEC 4 7SA6 (All versions < V4.78), SIPROTEC 4 7SD5 (All versions < V4.78), SIPROTEC 4 7SD610 (All versions < V4.78), SIPROTEC 4 7SJ61 (All versions), SIPROTEC 4 7SJ62 (All versions), SIPROTEC 4 7SJ63 (All versions), SIPROTEC 4 7SJ64 (All versions),
SJ61 (All versions), SIPROTEC 4 7SJ62 (All versions), SIPROTEC 4 7SJ63 (All versions), SIPROTEC 4 7SJ64 (All versions), SIPROTEC 4 7SJ66 (All versions), SIPROTEC 4 7SS52 (All versions), SIPROTEC 4 7ST6 (All versions), SIPROTEC 4 7UM61 (All versions), SIPROTEC 4 7UM62 (All versions), SIPROTEC 4 7UT612 (All versions), SIPROTEC 4 7UT613 (All versions), SIPROTEC 4 7UT63 (All versions), SIPROTEC 4 7VE6 (All versions), SIPROTEC 4 7VK61 (All versions), SIPROTEC 4 7VU683 (All versions), SIPROTEC 4 Compact 7RW80 (All versions), SIPROTEC 4 Compact 7SD80 (All versions), SIPROTEC 4 Compact 7SJ80 (All versions), SIPROTEC 4 Compact 7SJ81 (All versions), SIPROTEC 4 Compact 7SK80 (All versions), SIPROTEC 4
pact 7SJ80 (All versions), SIPROTEC 4 Compact 7SJ81 (All versions), SIPROTEC 4 Compact 7SK80 (All versions), SIPROTEC 4 Compact 7SK81 (All versions). Affected devices do not properly handle interrupted operations of file transfer. This could allow an unauthenticated remote attacker to cause a denial of service condition. To restore normal operations, the devices need to be restarted. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/html/ssa-400089.html
CVE ID: CVE-2024-52505 State: PUBLISHED Published: 2024-11-14T15:29:20.132Z Last Updated: 2024-11-14T15:55:36.958Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) Vendors: matrix-org Products: matrix-appservice-irc Problem Types: CWE-147 Description: matrix-appservice-irc is a Node.js IRC bridge for the Matrix messaging protocol. The provisioning API of the matrix-appservice-irc bridge up to version 3.0.2 contains a vulnerability which can lead to arbitrary IRC command execution as the bridge IRC bot. The vulnerability has been patched in matrix-appservice-irc version 3.0.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/matrix-or
service-irc version 3.0.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/matrix-org/matrix-appservice-irc/security/advisories/GHSA-c3hj-hg7p-rrq5 - https://github.com/matrix-org/matrix-appservice-irc/commit/4a024eae1a992b1ea67e71a998e0b833b54221e2
CVE ID: CVE-2024-52506 State: PUBLISHED Published: 2024-11-18T20:27:27.287Z Last Updated: 2025-09-23T18:27:04.470Z Vendors: Graylog2 Products: graylog2-server Problem Types: CWE-200 Description: Graylog is a free and open log management platform. The reporting functionality in Graylog allows the creation and scheduling of reports which contain dashboard widgets displaying individual log messages or metrics aggregated from fields of multiple log messages. This functionality, as included in Graylog 6.1.0 & 6.1.1, is vulnerable to information leakage triggered by multiple concurrent report rendering requests from authorized users. When multiple report renderings are requested at the same start
urrent report rendering requests from authorized users. When multiple report renderings are requested at the same start time, the headless browser instance used to render the PDF will be reused. Depending on the timing, either a check for the browser instance "freshness" hits, resulting in an error instead of the report being returned, or one of the concurrent report rendering requests "wins" and this report is returned for all report rendering requests that do not return an error. This might lead to one user getting the report of a different user, potentially leaking indexed log messages or aggregated data that this user normally has no access to. This problem is fixed in Graylog 6.1.2. The
ed log messages or aggregated data that this user normally has no access to. This problem is fixed in Graylog 6.1.2. There is no known workaround besides disabling the reporting functionality. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/Graylog2/graylog2-server/security/advisories/GHSA-vggm-3478-vm5m
CVE ID: CVE-2024-52507 State: PUBLISHED Published: 2024-11-15T17:24:50.173Z Last Updated: 2024-11-15T18:21:07.458Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N) Vendors: nextcloud Products: security-advisories Problem Types: CWE-639 Description: Nextcloud Tables allows users to to create tables with individual columns. The information which Table (numeric ID) is shared with which groups and users and the respective permissions was not limited to affected users. It is recommended that the Nextcloud Tables app is upgraded to 0.8.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/nextcloud/security-advisories/security/advisories/GHSA-r
otes: - CISA ADP Vulnrichment: References: - https://github.com/nextcloud/security-advisories/security/advisories/GHSA-rgvc-xr2w-qq45 - https://github.com/nextcloud/tables/pull/1406 - https://github.com/nextcloud/tables/commit/13ca45f1b9f70f694aea81b78bc7416ec840c332 - https://hackerone.com/reports/2705507
CVE ID: CVE-2024-52508 State: PUBLISHED Published: 2024-11-15T17:34:21.900Z Last Updated: 2024-11-15T18:17:04.830Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:L) Vendors: nextcloud Products: security-advisories Problem Types: CWE-200 Description: Nextcloud Mail is the mail app for Nextcloud, a self-hosted productivity platform. When a user is trying to set up a mail account with an email address like user@example.tld that does not support auto configuration, and an attacker managed to register autoconfig.tld, the used email details would be send to the server of the attacker. It is recommended that the Nextcloud Mail app is upgraded to 1.14.6, 1.15.4, 2.2.11, 3.6.3, 3
he server of the attacker. It is recommended that the Nextcloud Mail app is upgraded to 1.14.6, 1.15.4, 2.2.11, 3.6.3, 3.7.7 or 4.0.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/nextcloud/security-advisories/security/advisories/GHSA-vmhx-hwph-q6mc - https://github.com/nextcloud/mail/pull/9964 - https://github.com/nextcloud/mail/commit/a84c70e15d814dab6f0e8eda71bbaaf48152079b - https://hackerone.com/reports/2508422
CVE ID: CVE-2024-52509 State: PUBLISHED Published: 2024-11-15T17:37:47.035Z Last Updated: 2024-11-15T18:11:49.618Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N) Vendors: nextcloud Products: security-advisories Problem Types: CWE-284 Description: Nextcloud Mail is the mail app for Nextcloud, a self-hosted productivity platform. The Nextcloud mail app incorrectly allowed attaching shared files without download permissions as attachments. This allowed users to send them the files to themselves and then downloading it from their mail clients. It is recommended that the Nextcloud Mail is upgraded to 2.2.10, 3.6.2 or 3.7.2. Additional Analyst Notes: - CISA ADP Vulnrichment:
mended that the Nextcloud Mail is upgraded to 2.2.10, 3.6.2 or 3.7.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/nextcloud/security-advisories/security/advisories/GHSA-pwpp-fvcr-w862 - https://github.com/nextcloud/mail/pull/9592 - https://github.com/nextcloud/mail/commit/8d44f1ce44684022aa4e62a3e0462fdadcde6c8b - https://hackerone.com/reports/1878255
CVE ID: CVE-2024-52510 State: PUBLISHED Published: 2024-11-15T17:29:44.840Z Last Updated: 2024-11-15T18:20:10.869Z Severity: MEDIUM (CVSS 4.2 CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:N/A:N) Vendors: nextcloud Products: security-advisories Problem Types: CWE-295 Description: The Nextcloud Desktop Client is a tool to synchronize files from Nextcloud Server with your computer. The Desktop client did not stop with an error but allowed by-passing the signature validation, if a manipulated server sends an empty initial signature. It is recommended that the Nextcloud Desktop client is upgraded to 3.14.2 or later. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/next
is upgraded to 3.14.2 or later. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/nextcloud/security-advisories/security/advisories/GHSA-r4qc-m9mj-452v - https://github.com/nextcloud/desktop/pull/7333 - https://github.com/nextcloud/desktop/commit/97539218e6f63c3a3fd1694cb7d8aef27c5910d7 - https://hackerone.com/reports/2597504
CVE ID: CVE-2024-52511 State: PUBLISHED Published: 2024-11-15T17:22:41.184Z Last Updated: 2024-11-15T18:22:09.686Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:N) Vendors: nextcloud Products: security-advisories Problem Types: CWE-639 Description: Nextcloud Tables allows users to to create tables with individual columns. By directly specifying the ID of a table or view, a malicious user could blindly insert new rows into tables they have no access to. It is recommended that the Nextcloud Tables is upgraded to 0.8.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/nextcloud/security-advisories/security/advisories/GHSA-4qqp-9h2g-7qg7
ADP Vulnrichment: References: - https://github.com/nextcloud/security-advisories/security/advisories/GHSA-4qqp-9h2g-7qg7 - https://github.com/nextcloud/tables/pull/1351 - https://github.com/nextcloud/tables/commit/52846ad81fe192ee977f14c82a229b0d9cdc406c - https://hackerone.com/reports/2671404
CVE ID: CVE-2024-52512 State: PUBLISHED Published: 2024-11-15T17:18:50.519Z Last Updated: 2024-11-15T18:24:27.739Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) Vendors: nextcloud Products: security-advisories Problem Types: CWE-601 Description: user_oidc app is an OpenID Connect user backend for Nextcloud. A malicious user could send a malformed login link that would redirect the user to a provided URL after successfully authenticating. It is recommended that the Nextcloud User OIDC app is upgraded to 6.1.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/nextcloud/security-advisories/security/advisories/GHSA-784j-x2g5-4g7q - https
richment: References: - https://github.com/nextcloud/security-advisories/security/advisories/GHSA-784j-x2g5-4g7q - https://github.com/nextcloud/user_oidc/pull/961 - https://github.com/nextcloud/user_oidc/commit/c923428d51972f6d04636c6accbecdec0c1b88e9 - https://hackerone.com/reports/2720030
CVE ID: CVE-2024-52513 State: PUBLISHED Published: 2024-11-15T17:08:56.019Z Last Updated: 2024-11-15T17:33:35.575Z Severity: LOW (CVSS 2.6 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N) Vendors: nextcloud Products: security-advisories Problem Types: CWE-200 Description: Nextcloud Server is a self hosted personal cloud system. After receiving a "Files drop" or "Password protected" share link a malicious user was able to download attachments that are referenced in Text files without providing the password. It is recommended that the Nextcloud Server is upgraded to 28.0.11, 29.0.8 or 30.0.1 and Nextcloud Enterprise Server is upgraded to 25.0.13.13, 26.0.13.9, 27.1.11.9, 28.0.11, 29.0.8 or 30.0.1
0.8 or 30.0.1 and Nextcloud Enterprise Server is upgraded to 25.0.13.13, 26.0.13.9, 27.1.11.9, 28.0.11, 29.0.8 or 30.0.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/nextcloud/security-advisories/security/advisories/GHSA-gxph-5m4j-pfmj - https://github.com/nextcloud/text/pull/6485 - https://github.com/nextcloud/text/commit/ca24b25c93b81626b4e457c260243edeab5f1548 - https://hackerone.com/reports/2376900
CVE ID: CVE-2024-52514 State: PUBLISHED Published: 2024-11-15T17:06:03.628Z Last Updated: 2024-11-15T17:33:13.755Z Severity: MEDIUM (CVSS 4.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N) Vendors: nextcloud Products: security-advisories Problem Types: CWE-284 Description: Nextcloud Server is a self hosted personal cloud system. After a user received a share with some files inside being blocked by the files access control, the user would still be able to copy the intermediate folder inside Nextcloud allowing them to afterwards potentially access the blocked files depending on the user access control rules. It is recommended that the Nextcloud Server is upgraded to 27.1.9, 28.0.5 or 29.0.0 and
n the user access control rules. It is recommended that the Nextcloud Server is upgraded to 27.1.9, 28.0.5 or 29.0.0 and Nextcloud Enterprise Server is upgraded to 21.0.9.18, 22.2.10.23, 23.0.12.18, 24.0.12.14, 25.0.13.9, 26.0.13.3, 27.1.9, 28.0.5 or 29.0.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/nextcloud/security-advisories/security/advisories/GHSA-g8pr-g25r-58xj - https://github.com/nextcloud/server/pull/44889 - https://github.com/nextcloud/server/commit/5fffbcfe8650eab75b00e8d188fbc95b0e43f3a8 - https://hackerone.com/reports/2447316