Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-43089 State: PUBLISHED Published: 2024-11-13T17:25:13.683Z Last Updated: 2024-11-22T04:55:10.948Z Vendors: Google Products: Android Problem Types: Elevation of privilege Description: In updateInternal of MediaProvider.java , there is a possible access of another app's files due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://android.googlesource.com/platform/packages/providers/MediaProvider/+/33ff6a663eea1fcdd2b422b98722c1dee48a7f6a - https://source.android.com/security/bullet
packages/providers/MediaProvider/+/33ff6a663eea1fcdd2b422b98722c1dee48a7f6a - https://source.android.com/security/bulletin/2024-11-01
CVE ID: CVE-2024-43090 State: PUBLISHED Published: 2024-11-13T17:25:13.791Z Last Updated: 2025-08-26T22:48:31.531Z Vendors: Google Products: Android Problem Types: Information disclosure Description: In multiple locations, there is a possible cross-user image read due to a missing permission check. This could lead to local information disclosure with User execution privileges needed. User interaction is needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://android.googlesource.com/platform/frameworks/base/+/f1a15b5ef2539113c882fd2644f301a23e50f961 - https://source.android.com/security/bulletin/2025-03-01
CVE ID: CVE-2024-43091 State: PUBLISHED Published: 2024-11-13T17:25:13.895Z Last Updated: 2024-12-04T14:27:19.296Z Vendors: Google Products: Android Problem Types: Remote code execution Description: In filterMask of SkEmbossMaskFilter.cpp, there is a possible out of bounds write due to an integer overflow. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://android.googlesource.com/platform/external/skia/+/0b628a960e74197ace9831ef0727f5ba7ab6ac10 - https://source.android.com/security/bulletin/2024-11-01
CVE ID: CVE-2024-43093 State: PUBLISHED Published: 2024-11-13T17:25:14.006Z Last Updated: 2025-10-21T22:55:36.710Z Vendors: Google Products: Android Problem Types: Elevation of privilege Description: In shouldHideDocument of ExternalStorageProvider.java, there is a possible bypass of a file path filter designed to prevent access to sensitive directories due to incorrect unicode normalization. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://android.googlesource.com/platform/frameworks/base/+/7f83c671626f9bf993581f4598c22482d87cb
ichment: References: - https://android.googlesource.com/platform/frameworks/base/+/7f83c671626f9bf993581f4598c22482d87cba10 - https://source.android.com/security/bulletin/2025-03-01
CVE ID: CVE-2024-43095 State: PUBLISHED Published: 2025-01-21T23:04:42.642Z Last Updated: 2025-01-24T04:56:10.726Z Vendors: Google Products: Android Problem Types: Elevation of privilege Description: In multiple locations, there is a possible way to obtain any system permission due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://source.android.com/security/bulletin/2025-01-01
CVE ID: CVE-2024-43096 State: PUBLISHED Published: 2025-01-21T23:04:42.806Z Last Updated: 2025-03-19T13:40:29.299Z Vendors: Google Products: Android Problem Types: Remote code execution Description: In build_read_multi_rsp of gatt_sr.cc, there is a possible out of bounds write due to a missing bounds check. This could lead to remote (proximal/adjacent) code execution with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://source.android.com/security/bulletin/2025-01-01
CVE ID: CVE-2024-43097 State: PUBLISHED Published: 2025-01-02T23:58:26.791Z Last Updated: 2025-11-03T20:38:41.116Z Vendors: Google Products: Android Problem Types: Elevation of privilege Description: In resizeToAtLeast of SkRegion.cpp, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://android.googlesource.com/platform/external/skia/+/8d355fe1d0795fc30b84194b87563f75c6f8f2a7 - https://source.android.com/security/bulletin/2024-12-01
CVE ID: CVE-2024-43098 State: PUBLISHED Published: 2025-01-11T12:25:10.587Z Last Updated: 2025-11-03T20:38:43.911Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: i3c: Use i3cdev->desc->info instead of calling i3c_device_get_info() to avoid deadlock A deadlock may happen since the i3c_master_register() acquires &i3cbus->lock twice. See the log below. Use i3cdev->desc->info instead of calling i3c_device_info() to avoid acquiring the lock twice. v2: - Modified the title and commit message ============================================ WARNING: possible recursive locking detected 6.11.0-mainline --------------------------------------
==================== WARNING: possible recursive locking detected 6.11.0-mainline -------------------------------------------- init/1 is trying to acquire lock: f1ffff80a6a40dc0 (&i3cbus->lock){++++}-{3:3}, at: i3c_bus_normaluse_lock but task is already holding lock: f1ffff80a6a40dc0 (&i3cbus->lock){++++}-{3:3}, at: i3c_master_register other info that might help us debug this: Possible unsafe locking scenario: CPU0 ---- lock(&i3cbus->lock); lock(&i3cbus->lock); *** DEADLOCK *** May be due to missing lock nesting notation 2 locks held by init/1: #0: fcffff809b6798f8 (&dev->mutex){....}-{3:3}, at: __driver_attach #1: f1ffff80a6a40dc0 (&i3cbus->lock){++++}-{3:3}, at: i3c_master_register stack b
utex){....}-{3:3}, at: __driver_attach #1: f1ffff80a6a40dc0 (&i3cbus->lock){++++}-{3:3}, at: i3c_master_register stack backtrace: CPU: 6 UID: 0 PID: 1 Comm: init Call trace: dump_backtrace+0xfc/0x17c show_stack+0x18/0x28 dump_stack_lvl+0x40/0xc0 dump_stack+0x18/0x24 print_deadlock_bug+0x388/0x390 __lock_acquire+0x18bc/0x32ec lock_acquire+0x134/0x2b0 down_read+0x50/0x19c i3c_bus_normaluse_lock+0x14/0x24 i3c_device_get_info+0x24/0x58 i3c_device_uevent+0x34/0xa4 dev_uevent+0x310/0x384 kobject_uevent_env+0x244/0x414 kobject_uevent+0x14/0x20 device_add+0x278/0x460 device_register+0x20/0x34 i3c_master_register_new_i3c_devs+0x78/0x154 i3c_master_register+0x6a0/0x6d4 mtk_i3c_master_probe+0x3b8/0x4d8
r+0x20/0x34 i3c_master_register_new_i3c_devs+0x78/0x154 i3c_master_register+0x6a0/0x6d4 mtk_i3c_master_probe+0x3b8/0x4d8 platform_probe+0xa0/0xe0 really_probe+0x114/0x454 __driver_probe_device+0xa0/0x15c driver_probe_device+0x3c/0x1ac __driver_attach+0xc4/0x1f0 bus_for_each_dev+0x104/0x160 driver_attach+0x24/0x34 bus_add_driver+0x14c/0x294 driver_register+0x68/0x104 __platform_driver_register+0x20/0x30 init_module+0x20/0xfe4 do_one_initcall+0x184/0x464 do_init_module+0x58/0x1ec load_module+0xefc/0x10c8 __arm64_sys_finit_module+0x238/0x33c invoke_syscall+0x58/0x10c el0_svc_common+0xa8/0xdc do_el0_svc+0x1c/0x28 el0_svc+0x50/0xac el0t_64_sync_handler+0x70/0xbc el0t_64_sync+0x1a8/0x1ac Additiona
ommon+0xa8/0xdc do_el0_svc+0x1c/0x28 el0_svc+0x50/0xac el0t_64_sync_handler+0x70/0xbc el0t_64_sync+0x1a8/0x1ac Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/9a2173660ee53d5699744f02e6ab7bf89fcd0b1a - https://git.kernel.org/stable/c/5ac1dd51aaa0ce8b5421d1137e857955a4b6f55e - https://git.kernel.org/stable/c/2d98fa2a50b8058de52ada168fa5dbabb574711b - https://git.kernel.org/stable/c/816187b1833908941286e71b0041059a4acd52ed - https://git.kernel.org/stable/c/ffe19e363c6f8b992ba835a361542568dea17409 - https://git.kernel.org/stable/c/1f51ae217d09c361ede900b94735a6d2df6c0344 - https://git.kernel.org/stable/c/6cf7b65f7029914dc
s://git.kernel.org/stable/c/1f51ae217d09c361ede900b94735a6d2df6c0344 - https://git.kernel.org/stable/c/6cf7b65f7029914dc0cd7db86fac9ee5159008c6
CVE ID: CVE-2024-43099 State: PUBLISHED Published: 2024-09-13T16:33:02.575Z Last Updated: 2024-09-13T17:43:05.159Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: AutomationDirect Products: DirectLogic H2-DM1E Problem Types: CWE-294 Description: The session hijacking attack targets the application layer's control mechanism, which manages authenticated sessions between a host PC and a PLC. During such sessions, a session key is utilized to maintain security. However, if an attacker captures this session key, they can inject traffic into an ongoing authenticated session. To successfully achieve this, the attacker also needs to spoof both the IP address and MAC a
oing authenticated session. To successfully achieve this, the attacker also needs to spoof both the IP address and MAC address of the originating host which is typical of a session-based attack. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-24-256-17
CVE ID: CVE-2024-43101 State: PUBLISHED Published: 2025-05-13T21:03:07.610Z Last Updated: 2025-05-14T13:33:37.608Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:H) Vendors: n/a Products: Intel(R) Data Center GPU Flex Series for Windows driver software Problem Types: Denial of Service, CWE-284 Description: Improper access control for some Intel(R) Data Center GPU Flex Series for Windows driver software before version 31.0.101.4255 may allow an authenticated user to potentially enable denial of service via local access. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01253.html
CVE ID: CVE-2024-43102 State: PUBLISHED Published: 2024-09-05T04:54:52.452Z Last Updated: 2024-09-16T21:02:44.154Z Vendors: FreeBSD Products: FreeBSD Problem Types: CWE-416, CWE-911 Description: Concurrent removals of certain anonymous shared memory mappings by using the UMTX_SHM_DESTROY sub-request of UMTX_OP_SHM can lead to decreasing the reference count of the object representing the mapping too many times, causing it to be freed too early. A malicious code exercizing the UMTX_SHM_DESTROY sub-request in parallel can panic the kernel or enable further Use-After-Free attacks, potentially including code execution or Capsicum sandbox escape. Additional Analyst Notes: - CISA ADP Vulnrichment:
ks, potentially including code execution or Capsicum sandbox escape. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://security.freebsd.org/advisories/FreeBSD-SA-24:14.umtx.asc
CVE ID: CVE-2024-43105 State: PUBLISHED Published: 2024-08-23T07:25:00.371Z Last Updated: 2024-08-23T16:47:53.315Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: Mattermost Products: Mattermost Problem Types: CWE-400 Description: Mattermost Plugin Channel Export versions <=1.0.0 fail to restrict concurrent runs of the /export command which allows a user to consume excessive resource by running the /export command multiple times at once. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://mattermost.com/security-updates
CVE ID: CVE-2024-43106 State: PUBLISHED Published: 2024-12-18T22:41:11.189Z Last Updated: 2024-12-19T16:43:40.631Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) Vendors: Microsoft Products: Excel Problem Types: CWE-347 Description: A library injection vulnerability exists in Microsoft Excel 16.83 for macOS. A specially crafted library can leverage Excel's access privileges, leading to a permission bypass. A malicious application could inject a library and start the program to trigger this vulnerability and then make use of the vulnerable application's permissions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosi
's permissions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2024-1976
CVE ID: CVE-2024-43107 State: PUBLISHED Published: 2025-03-10T02:44:03.188Z Last Updated: 2025-03-10T17:16:47.074Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:L) Vendors: Gallagher Products: Milestone Integration Plugin Problem Types: CWE-295 Description: Improper Certificate Validation (CWE-295) in the Gallagher Milestone Integration Plugin (MIP) permits unauthenticated messages (e.g. alarm events) to be sent to the Plugin. This issue effects Gallagher MIPS Plugin v4.0 prior to v4.0.32, all versions of v3.0 and prior. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://security.gallagher.com/en-NZ/Security-Advisories/CVE-2024-43107
CVE ID: CVE-2024-43108 State: PUBLISHED Published: 2024-09-26T17:28:10.341Z Last Updated: 2024-10-17T16:53:16.231Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N) Vendors: goTenna Products: Pro ATAK Plugin Problem Types: CWE-353 Description: The goTenna Pro ATAK Plugin uses AES CTR type encryption for short, encrypted messages without any additional integrity checking mechanisms. This leaves messages malleable to an attacker that can access the message. It is advised to continue to use encryption in the plugin and update to the current release for enhanced encryption protocols. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news
nhanced encryption protocols. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-24-270-05
CVE ID: CVE-2024-43110 State: PUBLISHED Published: 2024-09-05T04:31:19.166Z Last Updated: 2025-11-04T16:13:45.604Z Vendors: FreeBSD Products: FreeBSD Problem Types: CWE-125 Description: The ctl_request_sense function could expose up to three bytes of the kernel heap to userspace. Malicious software running in a guest VM that exposes virtio_scsi can exploit the vulnerabilities to achieve code execution on the host in the bhyve userspace process, which typically runs as root. Note that bhyve runs in a Capsicum sandbox, so malicious code is constrained by the capabilities available to the bhyve process. A malicious iSCSI initiator could achieve remote code execution on the iSCSI target host. Ad
lable to the bhyve process. A malicious iSCSI initiator could achieve remote code execution on the iSCSI target host. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://security.freebsd.org/advisories/FreeBSD-SA-24:11.ctl.asc
CVE ID: CVE-2024-43111 State: PUBLISHED Published: 2024-08-06T15:55:14.910Z Last Updated: 2024-08-07T14:35:04.587Z Vendors: Mozilla Products: Firefox for iOS Problem Types: iOS Firefox allows to run javascript with download Description: Long pressing on a download link could potentially allow Javascript commands to be executed within the browser This vulnerability affects Firefox for iOS < 129. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1874907 - https://www.mozilla.org/security/advisories/mfsa2024-36/
CVE ID: CVE-2024-43112 State: PUBLISHED Published: 2024-08-06T15:55:13.378Z Last Updated: 2025-03-17T20:03:56.155Z Vendors: Mozilla Products: Firefox for iOS Problem Types: iOS Firefox Download UXSS Description: Long pressing on a download link could potentially provide a means for cross-site scripting This vulnerability affects Firefox for iOS < 129. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1874910 - https://www.mozilla.org/security/advisories/mfsa2024-36/
CVE ID: CVE-2024-43113 State: PUBLISHED Published: 2024-08-06T15:55:13.829Z Last Updated: 2025-03-24T16:25:58.379Z Vendors: Mozilla Products: Firefox for iOS Problem Types: The Context Menu for iOS Firefox can over ride on any origin allowing UXSS everywhere with bug id 1874910 Description: The contextual menu for links could provide an opportunity for cross-site scripting attacks This vulnerability affects Firefox for iOS < 129. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1874964 - https://www.mozilla.org/security/advisories/mfsa2024-36/
CVE ID: CVE-2024-43114 State: PUBLISHED Published: 2024-08-06T12:48:25.886Z Last Updated: 2024-08-06T13:16:50.111Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N) Vendors: JetBrains Products: TeamCity Problem Types: CWE-276 Description: In JetBrains TeamCity before 2024.07.1 possible privilege escalation due to incorrect directory permissions Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.jetbrains.com/privacy-security/issues-fixed/
CVE ID: CVE-2024-43115 State: PUBLISHED Published: 2025-09-03T08:38:32.442Z Last Updated: 2025-11-04T21:08:47.334Z Vendors: Apache Software Foundation Products: Apache DolphinScheduler Problem Types: CWE-20 Description: Improper Input Validation vulnerability in Apache DolphinScheduler. An authenticated user can execute any shell script server by alert script. This issue affects Apache DolphinScheduler: before 3.2.2. Users are recommended to upgrade to version 3.3.1, which fixes the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://lists.apache.org/thread/qm36nrsv1vrr2j4o5q2wo75h3686hrnj
CVE ID: CVE-2024-43116 State: PUBLISHED Published: 2024-08-26T20:52:51.206Z Last Updated: 2024-08-27T15:03:14.739Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: 10up Products: Simple Local Avatars Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in 10up Simple Local Avatars.This issue affects Simple Local Avatars: from n/a through 2.7.10. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/simple-local-avatars/wordpress-simple-local-avatars-plugin-2-7-10-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2024-43117 State: PUBLISHED Published: 2024-08-26T20:50:26.488Z Last Updated: 2024-08-27T13:48:36.124Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: WPMU DEV Products: Hummingbird Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in WPMU DEV Hummingbird.This issue affects Hummingbird: from n/a through 3.9.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/hummingbird-performance/wordpress-hummingbird-plugin-3-9-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2024-43118 State: PUBLISHED Published: 2024-11-01T14:17:50.491Z Last Updated: 2024-11-01T19:04:12.727Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: WPMU DEV Products: Hummingbird Problem Types: CWE-862 Description: Missing Authorization vulnerability in WPMU DEV Hummingbird allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Hummingbird: from n/a through 3.9.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/hummingbird-performance/wordpress-hummingbird-plugin-3-9-1-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2024-43119 State: PUBLISHED Published: 2024-11-01T14:17:49.773Z Last Updated: 2024-11-01T17:54:53.992Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: Aruba.it Products: Aruba HiSpeed Cache Problem Types: CWE-862 Description: Missing Authorization vulnerability in Aruba.It Aruba HiSpeed Cache allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Aruba HiSpeed Cache: from n/a through 2.0.12. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/aruba-hispeed-cache/wordpress-aruba-hispeed-cache-plugin-2-0-12-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2024-43120 State: PUBLISHED Published: 2024-11-01T14:17:49.104Z Last Updated: 2024-11-05T21:13:36.825Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: XSERVER Inc. Products: TypeSquare Webfonts Problem Types: CWE-862 Description: Missing Authorization vulnerability in XSERVER Inc. TypeSquare Webfonts allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects TypeSquare Webfonts: from n/a through 2.0.7. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/xserver-typesquare-webfonts/wordpress-typesquare-webfonts-plugin-2-0-7-broken-access-control-vulnerability?_s_id=
bility/xserver-typesquare-webfonts/wordpress-typesquare-webfonts-plugin-2-0-7-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2024-43121 State: PUBLISHED Published: 2024-08-13T10:50:48.047Z Last Updated: 2024-08-13T13:10:18.300Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: realmag777 Products: HUSKY Problem Types: CWE-269 Description: Improper Privilege Management vulnerability in realmag777 HUSKY allows Privilege Escalation.This issue affects HUSKY: from n/a through 1.3.6.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/woocommerce-products-filter/wordpress-husky-plugin-1-3-6-1-privilege-escalation-vulnerability?_s_id=cve
CVE ID: CVE-2024-43122 State: PUBLISHED Published: 2024-11-01T14:17:48.473Z Last Updated: 2024-11-01T17:54:33.805Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: Creative Motion Products: Robin image optimizer Problem Types: CWE-862 Description: Missing Authorization vulnerability in Creative Motion Robin image optimizer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Robin image optimizer: from n/a through 1.6.9. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/robin-image-optimizer/wordpress-robin-image-optimizer-plugin-1-6-9-broken-access-control-vuln
com/database/vulnerability/robin-image-optimizer/wordpress-robin-image-optimizer-plugin-1-6-9-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2024-43123 State: PUBLISHED Published: 2024-08-12T22:39:19.981Z Last Updated: 2024-08-14T14:55:11.967Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: Techeshta Products: Card Elements for Elementor Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Techeshta Card Elements for Elementor allows Stored XSS.This issue affects Card Elements for Elementor: from n/a through 1.2.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/card-elements-for-elementor/wordpress-card-elements-for-elementor-plugin
- https://patchstack.com/database/vulnerability/card-elements-for-elementor/wordpress-card-elements-for-elementor-plugin-1-2-2-cross-site-scripting-xss-vulnerability?_s_id=cve