Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-48426 State: PUBLISHED Published: 2024-10-24T00:00:00 Last Updated: 2024-10-29T19:24:29.174Z Vendors: n/a Products: n/a Problem Types: n/a Description: A segmentation fault (SEGV) was detected in the SortByPTypeProcess::Execute function in the Assimp library during fuzz testing with AddressSanitizer. The crash occurred due to a read access to an invalid memory address (0x1000c9714971). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/assimp/assimp/issues/5789
CVE ID: CVE-2024-48427 State: PUBLISHED Published: 2024-10-24T00:00:00 Last Updated: 2024-10-28T19:44:55.469Z Vendors: n/a Products: n/a Problem Types: n/a Description: A SQL injection vulnerability in Sourcecodester Packers and Movers Management System v1.0 allows remote authenticated users to execute arbitrary SQL commands via the id parameter in /mpms/admin/?page=services/manage_service&id Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.sourcecodester.com/php/15360/packers-and-movers-management-system-phpoop-free-source-code.html - https://github.com/vighneshnair7/CVE-2024-48427/blob/main/README.md
CVE ID: CVE-2024-48428 State: PUBLISHED Published: 2024-10-25T00:00:00.000Z Last Updated: 2025-03-19T18:29:56.072Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in Olive VLE allows an attacker to obtain sensitive information via the reset password function. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://medium.com/h7w/full-account-takeover-via-password-reset-link-manipulation-840fb9402967 - https://medium.com/%40powerful-/account-takeover-ato-via-the-reset-password-cve-2024-48428-84892d6211d6 - https://www.linkedin.com/posts/said-al-ghammari-301972285_0day-bugbountytips-bugbountytip-activity-7227418100034412544-2ocu/ - https://www.olivevle.com/
CVE ID: CVE-2024-48440 State: PUBLISHED Published: 2024-10-24T00:00:00 Last Updated: 2024-10-25T19:48:25.060Z Vendors: n/a Products: n/a Problem Types: n/a Description: Shenzhen Tuoshi Network Communications Co.,Ltd 5G CPE Router NR500-EA RG500UEAABxCOMSLICv3.2.2543.12.18 was discovered to contain a command injection vulnerability via the component at_command.asp. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://medium.com/%40sengkyaut/unauthenticated-factory-mode-reset-and-at-command-injection-in-jboneos-or-jbonecloud-firmware-1dec156b7ddd
CVE ID: CVE-2024-48441 State: PUBLISHED Published: 2024-10-24T00:00:00 Last Updated: 2024-10-25T19:59:02.538Z Vendors: n/a Products: n/a Problem Types: n/a Description: Wuhan Tianyu Information Industry Co., Ltd Tianyu CPE Router CommonCPExCPETS_v3.2.468.11.04_P4 was discovered to contain a command injection vulnerability via the component at_command.asp. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://medium.com/%40sengkyaut/unauthenticated-factory-mode-reset-and-at-command-injection-in-jboneos-or-jbonecloud-firmware-1dec156b7ddd
CVE ID: CVE-2024-48442 State: PUBLISHED Published: 2024-10-24T00:00:00 Last Updated: 2024-10-25T19:44:02.828Z Vendors: n/a Products: n/a Problem Types: n/a Description: Incorrect access control in Shenzhen Tuoshi Network Communications Co.,Ltd 5G CPE Router NR500-EA RG500UEAABxCOMSLICv3.2.2543.12.18 allows attackers to access the SSH protocol without authentication. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://medium.com/%40sengkyaut/unauthenticated-factory-mode-reset-and-at-command-injection-in-jboneos-or-jbonecloud-firmware-1dec156b7ddd
CVE ID: CVE-2024-48445 State: PUBLISHED Published: 2025-02-04T00:00:00.000Z Last Updated: 2025-02-06T14:49:43.663Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in compop.ca ONLINE MALL v.3.5.3 allows a remote attacker to execute arbitrary code via the rid, tid, et, and ts parameters. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://packetstorm.news/files/id/188996/
CVE ID: CVE-2024-48448 State: PUBLISHED Published: 2024-10-25T00:00:00 Last Updated: 2024-10-29T20:44:56.363Z Vendors: n/a Products: n/a Problem Types: n/a Description: An arbitrary file upload vulnerability in Huly Platform v0.6.295 allows attackers to execute arbitrary code via uploading a crafted HTML file into the tracker comments page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/b-hermes/vulnerability-research/tree/main/CVE-2024-48448
CVE ID: CVE-2024-48450 State: PUBLISHED Published: 2024-10-25T00:00:00 Last Updated: 2024-10-29T20:44:24.066Z Vendors: n/a Products: n/a Problem Types: n/a Description: An arbitrary file upload vulnerability in Huly Platform v0.6.295 allows attackers to execute arbitrary code via uploading a crafted HTML file into chat group. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/b-hermes/vulnerability-research/tree/main/CVE-2024-48450
CVE ID: CVE-2024-48453 State: PUBLISHED Published: 2024-12-04T00:00:00 Last Updated: 2024-12-11T20:15:14.977Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in INOVANCE AM401_CPU1608TPTN allows a remote attacker to execute arbitrary code via the ExecuteUserProgramUpgrade function Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.inovance.com/ - https://github.com/N0zoM1z0/Vuln-Search/blob/main/INOVANCE%20AM401_CPU1608TPTN%20Unauthorized%20Arbitrary%20Code%20Execution%20Vulnerability.md - https://github.com/N0zoM1z0/CVEs/blob/main/CVE-2024-48453.md
CVE ID: CVE-2024-48454 State: PUBLISHED Published: 2024-10-24T00:00:00 Last Updated: 2024-10-24T20:44:59.608Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in SourceCodester Purchase Order Management System v1.0 allows a remote attacker to execute arbitrary code via the /admin?page=user component Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.sourcecodester.com/ - https://www.sourcecodester.com/php/14935/purchase-order-management-system-using-php-free-source-code.html - https://github.com/N0zoM1z0/CVEs/blob/main/CVE-2024-48454.md
CVE ID: CVE-2024-48455 State: PUBLISHED Published: 2025-01-06T00:00:00 Last Updated: 2025-01-07T21:51:54.193Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in Netis Wifi6 Router NX10 2.0.1.3643 and 2.0.1.3582 and Netis Wifi 11AC Router NC65 3.0.0.3749 and Netis Wifi 11AC Router NC63 3.0.0.3327 and 3.0.0.3503 and Netis Wifi 11AC Router NC21 3.0.0.3800, 3.0.0.3500 and 3.0.0.3329 and Netis Wifi Router MW5360 1.0.1.3442 and 1.0.1.3031 allows a remote attacker to obtain sensitive information via the mode_name, wl_link parameters of the skk_get.cgi component. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/users/h00die-gr3y/projects/1/views
. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/users/h00die-gr3y/projects/1/views/1
CVE ID: CVE-2024-48456 State: PUBLISHED Published: 2025-01-06T00:00:00 Last Updated: 2025-01-07T15:25:13.725Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in Netis Wifi6 Router NX10 2.0.1.3643 and 2.0.1.3582 and Netis Wifi 11AC Router NC65 3.0.0.3749 and Netis Wifi 11AC Router NC63 3.0.0.3327 and 3.0.0.3503 and Netis Wifi 11AC Router NC21 3.0.0.3800, 3.0.0.3500 and 3.0.0.3329 and Netis Wifi Router MW5360 1.0.1.3442 and 1.0.1.3031 allows a remote attacker to obtain sensitive information via the parameter password at the change admin password page at the router web interface. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/users/h00die
e router web interface. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/users/h00die-gr3y/projects/1/views/1
CVE ID: CVE-2024-48457 State: PUBLISHED Published: 2025-01-06T00:00:00 Last Updated: 2025-01-07T15:26:01.178Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in Netis Wifi6 Router NX10 2.0.1.3643 and 2.0.1.3582 and Netis Wifi 11AC Router NC65 3.0.0.3749 and Netis Wifi 11AC Router NC63 3.0.0.3327 and 3.0.0.3503 and Netis Wifi 11AC Router NC21 3.0.0.3800, 3.0.0.3500 and 3.0.0.3329 and Netis Wifi Router MW5360 1.0.1.3442 and 1.0.1.3031 allows a remote attacker to obtain sensitive information via the endpoint /cgi-bin/skk_set.cgi and binary /bin/scripts/start_wifi.sh Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/users/h00die-gr3y/projects
t_wifi.sh Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/users/h00die-gr3y/projects/1/views/1
CVE ID: CVE-2024-48459 State: PUBLISHED Published: 2024-10-25T00:00:00 Last Updated: 2024-10-29T19:42:06.188Z Vendors: n/a Products: n/a Problem Types: n/a Description: A command execution vulnerability exists in the AX2 Pro home router produced by Shenzhen Tenda Technology Co., Ltd. (Jixiang Tenda) v.DI_7003G-19.12.24A1V16.03.29.50;V16.03.29.50;V16.03.29.50. An attacker can exploit this vulnerability by constructing a malicious payload to execute commands and further obtain shell access to the router's file system with the highest privileges. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gist.github.com/Swind1er/da24125da98f6616a50a35a3e60141f4
CVE ID: CVE-2024-48460 State: PUBLISHED Published: 2025-01-16T00:00:00.000Z Last Updated: 2025-02-03T20:13:41.729Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in Eugeny Tabby 1.0.213 allows a remote attacker to obtain sensitive information via the server and sends the SSH username and password even when the host key verification fails. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Eugeny/tabby/issues/9955
CVE ID: CVE-2024-48461 State: PUBLISHED Published: 2024-10-29T00:00:00 Last Updated: 2024-10-30T15:05:38.678Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting vulnerability in TeslaLogger Admin Panel before v.1.59.6 allows a remote attacker to execute arbitrary code via the New Journey field. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/bassmaster187/TeslaLogger/blob/65f5ff43c7cacf0391ddc21b90f77a2e8c8d860e/TeslaLogger/bin/changelog.md?plain=1#L4 - https://mohammedshine.github.io/CVE-2024-48461.html
CVE ID: CVE-2024-48463 State: PUBLISHED Published: 2024-11-04T00:00:00 Last Updated: 2025-01-16T06:03:24.086Z Vendors: n/a Products: n/a Problem Types: n/a Description: Bruno before 1.29.1 uses Electron shell.openExternal without validation (of http or https) for opening windows within the Markdown docs viewer. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://gist.github.com/opcod3r/ab69f36d52367df7ffac32a597dff31c - https://github.com/usebruno/bruno/releases/tag/v1.29.1 - https://www.usebruno.com/changelog - https://github.com/usebruno/bruno/pull/3122
CVE ID: CVE-2024-48465 State: PUBLISHED Published: 2024-10-28T00:00:00 Last Updated: 2024-10-30T17:41:01.573Z Vendors: n/a Products: n/a Problem Types: n/a Description: The MRBS version 1.5.0 has an SQL injection vulnerability in the edit_entry_handler.php file, specifically in the rooms%5B%5D parameter Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://mrbs.sourceforge.io/ - https://github.com/4459gif/zo/blob/main/index.html
CVE ID: CVE-2024-48509 State: PUBLISHED Published: 2024-10-21T00:00:00 Last Updated: 2024-10-21T19:48:20.097Z Vendors: n/a Products: n/a Problem Types: n/a Description: Learning with Texts (LWT) 2.0.3 is vulnerable to SQL Injection. This occurs when the application fails to properly sanitize user inputs, allowing attackers to manipulate SQL queries by injecting malicious SQL statements into URL parameters. By exploiting this vulnerability, an attacker could gain unauthorized access to the database, retrieve sensitive information, modify or delete data, and execute arbitrary commands. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://medium.com/%40ChadSecurity/the-cve-2
commands. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://medium.com/%40ChadSecurity/the-cve-2024-48509-vulnerability-overview-df58a6be6864
CVE ID: CVE-2024-48510 State: PUBLISHED Published: 2024-11-13T00:00:00 Last Updated: 2024-11-21T16:45:14.070Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory Traversal vulnerability in DotNetZip v.1.16.0 and before allows a remote attacker to execute arbitrary code via the src/Zip.Shared/ZipEntry.Extract.cs component NOTE: This vulnerability only affects products that are no longer supported by the maintainer. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/haf/DotNetZip.Semverd/blob/e487179b33a9a0f2631eed5fb04d2c952ea5377a/src/Zip.Shared/ZipEntry.Extract.cs#L1365-L1410 - https://www.nuget.org/packages/DotNetZip/ - https://github.com/h
a5377a/src/Zip.Shared/ZipEntry.Extract.cs#L1365-L1410 - https://www.nuget.org/packages/DotNetZip/ - https://github.com/haf/DotNetZip.Semverd - https://gist.github.com/thomas-chauchefoin-bentley-systems/855218959116f870f08857cce2aec731
CVE ID: CVE-2024-48514 State: PUBLISHED Published: 2024-10-24T00:00:00 Last Updated: 2024-12-19T15:14:41.209803Z Vendors: n/a Products: n/a Problem Types: n/a Description: php-heic-to-jpg <= 1.0.5 is vulnerable to code injection (fixed in 1.0.6). An attacker who can upload heic images is able to execute code on the remote server via the file name. As a result, the CIA is no longer guaranteed. This affects php-heic-to-jpg 1.0.5 and below. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/MaestroError/php-heic-to-jpg - https://github.com/marcoris/CVEs/tree/master/CVE-2024-48514 - https://advisories.gitlab.com/pkg/composer/maestroerror/php-heic-to-jpg/CVE-2024-
oris/CVEs/tree/master/CVE-2024-48514 - https://advisories.gitlab.com/pkg/composer/maestroerror/php-heic-to-jpg/CVE-2024-48514/ - https://github.com/advisories/GHSA-g8v9-c8m3-942v
CVE ID: CVE-2024-48530 State: PUBLISHED Published: 2024-11-20T00:00:00 Last Updated: 2024-12-03T15:53:33.880Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in the Instructor Appointment Availability module of eSoft Planner 3.24.08271-USA allows attackers to cause a Denial of Service (DoS) via a crafted POST request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/esoft-planner-cve/esoft_planner_cve
CVE ID: CVE-2024-48531 State: PUBLISHED Published: 2024-11-20T00:00:00 Last Updated: 2024-11-20T21:07:55.531Z Vendors: n/a Products: n/a Problem Types: n/a Description: A reflected cross-site scripting (XSS) vulnerability on the Rental Availability module of eSoft Planner 3.24.08271-USA allows attackers to execute arbitrary code in the context of a user's browser via injecting a crafted payload. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/esoft-planner-cve/esoft_planner_cve
CVE ID: CVE-2024-48533 State: PUBLISHED Published: 2024-11-20T00:00:00 Last Updated: 2024-12-03T15:41:41.223Z Vendors: n/a Products: n/a Problem Types: n/a Description: A discrepancy between responses for valid and invalid e-mail accounts in the Forgot your Login? module of eSoft Planner 3.24.08271-USA allows attackers to enumerate valid user e-mail accounts. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/esoft-planner-cve/esoft_planner_cve
CVE ID: CVE-2024-48534 State: PUBLISHED Published: 2024-11-20T00:00:00 Last Updated: 2024-11-20T21:07:55.646Z Vendors: n/a Products: n/a Problem Types: n/a Description: A reflected cross-site scripting (XSS) vulnerability on the Camp Details module of eSoft Planner 3.24.08271-USA allows attackers to execute arbitrary code in the context of a user's browser via injecting a crafted payload. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/esoft-planner-cve/esoft_planner_cve
CVE ID: CVE-2024-48535 State: PUBLISHED Published: 2024-11-20T00:00:00 Last Updated: 2024-11-20T21:07:55.789Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stored cross-site scripting (XSS) vulnerability in eSoft Planner 3.24.08271-USA allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Name parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/esoft-planner-cve/esoft_planner_cve
CVE ID: CVE-2024-48536 State: PUBLISHED Published: 2024-11-20T00:00:00 Last Updated: 2024-12-03T15:37:22.236Z Vendors: n/a Products: n/a Problem Types: n/a Description: Incorrect access control in eSoft Planner 3.24.08271-USA allow attackers to view all transactions performed by the company via supplying a crafted web request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/esoft-planner-cve/esoft_planner_cve
CVE ID: CVE-2024-48538 State: PUBLISHED Published: 2024-10-24T00:00:00 Last Updated: 2024-10-24T19:48:14.344Z Vendors: n/a Products: n/a Problem Types: n/a Description: Incorrect access control in the firmware update and download processes of Neye3C v4.5.2.0 allows attackers to access sensitive information by analyzing the code and data within the APK file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://neye3c.com - http://www.netdvr.cn/page6 - https://github.com/HankJames/Vul-Reports/blob/main/FirmwareLeakage/com.gooclient.anycam.neye3ctwo/com.gooclient.anycam.neye3ctwo.md
CVE ID: CVE-2024-48539 State: PUBLISHED Published: 2024-10-24T00:00:00 Last Updated: 2024-10-24T19:41:51.783Z Vendors: n/a Products: n/a Problem Types: n/a Description: Neye3C v4.5.2.0 was discovered to contain a hardcoded encryption key in the firmware update mechanism. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://neye3c.com - http://www.netdvr.cn/page6 - https://github.com/HankJames/Vul-Reports/blob/main/FirmwareLeakage/com.gooclient.anycam.neye3ctwo/com.gooclient.anycam.neye3ctwo_key.md
CVE ID: CVE-2024-48540 State: PUBLISHED Published: 2024-10-24T00:00:00 Last Updated: 2024-10-25T15:33:48.885Z Vendors: n/a Products: n/a Problem Types: n/a Description: Incorrect access control in XIAO HE Smart 4.3.1 allows attackers to access sensitive information by analyzing the code and data within the APK file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/HankJames/Vul-Reports/blob/main/FirmwareLeakage/com.hle.china.smarthome.xiaohe/com.hle.china.smarthome.xiaohe.md
CVE ID: CVE-2024-48541 State: PUBLISHED Published: 2024-10-24T00:00:00 Last Updated: 2024-10-24T18:15:20.612Z Vendors: n/a Products: n/a Problem Types: n/a Description: Incorrect access control in the firmware update and download processes of Ruochan Smart v4.4.7 allows attackers to access sensitive information by analyzing the code and data within the APK file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://www.ruochanit.com/ - https://github.com/HankJames/Vul-Reports/blob/main/FirmwareLeakage/com.ruochan.dabai/com.ruochan.dabai.md
CVE ID: CVE-2024-48542 State: PUBLISHED Published: 2024-10-24T00:00:00 Last Updated: 2024-10-24T18:16:53.998Z Vendors: n/a Products: n/a Problem Types: n/a Description: Incorrect access control in the firmware update and download processes of Yamaha Headphones Controller v1.6.7 allows attackers to access sensitive information by analyzing the code and data within the APK file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/HankJames/Vul-Reports/blob/main/FirmwareLeakage/com.yamaha.sc.hpcontroller/com.yamaha.sc.hpcontroller.md
CVE ID: CVE-2024-48544 State: PUBLISHED Published: 2024-10-24T00:00:00 Last Updated: 2024-10-24T21:01:12.948Z Vendors: n/a Products: n/a Problem Types: n/a Description: Incorrect access control in the firmware update and download processes of Sylvania Smart Home v3.0.3 allows attackers to access sensitive information by analyzing the code and data within the APK file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://sylvania.com - https://github.com/HankJames/Vul-Reports/blob/main/FirmwareLeakage/com.ledvance.smartplus/com.ledvance.smartplus.md
CVE ID: CVE-2024-48545 State: PUBLISHED Published: 2024-10-24T00:00:00 Last Updated: 2024-10-24T18:25:52.517Z Vendors: n/a Products: n/a Problem Types: n/a Description: Incorrect access control in the firmware update and download processes of IVY Smart v4.5.0 allows attackers to access sensitive information by analyzing the code and data within the APK file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/HankJames/Vul-Reports/blob/main/FirmwareLeakage/com.ivyiot.IvySmart/com.ivyiot.IvySmart.md
CVE ID: CVE-2024-48546 State: PUBLISHED Published: 2024-10-24T00:00:00 Last Updated: 2024-10-24T18:23:36.931Z Vendors: n/a Products: n/a Problem Types: n/a Description: Incorrect access control in the firmware update and download processes of Wear Sync v1.2.0 allows attackers to access sensitive information by analyzing the code and data within the APK file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://haylou.com - https://github.com/HankJames/Vul-Reports/blob/main/FirmwareLeakage/com.yingsheng.nadai/com.yingsheng.nadai.md
CVE ID: CVE-2024-48547 State: PUBLISHED Published: 2024-10-24T00:00:00 Last Updated: 2024-10-24T18:29:01.698Z Vendors: n/a Products: n/a Problem Types: n/a Description: Incorrect access control in the firmware update and download processes of DreamCatcher Life v1.8.7 allows attackers to access sensitive information by analyzing the code and data within the APK file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/HankJames/Vul-Reports/blob/main/FirmwareLeakage/com.dc.dreamcatcherlife/com.dc.dreamcatcherlife.md
CVE ID: CVE-2024-48548 State: PUBLISHED Published: 2024-10-24T00:00:00 Last Updated: 2024-10-24T20:55:38.207Z Vendors: n/a Products: n/a Problem Types: n/a Description: The APK file in Cloud Smart Lock v2.0.1 has a leaked a URL that can call an API for binding physical devices. This vulnerability allows attackers to arbitrarily construct a request to use the app to bind to unknown devices by finding a valid serial number via a bruteforce attack. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cloudsmartlock.com/m/app.html - https://github.com/HankJames/Vul-Reports/blob/main/FirmwareLeakage/com.seamooncloud.cloudsmartlock/com.seamooncloud.cloudsmartlock.md
CVE ID: CVE-2024-48569 State: PUBLISHED Published: 2024-10-30T00:00:00.000Z Last Updated: 2025-10-17T15:07:47.720Z Vendors: n/a Products: n/a Problem Types: n/a Description: Proactive Risk Manager version 9.1.1.0 is affected by multiple Cross-Site Scripting (XSS) vulnerabilities in the add/edit form fields, at the urls starting with the subpaths: /ar/config/configuation/ and /ar/config/risk-strategy-control/ Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/MarioTesoro/CVE-2024-48569 - https://github.com/MarioTesoro/vulnerability-research/tree/main/CVE-2024-48569
CVE ID: CVE-2024-48570 State: PUBLISHED Published: 2024-10-22T00:00:00 Last Updated: 2024-10-22T18:36:39.721Z Vendors: n/a Products: n/a Problem Types: n/a Description: Client Management System 1.0 was discovered to contain a SQL injection vulnerability via the Between Dates Reports parameter at /admin/bwdates-reports-ds.php. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Luc1f3r066/Client-Management-System-v1.0-
CVE ID: CVE-2024-48572 State: PUBLISHED Published: 2024-10-29T00:00:00.000Z Last Updated: 2025-03-14T16:59:22.921Z Vendors: n/a Products: n/a Problem Types: n/a Description: A User enumeration vulnerability in AquilaCMS 1.409.20 and prior allows unauthenticated attackers to obtain email addresses via the "Add a user" feature. The vulnerability occurs due to insufficiently validated user input being processed as a regular expression, which is then matched against email addresses to find duplicate entries. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/dos-m0nk3y/CVE/tree/main/CVE-2024-48572