Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-37548 State: PUBLISHED Published: 2024-07-21T07:01:29.659Z Last Updated: 2024-08-02T03:57:39.759Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: Meks Products: Meks Easy Ads Widget Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Meks Meks Easy Ads Widget allows Stored XSS.This issue affects Meks Easy Ads Widget: from n/a through 2.0.8. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/meks-easy-ads-widget/wordpress-meks-easy-ads-widget-plugin-2-0-8-cross-site-sc
s://patchstack.com/database/vulnerability/meks-easy-ads-widget/wordpress-meks-easy-ads-widget-plugin-2-0-8-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2024-37549 State: PUBLISHED Published: 2024-07-21T07:00:24.302Z Last Updated: 2024-08-02T03:57:39.724Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: Pdfcrowd Products: Save as PDF plugin by Pdfcrowd Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Pdfcrowd Save as PDF plugin by Pdfcrowd allows Stored XSS.This issue affects Save as PDF plugin by Pdfcrowd: from n/a through 4.0.0. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/save-as-pdf-by-pdfcrowd/wordpress-save-a
Program Container: References: - https://patchstack.com/database/vulnerability/save-as-pdf-by-pdfcrowd/wordpress-save-as-pdf-plugin-by-pdfcrowd-plugin-3-4-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2024-37550 State: PUBLISHED Published: 2024-07-21T06:57:24.779Z Last Updated: 2024-08-02T03:57:39.636Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: Envato Products: Template Kit – Export Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Envato Template Kit – Export allows Stored XSS.This issue affects Template Kit – Export: from n/a through 1.0.22. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/template-kit-export/wordpress-template-kit-export-plugin-1-0-21-cross-
: - https://patchstack.com/database/vulnerability/template-kit-export/wordpress-template-kit-export-plugin-1-0-21-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2024-37551 State: PUBLISHED Published: 2024-07-21T06:55:38.121Z Last Updated: 2024-08-02T03:57:39.681Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: Perials Products: Simple Social Share Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Perials Simple Social Share allows Stored XSS.This issue affects Simple Social Share: from n/a through 3.0. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/simple-social-share/wordpress-simple-social-share-plugin-3-0-cross-site-scrip
ps://patchstack.com/database/vulnerability/simple-social-share/wordpress-simple-social-share-plugin-3-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2024-37552 State: PUBLISHED Published: 2024-07-21T06:54:34.601Z Last Updated: 2024-08-02T03:57:39.700Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: Inisev Products: Social Media & Share Icons Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Inisev Social Media & Share Icons allows Stored XSS.This issue affects Social Media & Share Icons: from n/a through 2.9.1. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/ultimate-social-media-icons/wordpress-social-media-share
er: References: - https://patchstack.com/database/vulnerability/ultimate-social-media-icons/wordpress-social-media-share-buttons-social-sharing-icons-plugin-2-9-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2024-37553 State: PUBLISHED Published: 2024-07-06T16:03:32.989Z Last Updated: 2024-08-02T03:57:39.734Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: Axelerant Products: Testimonials Widget Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Axelerant Testimonials Widget allows Stored XSS.This issue affects Testimonials Widget: from n/a through 4.0.4. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/testimonials-widget/wordpress-testimonials-widget-plugin-4-0-4-cross-si
- https://patchstack.com/database/vulnerability/testimonials-widget/wordpress-testimonials-widget-plugin-4-0-4-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2024-37554 State: PUBLISHED Published: 2024-07-06T16:12:55.519Z Last Updated: 2024-08-02T03:57:39.686Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: CodeAstrology Team Products: UltraAddons Elementor Lite (Header & Footer Builder, Menu Builder, Cart Icon, Shortcode) Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in CodeAstrology Team UltraAddons Elementor Lite (Header & Footer Builder, Menu Builder, Cart Icon, Shortcode).This issue affects UltraAddons Elementor Lite (Header & Footer Builder, Menu Builder, Cart Icon, Shortcode): from n/a through 1.1.6.
fects UltraAddons Elementor Lite (Header & Footer Builder, Menu Builder, Cart Icon, Shortcode): from n/a through 1.1.6. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/ultraaddons-elementor-lite/wordpress-ultraaddons-elementor-addons-header-footer-builder-custom-font-custom-css-woo-widget-menu-builder-anywhere-elementor-shortcode-plugin-1-1-6-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2024-37555 State: PUBLISHED Published: 2024-07-09T07:21:53.199Z Last Updated: 2024-08-02T03:57:39.681Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: ZealousWeb Products: Generate PDF using Contact Form 7 Problem Types: CWE-434 Description: Unrestricted Upload of File with Dangerous Type vulnerability in ZealousWeb Generate PDF using Contact Form 7.This issue affects Generate PDF using Contact Form 7: from n/a through 4.0.6. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/generate-pdf-using-contact-form-7/wordpress-generate-pdf-using-contact-form-7-plugin-4
hstack.com/database/vulnerability/generate-pdf-using-contact-form-7/wordpress-generate-pdf-using-contact-form-7-plugin-4-0-6-arbitrary-file-upload-vulnerability?_s_id=cve
CVE ID: CVE-2024-37556 State: PUBLISHED Published: 2024-07-21T06:53:17.032Z Last Updated: 2024-08-02T03:57:39.770Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: SeedProd Products: WordPress Notification Bar Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in SeedProd WordPress Notification Bar allows Stored XSS.This issue affects WordPress Notification Bar: from n/a through 1.3.10. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/wordpress-notification-bar/wordpress-wordpress-noti
ntainer: References: - https://patchstack.com/database/vulnerability/wordpress-notification-bar/wordpress-wordpress-notification-bar-plugin-1-3-10-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2024-37557 State: PUBLISHED Published: 2024-07-21T06:52:17.834Z Last Updated: 2024-08-02T03:57:39.698Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: Soham Web Solution Products: WP Cookie Law Info Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Soham Web Solution WP Cookie Law Info allows Stored XSS.This issue affects WP Cookie Law Info: from n/a through 1.1. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/wp-cookie-law-info/wordpress-wp-cookie-law-info-plugin-1-1
: References: - https://patchstack.com/database/vulnerability/wp-cookie-law-info/wordpress-wp-cookie-law-info-plugin-1-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2024-37558 State: PUBLISHED Published: 2024-07-21T06:51:06.751Z Last Updated: 2024-08-02T03:57:39.707Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: Nazmul Hossain Nihal Products: WPFavicon Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Nazmul Hossain Nihal WPFavicon allows Stored XSS.This issue affects WPFavicon: from n/a through 2.1.1. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/wpfavicon/wordpress-wpfavicon-plugin-2-1-1-cross-site-scripting-xss-vulnerabili
://patchstack.com/database/vulnerability/wpfavicon/wordpress-wpfavicon-plugin-2-1-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2024-37559 State: PUBLISHED Published: 2024-07-21T06:48:53.508Z Last Updated: 2024-08-02T03:57:39.516Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: Echenley Products: Counterpoint Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Echenley Counterpoint allows Reflected XSS.This issue affects Counterpoint: from n/a through 1.8.1. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/counterpoint/wordpress-counterpoint-theme-1-8-1-reflected-cross-site-scripting-xss-vulnerabil
com/database/vulnerability/counterpoint/wordpress-counterpoint-theme-1-8-1-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2024-37560 State: PUBLISHED Published: 2024-07-12T13:56:46.362Z Last Updated: 2024-08-02T03:57:39.785Z Severity: HIGH (CVSS 8 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: IqbalRony Products: WP User Switch Problem Types: CWE-269 Description: Improper Privilege Management vulnerability in IqbalRony WP User Switch allows Privilege Escalation.This issue affects WP User Switch: from n/a through 1.1.0. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/wp-user-switch/wordpress-wp-user-switch-plugin-1-0-5-privilege-escalation-vulnerability?_s_id=cve
CVE ID: CVE-2024-37561 State: PUBLISHED Published: 2024-07-20T09:18:10.393Z Last Updated: 2024-08-02T03:57:40.023Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: Jamie Bergen Products: Plugin Notes Plus Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Jamie Bergen Plugin Notes Plus allows Stored XSS.This issue affects Plugin Notes Plus: from n/a through 1.2.6. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/plugin-notes-plus/wordpress-plugin-notes-plus-plugin-1-2-6-cross-site-s
- https://patchstack.com/database/vulnerability/plugin-notes-plus/wordpress-plugin-notes-plus-plugin-1-2-6-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2024-37562 State: PUBLISHED Published: 2024-07-20T09:15:39.923Z Last Updated: 2024-08-02T03:57:39.526Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: BracketSpace Products: Simple Post Notes Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in BracketSpace Simple Post Notes allows Stored XSS.This issue affects Simple Post Notes: from n/a through 1.7.7. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/simple-post-notes/wordpress-simple-post-notes-plugin-1-7-7-cross-site-s
- https://patchstack.com/database/vulnerability/simple-post-notes/wordpress-simple-post-notes-plugin-1-7-7-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2024-37563 State: PUBLISHED Published: 2024-07-20T09:04:33.202Z Last Updated: 2024-08-02T03:57:39.519Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L) Vendors: TOCHAT.BE Products: TOCHAT.BE Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in TOCHAT.BE allows Stored XSS.This issue affects TOCHAT.BE: from n/a through 1.3.0. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/tochat-be/wordpress-tochat-be-plugin-1-3-0-unauthenticated-stored-cross-site-scripting-xss-vulnerability?_s_id=
rability/tochat-be/wordpress-tochat-be-plugin-1-3-0-unauthenticated-stored-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2024-37564 State: PUBLISHED Published: 2024-07-12T13:24:30.423Z Last Updated: 2024-08-02T03:57:39.748Z Severity: HIGH (CVSS 8.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L) Vendors: PayPlus LTD Products: PayPlus Payment Gateway Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in PayPlus LTD PayPlus Payment Gateway.This issue affects PayPlus Payment Gateway: from n/a through 7.0.7. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/payplus-payment-gateway/wordpress-payplus-payment-gateway-plugin-7-0-7-sql-injecti
patchstack.com/database/vulnerability/payplus-payment-gateway/wordpress-payplus-payment-gateway-plugin-7-0-7-sql-injection-vulnerability?_s_id=cve
CVE ID: CVE-2024-37565 State: PUBLISHED Published: 2024-07-20T09:02:55.371Z Last Updated: 2024-08-02T03:57:39.619Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: TemeGUM Products: Gum Elementor Addon Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in TemeGUM Gum Elementor Addon allows Stored XSS.This issue affects Gum Elementor Addon: from n/a through 1.3.5. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/gum-elementor-addon/wordpress-gum-elementor-addon-plugin-1-3-5-cross-site-s
ttps://patchstack.com/database/vulnerability/gum-elementor-addon/wordpress-gum-elementor-addon-plugin-1-3-5-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2024-37566 State: PUBLISHED Published: 2025-02-27T00:00:00.000Z Last Updated: 2025-02-28T15:48:51.403Z Vendors: n/a Products: n/a Problem Types: n/a Description: Infoblox NIOS through 8.6.4 has Improper Authentication for Grids. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.infoblox.com/s/article/000010392
CVE ID: CVE-2024-37567 State: PUBLISHED Published: 2025-02-27T00:00:00.000Z Last Updated: 2025-02-28T15:50:11.160Z Vendors: n/a Products: n/a Problem Types: n/a Description: Infoblox NIOS through 8.6.4 has Improper Access Control for Grids. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.infoblox.com/s/article/000010393
CVE ID: CVE-2024-37568 State: PUBLISHED Published: 2024-06-09T00:00:00.000Z Last Updated: 2025-11-03T17:31:16.986Z Vendors: n/a Products: n/a Problem Types: n/a Description: lepture Authlib before 1.3.1 has algorithm confusion with asymmetric public keys. Unless an algorithm is specified in a jwt.decode call, HMAC verification is allowed with any asymmetric public key. (This is similar to CVE-2022-29217 and CVE-2024-33663.) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/lepture/authlib/issues/654 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IZI7HYGN7VZAYFV6UV3SRLYF7QGERXIU/ - h
fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IZI7HYGN7VZAYFV6UV3SRLYF7QGERXIU/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FHJI32SN4FNAUVNALVGOKWHNSQ6XS3M5/ - https://www.vicarius.io/vsociety/posts/algorithm-confusion-in-lepture-authlib-cve-2024-37568
CVE ID: CVE-2024-37569 State: PUBLISHED Published: 2024-06-09T00:00:00 Last Updated: 2024-08-02T03:57:39.561Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on Mitel 6869i through 4.5.0.41 and 5.x through 5.0.0.1018 devices. A command injection vulnerability exists in the hostname parameter taken in by the provis.html endpoint. The provis.html endpoint performs no sanitization on the hostname parameter (sent by an authenticated user), which is subsequently written to disk. During boot, the hostname parameter is executed as part of a series of shell commands. Attackers can achieve remote code execution in the root context by placing shell metacharacters in
s of shell commands. Attackers can achieve remote code execution in the root context by placing shell metacharacters in the hostname parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/kwburns/CVE/tree/main/Mitel/5.0.0.1018#authenticated-remote-command-execution-provis - https://github.com/kwburns/CVE/blob/main/Mitel/5.0.0.1018/code/exploit-provis.py - https://www.youtube.com/watch?v=I9TQqfP5qzM
CVE ID: CVE-2024-37570 State: PUBLISHED Published: 2024-06-09T00:00:00 Last Updated: 2024-10-25T18:47:40.022Z Vendors: n/a Products: n/a Problem Types: n/a Description: On Mitel 6869i 4.5.0.41 devices, the Manual Firmware Update (upgrade.html) page does not perform sanitization on the username and path parameters (sent by an authenticated user) before appending flags to the busybox ftpget command. This leads to $() command execution. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/kwburns/CVE/tree/main/Mitel/5.0.0.1018#authenticated-remote-command-execution-firmware - https://github.com/kwburns/CVE/blob/main/Mitel/5.0.0.1018/code/e
.1018#authenticated-remote-command-execution-firmware - https://github.com/kwburns/CVE/blob/main/Mitel/5.0.0.1018/code/exploit-firmware.py
CVE ID: CVE-2024-37571 State: PUBLISHED Published: 2024-06-26T00:00:00 Last Updated: 2024-11-05T14:45:57.420Z Vendors: n/a Products: n/a Problem Types: n/a Description: Buffer Overflow vulnerability in SAS Broker 9.2 build 1495 allows attackers to cause denial of service or obtain sensitive information via crafted payload to the '_debug' parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://gist.github.com/MILPDS/e9da6d07ba1789defacec08f2f03293d
CVE ID: CVE-2024-37573 State: PUBLISHED Published: 2024-10-30T00:00:00 Last Updated: 2024-10-31T14:51:56.835Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Talkatone com.talkatone.android application 8.4.6 for Android enables any installed application (with no permissions) to place phone calls without user interaction by sending a crafted intent via the com.talkatone.vedroid.ui.launcher.OutgoingCallInterceptor component. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/actuator/com.talkatone.android/blob/main/CVE-2024-37573
CVE ID: CVE-2024-37574 State: PUBLISHED Published: 2024-12-04T00:00:00 Last Updated: 2024-12-11T20:23:11.956Z Vendors: n/a Products: n/a Problem Types: n/a Description: The GriceMobile com.grice.call application 4.5.2 for Android enables any installed application (with no permissions) to place phone calls without user interaction by sending a crafted intent via the com.iui.mobile.presentation.MobileActivity. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://play.google.com/store/apps/details?id=com.grice.call - https://github.com/actuator/com.grice.call - https://github.com/actuator/com.grice.call/blob/main/CVE-2024-37574
CVE ID: CVE-2024-37575 State: PUBLISHED Published: 2024-12-04T00:00:00 Last Updated: 2024-12-11T15:58:53.219Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Mister org.mistergroup.shouldianswer application 1.4.264 for Android enables any installed application (with no permissions) to place phone calls without user interaction by sending a crafted intent via the org.mistergroup.shouldianswer.ui.default_dialer.DefaultDialerActivity component. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://play.google.com/store/apps/details?id=org.mistergroup.shouldianswer - https://github.com/actuator/org.mistergroup.shouldianswer - https://github.com/actuator/org.mist
ergroup.shouldianswer - https://github.com/actuator/org.mistergroup.shouldianswer - https://github.com/actuator/org.mistergroup.shouldianswer/blob/main/CVE-2024-37575
CVE ID: CVE-2024-37600 State: PUBLISHED Published: 2025-02-13T00:00:00.000Z Last Updated: 2025-02-18T14:06:45.658Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AC:L/AV:P/A:H/C:H/I:H/PR:N/S:U/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Mercedes Benz NTG (New Telematics Generation) 6 through 2021. A possible stack buffer overflow in the Service Broker service affects NTG 6 head units. To perform this attack, physical access to Ethernet pins of the head unit base board is needed. With a static IP address, an attacker can connect via the internal network to the Service Broker service. With prepared HTTP requests, an attacker can cause the Service-Broker ser
nternal network to the Service Broker service. With prepared HTTP requests, an attacker can cause the Service-Broker service to fail. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://securelist.com/mercedes-benz-head-unit-security-research/115218/
CVE ID: CVE-2024-37601 State: PUBLISHED Published: 2025-02-13T00:00:00.000Z Last Updated: 2025-02-18T14:07:50.678Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Mercedes Benz NTG (New Telematics Generation) 6. A possible heap buffer overflow exists in the user data import/export function of NTG 6 head units. To perform this attack, local access to the USB interface of the car is needed. With prepared data, an attacker can cause the User-Data service to fail. The failed service instance will restart automatically. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://securelist.com/mercedes-benz-head-unit-security-research/115218/
CVE ID: CVE-2024-37602 State: PUBLISHED Published: 2025-02-13T00:00:00.000Z Last Updated: 2025-02-14T16:27:59.742Z Severity: MEDIUM (CVSS 4.6 CVSS:3.1/AC:L/AV:P/A:H/C:N/I:N/PR:N/S:U/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Mercedes Benz NTG (New Telematics Generation) 6 through 2021. A possible NULL pointer dereference in the Apple Car Play function affects NTG 6 head units. To perform this attack, physical access to Ethernet pins of the head unit base board is needed. With a static IP address, an attacker can connect via the internal network to the AirTunes / AirPlay service. With prepared HTTP requests, an attacker can cause the Car Play s