Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
aq2=%5B%5B%5D%5D&c=1&af=%5B%5D&searchType=SIMPLE&sortOrder2=title_sort_asc&query=Exploiting+Vulnerabilities+to+Remotely+Hijack+Children%E2%80%99s+Smartwatches&language=en&pid=diva2%3A1933447&aq=%5B%5B%5D%5D&sf=undergraduate&aqe=%5B%5D&sortOrder=author_sort_asc&onlyFullText=false&noOfRows=50&dswid=-8296
CVE ID: CVE-2024-36555 State: PUBLISHED Published: 2025-02-06T00:00:00.000Z Last Updated: 2025-02-10T14:31:21.816Z Vendors: n/a Products: n/a Problem Types: n/a Description: Built-in SMS-configuration command in Forever KidsWatch Call Me KW50 R36_YDR_A3PW_GM7S_V1.0_2019_07_15_16.19.24_cob_h and Forever KidsWatch Call Me 2 KW-60 R36CW_YDE_S4_A29_2_V1.0_2023.05.24_22.49.44_cob_b allows malicious users to change the device IMEI-number which allows for forging the identity of the device. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.diva-portal.org/smash/record.jsf?aq2=%5B%5B%5D%5D&c=1&af=%5B%5D&searchType=SIMPLE&sortOrder2=title_sort_asc&query=Exploiting+Vulnerabi
g/smash/record.jsf?aq2=%5B%5B%5D%5D&c=1&af=%5B%5D&searchType=SIMPLE&sortOrder2=title_sort_asc&query=Exploiting+Vulnerabilities+to+Remotely+Hijack+Children%E2%80%99s+Smartwatches&language=en&pid=diva2%3A1933447&aq=%5B%5B%5D%5D&sf=undergraduate&aqe=%5B%5D&sortOrder=author_sort_asc&onlyFullText=false&noOfRows=50&dswid=-8296
CVE ID: CVE-2024-36556 State: PUBLISHED Published: 2025-02-06T00:00:00.000Z Last Updated: 2025-02-10T15:46:02.022Z Vendors: n/a Products: n/a Problem Types: n/a Description: Forever KidsWatch Call Me KW50 R36_YDR_A3PW_GM7S_V1.0_2019_07_15_16.19.24_cob_h, and Forever KidsWatch Call Me 2 KW60 R36CW_YDE_S4_A29_2_V1.0_2023.05.24_22.49.44_cob_b have a Hardcoded password vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.diva-portal.org/smash/record.jsf?aq2=%5B%5B%5D%5D&c=1&af=%5B%5D&searchType=SIMPLE&sortOrder2=title_sort_asc&query=Exploiting+Vulnerabilities+to+Remotely+Hijack+Children%E2%80%99s+Smartwatches&language=en&pid=diva2%3A1933447&aq=%5B%5B%5D%5D&
ting+Vulnerabilities+to+Remotely+Hijack+Children%E2%80%99s+Smartwatches&language=en&pid=diva2%3A1933447&aq=%5B%5B%5D%5D&sf=undergraduate&aqe=%5B%5D&sortOrder=author_sort_asc&onlyFullText=false&noOfRows=50&dswid=-8296
CVE ID: CVE-2024-36557 State: PUBLISHED Published: 2025-02-06T00:00:00.000Z Last Updated: 2025-02-10T14:22:56.247Z Vendors: n/a Products: n/a Problem Types: n/a Description: The device ID is based on IMEI in Forever KidsWatch Call Me KW50 R36_YDR_A3PW_GM7S_V1.0_2019_07_15_16.19.24_cob_h and Forever KidsWatch Call Me 2 KW60 R36CW_YDE_S4_A29_2_V1.0_2023.05.24_22.49.44_cob_b. If a malicious user changes the IMEI to the IMEI of a unit they registered in the mobile app, it is possible to hijack the device and control it from the app. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.diva-portal.org/smash/record.jsf?aq2=%5B%5B%5D%5D&c=1&af=%5B%5D&searchType=SIMPLE&sortOr
ment: References: - https://www.diva-portal.org/smash/record.jsf?aq2=%5B%5B%5D%5D&c=1&af=%5B%5D&searchType=SIMPLE&sortOrder2=title_sort_asc&query=Exploiting+Vulnerabilities+to+Remotely+Hijack+Children%E2%80%99s+Smartwatches&language=en&pid=diva2%3A1933447&aq=%5B%5B%5D%5D&sf=undergraduate&aqe=%5B%5D&sortOrder=author_sort_asc&onlyFullText=false&noOfRows=50&dswid=-8296
CVE ID: CVE-2024-36558 State: PUBLISHED Published: 2025-02-06T00:00:00.000Z Last Updated: 2025-03-19T14:29:03.055Z Vendors: n/a Products: n/a Problem Types: n/a Description: Forever KidsWatch Call Me KW-50 R36_YDR_A3PW_GM7S_V1.0_2019_07_15_16.19.24_cob_h suffers from Cleartext Transmission of Sensitive Information due to lack of encryption in device-server communication. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.diva-portal.org/smash/record.jsf?aq2=%5B%5B%5D%5D&c=1&af=%5B%5D&searchType=SIMPLE&sortOrder2=title_sort_asc&query=Exploiting+Vulnerabilities+to+Remotely+Hijack+Children%E2%80%99s+Smartwatches&language=en&pid=diva2%3A1933447&aq=%5B%5B%5D%5D&sf=underg
erabilities+to+Remotely+Hijack+Children%E2%80%99s+Smartwatches&language=en&pid=diva2%3A1933447&aq=%5B%5B%5D%5D&sf=undergraduate&aqe=%5B%5D&sortOrder=author_sort_asc&onlyFullText=false&noOfRows=50&dswid=-8296
CVE ID: CVE-2024-36568 State: PUBLISHED Published: 2024-06-03T13:25:36.809Z Last Updated: 2025-02-13T15:59:24.084Z Vendors: n/a Products: n/a Problem Types: n/a Description: Sourcecodester Gas Agency Management System v1.0 is vulnerable to SQL Injection via /gasmark/editbrand.php?id=. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/debug601/bug_report/blob/main/vendors/mayuri_k/gas-agency-management-system/SQL-1.md
CVE ID: CVE-2024-36569 State: PUBLISHED Published: 2024-06-03T13:28:13.564Z Last Updated: 2025-02-13T15:59:24.663Z Vendors: n/a Products: n/a Problem Types: n/a Description: Sourcecodester Gas Agency Management System v1.0 is vulnerable to arbitrary code execution via editClientImage.php. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/debug601/bug_report/blob/main/vendors/mayuri_k/gas-agency-management-system/RCE-1.md
CVE ID: CVE-2024-36572 State: PUBLISHED Published: 2024-07-30T00:00:00 Last Updated: 2024-08-02T03:37:05.287Z Vendors: n/a Products: n/a Problem Types: n/a Description: Prototype pollution in allpro form-manager 0.7.4 allows attackers to run arbitrary code and cause other impacts via the functions setDefaults, mergeBranch, and Object.setObjectValue. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://gist.github.com/mestrtee/1771ab4fba733ca898b6e2463dc6ed19 - https://github.com/allpro/form-manager/issues/1
CVE ID: CVE-2024-36573 State: PUBLISHED Published: 2024-06-17T00:00:00 Last Updated: 2024-08-02T03:37:05.359Z Vendors: n/a Products: n/a Problem Types: n/a Description: almela obx before v.0.0.4 has a Prototype Pollution issue which allows arbitrary code execution via the obx/build/index.js:656), reduce (@almela/obx/build/index.js:470), Object.set (obx/build/index.js:269) component. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://gist.github.com/mestrtee/fd8181bbc180d775f8367a2b9e0ffcd1
CVE ID: CVE-2024-36574 State: PUBLISHED Published: 2024-06-17T00:00:00 Last Updated: 2024-08-02T03:37:05.449Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Prototype Pollution issue in flatten-json 1.0.1 allows an attacker to execute arbitrary code via module.exports.unflattenJSON (flatten-json/index.js:42) Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://gist.github.com/mestrtee/d5a0c93459599f77557b5bbe78b57325
CVE ID: CVE-2024-36575 State: PUBLISHED Published: 2024-06-17T00:00:00 Last Updated: 2024-08-02T03:37:05.330Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Prototype Pollution issue in getsetprop 1.1.0 allows an attacker to execute arbitrary code via global.accessor. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://gist.github.com/mestrtee/0d830798f20839d634278d7af0155f9e
CVE ID: CVE-2024-36577 State: PUBLISHED Published: 2024-06-17T00:00:00 Last Updated: 2024-08-02T03:37:05.426Z Vendors: n/a Products: n/a Problem Types: n/a Description: apphp js-object-resolver < 3.1.1 is vulnerable to Prototype Pollution via Module.setNestedProperty. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://gist.github.com/mestrtee/c90189f3d8480a5f267395ec40701373
CVE ID: CVE-2024-36578 State: PUBLISHED Published: 2024-06-17T00:00:00 Last Updated: 2024-08-02T03:37:05.324Z Vendors: n/a Products: n/a Problem Types: n/a Description: akbr update 1.0.0 is vulnerable to Prototype Pollution via update/index.js. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://gist.github.com/mestrtee/8bc749ec2b5453d887b2f4a362a65897
CVE ID: CVE-2024-36580 State: PUBLISHED Published: 2024-06-17T00:00:00 Last Updated: 2024-08-22T19:01:29.773Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Prototype Pollution issue in cdr0 sg 1.0.10 allows an attacker to execute arbitrary code. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gist.github.com/mestrtee/a75d75eca4622ad08f7cfa903a6cc9c3
CVE ID: CVE-2024-36581 State: PUBLISHED Published: 2024-06-17T00:00:00 Last Updated: 2024-08-02T03:37:05.309Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Prototype Pollution issue in abw badger-database 1.2.1 allows an attacker to execute arbitrary code via dist/badger-database.esm. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://gist.github.com/mestrtee/f6b2ed1b3b4bc0df994c7455fc6110bd
CVE ID: CVE-2024-36582 State: PUBLISHED Published: 2024-06-17T00:00:00 Last Updated: 2024-08-19T16:55:23.837Z Vendors: n/a Products: n/a Problem Types: n/a Description: alexbinary object-deep-assign 1.0.11 is vulnerable to Prototype Pollution via the extend() method of Module.deepAssign (/src/index.js) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gist.github.com/mestrtee/9fe4d3a862c62ce6b2b0d20d4c5fd346
CVE ID: CVE-2024-36583 State: PUBLISHED Published: 2024-06-17T00:00:00 Last Updated: 2024-08-02T03:37:05.328Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Prototype Pollution issue in byondreal accessor <= 1.0.0 allows an attacker to execute arbitrary code via @byondreal/accessor/index. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://gist.github.com/mestrtee/97bc2fbfbcbde3a54d5536c9adeee34c
CVE ID: CVE-2024-36586 State: PUBLISHED Published: 2024-06-13T00:00:00 Last Updated: 2024-08-02T03:37:05.326Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in AdGuardHome v0.93 to latest allows unprivileged attackers to escalate privileges via overwriting the AdGuardHome binary. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/go-compile/security-advisories/blob/master/vulns/CVE-2024-36586.md
CVE ID: CVE-2024-36587 State: PUBLISHED Published: 2024-06-13T00:00:00 Last Updated: 2024-08-02T03:37:05.333Z Vendors: n/a Products: n/a Problem Types: n/a Description: Insecure permissions in DNSCrypt-proxy v2.0.0alpha9 to v2.1.5 allows non-privileged attackers to escalate privileges to root via overwriting the binary dnscrypt-proxy. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/go-compile/security-advisories/blob/master/vulns/CVE-2024-36587.md
CVE ID: CVE-2024-36588 State: PUBLISHED Published: 2024-06-13T00:00:00 Last Updated: 2024-11-21T19:38:56.166Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in Annonshop.app DecentralizeJustice/ anonymousLocker commit 2b2b4 allows attackers to send messages erroneously attributed to arbitrary users via a crafted HTTP request. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/go-compile/security-advisories/blob/master/vulns/CVE-2024-36588.md
CVE ID: CVE-2024-36589 State: PUBLISHED Published: 2024-06-13T00:00:00 Last Updated: 2024-11-25T21:23:37.214Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in Annonshop.app DecentralizeJustice/anonymousLocker commit 2b2b4 to ba9fd and DecentralizeJustice/anonBackend commit 57837 to cd815 was discovered to store credentials in plaintext. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/go-compile/security-advisories/blob/master/vulns/CVE-2024-36589.md
CVE ID: CVE-2024-36597 State: PUBLISHED Published: 2024-06-14T00:00:00.000Z Last Updated: 2025-03-13T19:42:00.871Z Vendors: n/a Products: n/a Problem Types: n/a Description: Aegon Life v1.0 was discovered to contain a SQL injection vulnerability via the client_id parameter at clientStatus.php. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/kaliankhe/CVE-Aslam-mahi/blob/9ec0572c68bfd3708a7d6e089181024131f4e927/vendors/projectworlds.in/AEGON%20LIFE%20v1.0%20Life%20Insurance%20Management%20System/CVE-2024-36597
CVE ID: CVE-2024-36598 State: PUBLISHED Published: 2024-06-14T00:00:00 Last Updated: 2024-08-02T03:37:05.331Z Vendors: n/a Products: n/a Problem Types: n/a Description: An arbitrary file upload vulnerability in Aegon Life v1.0 allows attackers to execute arbitrary code via uploading a crafted image file. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/kaliankhe/CVE-Aslam-mahi/blob/9ec0572c68bfd3708a7d6e089181024131f4e927/vendors/projectworlds.in/AEGON%20LIFE%20v1.0%20Life%20Insurance%20Management%20System/CVE-2024-36598
CVE ID: CVE-2024-36599 State: PUBLISHED Published: 2024-06-14T00:00:00.000Z Last Updated: 2025-03-13T14:51:25.024Z Vendors: n/a Products: n/a Problem Types: n/a Description: A cross-site scripting (XSS) vulnerability in Aegon Life v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the name parameter at insertClient.php. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/kaliankhe/CVE-Aslam-mahi/blob/9ec0572c68bfd3708a7d6e089181024131f4e927/vendors/projectworlds.in/AEGON%20LIFE%20v1.0%20Life%20Insurance%20Management%20System/CVE-2024-36599
CVE ID: CVE-2024-36600 State: PUBLISHED Published: 2024-06-14T00:00:00 Last Updated: 2024-08-02T03:37:05.356Z Vendors: n/a Products: n/a Problem Types: n/a Description: Buffer Overflow Vulnerability in libcdio v2.1.0 allows an attacker to execute arbitrary code via a crafted ISO 9660 image file. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/gashasbi/My-Reports/tree/main/CVE-2024-36600
CVE ID: CVE-2024-36604 State: PUBLISHED Published: 2024-06-04T17:14:08.675Z Last Updated: 2025-02-13T15:59:25.200Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda O3V2 v1.0.0.12(3880) was discovered to contain a Blind Command Injection via stpEn parameter in the SetStp function. This vulnerability allows attackers to execute arbitrary commands with root privileges. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://exzettabyte.me/blind-command-injection-in-stp-service-on-tenda-o3v2/
CVE ID: CVE-2024-36610 State: REJECTED Published: 2024-11-29T00:00:00 Last Updated: 2024-12-24T21:13:42.813154Z Description: No description available.
CVE ID: CVE-2024-36611 State: PUBLISHED Published: 2024-11-29T00:00:00 Last Updated: 2025-01-06T17:44:44.438Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Symfony v7.07, a security vulnerability was identified in the FormLoginAuthenticator component, where it failed to adequately handle cases where the username or password field of a login request is empty. This flaw could lead to various security risks, including improper authentication logic handling or denial of service. NOTE: the Supplier has concluded that this is a false report. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/symfony/symfony/commit/a804ca15fcad279d7727b91d12a667fd5b9
es: - CISA ADP Vulnrichment: References: - https://github.com/symfony/symfony/commit/a804ca15fcad279d7727b91d12a667fd5b925995 - https://github.com/symfony/symfony/blob/v7.0.7/src/Symfony/Component/Security/Http/Authenticator/FormLoginAuthenticator.php#L132 - https://gist.github.com/1047524396/3581425e0911b716cf8ce4fa30e41e6c - https://github.com/github/advisory-database/pull/5046 - https://github.com/symfony/symfony/issues/59077#issuecomment-2513935018
CVE ID: CVE-2024-36612 State: PUBLISHED Published: 2024-11-29T00:00:00 Last Updated: 2024-12-02T16:35:49.772Z Vendors: n/a Products: n/a Problem Types: n/a Description: Zulip from 8.0 to 8.3 contains a memory leak vulnerability in the handling of popovers. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/zulip/zulip/commit/0a90a13becbf0338a8fc1ad37946e51c2c25b0a5 - https://github.com/zulip/zulip/blob/8.3/web/src/click_handlers.js - https://gist.github.com/1047524396/f7ff51d24ebbb29e21dfb70a0c97302b
CVE ID: CVE-2024-36613 State: PUBLISHED Published: 2025-01-03T00:00:00 Last Updated: 2025-01-03T20:46:39.235Z Vendors: n/a Products: n/a Problem Types: n/a Description: FFmpeg n6.1.1 has a vulnerability in the DXA demuxer of the libavformat library allowing for an integer overflow, potentially resulting in a denial-of-service (DoS) condition or other undefined behavior. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/ffmpeg/ffmpeg/commit/50d8e4f27398fd5778485a827d7a2817921f8540 - https://github.com/FFmpeg/FFmpeg/blob/n6.1.1/libavformat/dxa.c#L125 - https://gist.github.com/1047524396/0f4d90ef87553f772f888223085ac806
CVE ID: CVE-2024-36615 State: PUBLISHED Published: 2024-11-29T00:00:00 Last Updated: 2024-12-03T15:24:20.233Z Vendors: n/a Products: n/a Problem Types: n/a Description: FFmpeg n7.0 has a race condition vulnerability in the VP9 decoder. This could lead to a data race if video encoding parameters were being exported, as the side data would be attached in the decoder thread while being read in the output thread. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/ffmpeg/ffmpeg/commit/0ba058579f332b3060d8470a04ddd3fbf305be61 - https://github.com/FFmpeg/FFmpeg/blob/n7.0/libavcodec/vp9.c#L1738 - https://gist.github.com/1047524396/c44e5eaafa8f408eea0c9411205990fb
CVE ID: CVE-2024-36616 State: PUBLISHED Published: 2024-11-29T00:00:00 Last Updated: 2024-12-02T17:41:37.389Z Vendors: n/a Products: n/a Problem Types: n/a Description: An integer overflow in the component /libavformat/westwood_vqa.c of FFmpeg n6.1.1 allows attackers to cause a denial of service in the application via a crafted VQA file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/ffmpeg/ffmpeg/commit/86f73277bf014e2ce36dd2594f1e0fb8b3bd6661 - https://github.com/FFmpeg/FFmpeg/blob/n6.1.1/libavformat/westwood_vqa.c#L265 - https://gist.github.com/1047524396/ded3e1509d8296ec4a91817867d108e0
CVE ID: CVE-2024-36617 State: PUBLISHED Published: 2024-11-29T00:00:00 Last Updated: 2024-12-02T17:57:09.775Z Vendors: n/a Products: n/a Problem Types: n/a Description: FFmpeg n6.1.1 has an integer overflow vulnerability in the FFmpeg CAF decoder. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/ffmpeg/ffmpeg/commit/d973fcbcc2f944752ff10e6a76b0b2d9329937a7 - https://github.com/FFmpeg/FFmpeg/blob/n6.1.1/libavformat/cafdec.c#L274 - https://gist.github.com/1047524396/f20749f8addc8f86de9cfacf17ba29df
CVE ID: CVE-2024-36618 State: PUBLISHED Published: 2024-11-29T00:00:00.000Z Last Updated: 2025-11-03T20:37:49.706Z Vendors: n/a Products: n/a Problem Types: n/a Description: FFmpeg n6.1.1 has a vulnerability in the AVI demuxer of the libavformat library which allows for an integer overflow, potentially resulting in a denial-of-service (DoS) condition. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/ffmpeg/ffmpeg/commit/7a089ed8e049e3bfcb22de1250b86f2106060857 - https://github.com/FFmpeg/FFmpeg/blob/n6.1.1/libavformat/avidec.c#L1699 - https://gist.github.com/1047524396/a148f3679415a6da53ca112eb2ba1523
CVE ID: CVE-2024-36619 State: PUBLISHED Published: 2024-11-29T00:00:00 Last Updated: 2024-11-29T18:06:36.151Z Vendors: n/a Products: n/a Problem Types: n/a Description: FFmpeg n6.1.1 has a vulnerability in the WAVARC decoder of the libavcodec library which allows for an integer overflow when handling certain block types, leading to a denial-of-service (DoS) condition. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/ffmpeg/ffmpeg/commit/28c7094b25b689185155a6833caf2747b94774a4 - https://github.com/FFmpeg/FFmpeg/blob/n6.1.1/libavcodec/wavarc.c#L651 - https://gist.github.com/1047524396/fad68e8251f4e34a1bb838de697d5119
CVE ID: CVE-2024-36620 State: PUBLISHED Published: 2024-11-29T00:00:00 Last Updated: 2024-12-04T17:14:27.602Z Vendors: n/a Products: n/a Problem Types: n/a Description: moby v25.0.0 - v26.0.2 is vulnerable to NULL Pointer Dereference via daemon/images/image_history.go. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/moby/moby/commit/ab570ab3d62038b3d26f96a9bb585d0b6095b9b4 - https://github.com/moby/moby/blob/v26.0.2/daemon/images/image_history.go#L48 - https://gist.github.com/1047524396/f08816669701ab478a265a811d2c89b2
CVE ID: CVE-2024-36621 State: PUBLISHED Published: 2024-11-29T00:00:00 Last Updated: 2024-12-04T17:13:36.018Z Vendors: n/a Products: n/a Problem Types: n/a Description: moby v25.0.5 is affected by a Race Condition in builder/builder-next/adapters/snapshot/layer.go. The vulnerability could be used to trigger concurrent builds that call the EnsureLayer function resulting in resource leaks/exhaustion. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/moby/moby/commit/37545cc644344dcb576cba67eb7b6f51a463d31e - https://github.com/moby/moby/blob/v25.0.5/builder/builder-next/adapters/snapshot/layer.go#L24 - https://gist.github.com/1047524396/5d44459edab5fafcdf86b43
v25.0.5/builder/builder-next/adapters/snapshot/layer.go#L24 - https://gist.github.com/1047524396/5d44459edab5fafcdf86b43909b81135
CVE ID: CVE-2024-36622 State: PUBLISHED Published: 2024-11-29T00:00:00 Last Updated: 2024-12-03T15:26:18.611Z Vendors: n/a Products: n/a Problem Types: n/a Description: In RaspAP raspap-webgui 3.0.9 and earlier, a command injection vulnerability exists in the clearlog.php script. The vulnerability is due to improper sanitization of user input passed via the logfile parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/raspap/raspap-webgui/commit/c98d2b0c15942b4829d31dec615b9b40cc6faa14#diff-939ee414d82245c3b3dd7d36b57f10706e06e8f0871b24bdcf9de6e0d181c4c9 - https://github.com/RaspAP/raspap-webgui/blob/3.0.9/ajax/logging/clearlog.php - https://gist.gith
b24bdcf9de6e0d181c4c9 - https://github.com/RaspAP/raspap-webgui/blob/3.0.9/ajax/logging/clearlog.php - https://gist.github.com/1047524396/ab997b902ec892e592a0df93f38e6941
CVE ID: CVE-2024-36623 State: PUBLISHED Published: 2024-11-29T00:00:00.000Z Last Updated: 2025-05-01T13:48:34.300Z Vendors: n/a Products: n/a Problem Types: n/a Description: moby through v25.0.3 has a Race Condition vulnerability in the streamformatter package which can be used to trigger multiple concurrent write operations resulting in data corruption or application crashes. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/moby/moby/commit/5689dabfb357b673abdb4391eef426f297d7d1bb - https://github.com/moby/moby/blob/v25.0.3/pkg/streamformatter/streamformatter.go#L115 - https://gist.github.com/1047524396/c192c0159a19bf58a4373b696467dc29 - https://github.com
atter/streamformatter.go#L115 - https://gist.github.com/1047524396/c192c0159a19bf58a4373b696467dc29 - https://github.com/moby/moby/commit/8e3bcf19748838b30e34d612832d1dc9d90363b8
CVE ID: CVE-2024-36624 State: PUBLISHED Published: 2024-11-29T00:00:00 Last Updated: 2024-11-29T18:17:17.138Z Vendors: n/a Products: n/a Problem Types: n/a Description: Zulip 8.3 is vulnerable to Cross Site Scripting (XSS) via the construct_copy_div function in copy_and_paste.js. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/zulip/zulip/commit/e1029b59ede0c4f314c367ffa1ba2904ffaf6768 - https://github.com/zulip/zulip/blob/8.3/web/src/copy_and_paste.js#L90 - https://gist.github.com/1047524396/64720d2aa5afd943eb7e5a1ed4808ad6