Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-13176 State: PUBLISHED Published: 2025-01-20T13:29:57.047Z Last Updated: 2025-11-03T19:29:14.570Z Vendors: OpenSSL Products: OpenSSL Problem Types: CWE-385 Description: Issue summary: A timing side-channel which could potentially allow recovering the private key exists in the ECDSA signature computation. Impact summary: A timing side-channel in ECDSA signature computations could allow recovering the private key by an attacker. However, measuring the timing would require either local access to the signing application or a very fast network connection with low latency. There is a timing signal of around 300 nanoseconds when the top word of the inverted ECDSA nonce value is zer
w latency. There is a timing signal of around 300 nanoseconds when the top word of the inverted ECDSA nonce value is zero. This can happen with significant probability only for some of the supported elliptic curves. In particular the NIST P-521 curve is affected. To be able to measure this leak, the attacker process must either be located in the same physical computer or must have a very fast network connection with low latency. For that reason the severity of this vulnerability is Low. The FIPS modules in 3.4, 3.3, 3.2, 3.1 and 3.0 are affected by this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://openssl-library.org/news/secadv/202
alyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://openssl-library.org/news/secadv/20250120.txt - https://github.com/openssl/openssl/commit/77c608f4c8857e63e98e66444e2e761c9627916f - https://github.com/openssl/openssl/commit/392dcb336405a0c94486aa6655057f59fd3a0902 - https://github.com/openssl/openssl/commit/4b1cb94a734a7d4ec363ac0a215a25c181e11f65 - https://github.com/openssl/openssl/commit/2af62e74fb59bc469506bc37eb2990ea408d9467 - https://github.com/openssl/openssl/commit/07272b05b04836a762b4baa874958af51d513844 - https://github.openssl.org/openssl/extended-releases/commit/a2639000db19878d5d89586ae7b725080592ae86 - https://github.openssl.org/openssl/exten
org/openssl/extended-releases/commit/a2639000db19878d5d89586ae7b725080592ae86 - https://github.openssl.org/openssl/extended-releases/commit/0d5fd1ab987f7571e2c955d8d8b638fc0fb54ded
CVE ID: CVE-2024-13177 State: PUBLISHED Published: 2025-04-15T15:21:21.941Z Last Updated: 2025-04-15T16:14:08.279Z Vendors: Netskope Products: Netskope Client Problem Types: CWE-610 Description: Netskope Client on Mac OS is impacted by a vulnerability in which the postinstall script does not properly validate the path of the file “nsinstallation”. A standard user could potentially create a symlink of the file “nsinstallation” to escalate the privileges of a different file on the system. This issue affects Netskope Client: before 123.0, before 117.1.11.2310, before 120.1.10.2306. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.netskope.com/s/article/Netskope-S
2306. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.netskope.com/s/article/Netskope-Security-Advisory-Netskope-Client-installer-with-symbolic-link-following-vulnerability-leading-to-privilege-escalation
CVE ID: CVE-2024-13178 State: PUBLISHED Published: 2025-11-14T02:29:58.232Z Last Updated: 2025-11-14T15:31:16.951Z Vendors: Google Products: Chrome Problem Types: Inappropriate implementation Description: Inappropriate implementation in Fullscreen in Google Chrome prior to 128.0.6613.84 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2024/08/stable-channel-update-for-desktop_21.html - https://issues.chromium.org/issues/40068607
CVE ID: CVE-2024-13179 State: PUBLISHED Published: 2025-01-14T16:51:57.334Z Last Updated: 2025-01-16T16:53:23.111Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: Ivanti Products: Avalanche Problem Types: CWE-22, CWE-288 Description: Path Traversal in Ivanti Avalanche before version 6.4.7 allows a remote unauthenticated attacker to bypass authentication. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Avalanche-6-4-7-Multiple-CVEs
CVE ID: CVE-2024-13180 State: PUBLISHED Published: 2025-01-14T16:52:41.501Z Last Updated: 2025-01-16T19:01:55.047Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Ivanti Products: Avalanche Problem Types: CWE-22 Description: Path Traversal in Ivanti Avalanche before version 6.4.7 allows a remote unauthenticated attacker to leak sensitive information. This CVE addresses incomplete fixes from CVE-2024-47011. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Avalanche-6-4-7-Multiple-CVEs
CVE ID: CVE-2024-13181 State: PUBLISHED Published: 2025-01-14T16:53:36.325Z Last Updated: 2025-01-16T19:06:15.676Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: Ivanti Products: Avalanche Problem Types: CWE-22, CWE-288 Description: Path Traversal in Ivanti Avalanche before version 6.4.7 allows a remote unauthenticated attacker to bypass authentication. This CVE addresses incomplete fixes from CVE-2024-47010. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Avalanche-6-4-7-Multiple-CVEs
CVE ID: CVE-2024-13182 State: PUBLISHED Published: 2025-02-13T12:41:51.470Z Last Updated: 2025-02-13T14:24:43.434Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Chimpstudio Products: WP Directorybox Manager Problem Types: CWE-288 Description: The WP Directorybox Manager plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 2.5. This is due to incorrect authentication in the 'wp_dp_parse_request' function. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence
e site, such as an administrator. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/ea9e5e5d-a7fc-4159-a2ae-610bee76f818?source=cve - http://localhost:1337/wp-content/plugins/wp-directorybox-manager/elements/login/cs-social-login/cs-social-login.php#L43
CVE ID: CVE-2024-13183 State: PUBLISHED Published: 2025-01-10T07:21:46.542Z Last Updated: 2025-01-10T14:50:49.253Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: themeisle Products: Orbit Fox by ThemeIsle Problem Types: CWE-79 Description: The Orbit Fox by ThemeIsle plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘title_tag’ parameter in all versions up to, and including, 2.10.43 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. A
ccess and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/d0f6be2b-5eb6-4828-ae95-7f2253700ee9?source=cve - https://wordpress.org/plugins/themeisle-companion/#developers - https://plugins.trac.wordpress.org/browser/themeisle-companion/trunk/obfx_modules/elementor-extra-widgets/widgets/elementor/pricing-table.php#L118 - https://plugins.trac.wordpress.org/changeset/3219568/ - https://github.com/Codeinwp/themeisle-companion/commit/47a17c86934cebbfc3f1a812f1afcaa20515c1f7
CVE ID: CVE-2024-13184 State: PUBLISHED Published: 2025-01-18T08:26:39.182Z Last Updated: 2025-01-21T21:16:56.643Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: wpextended Products: The Ultimate WordPress Toolkit – WP Extended Problem Types: CWE-89 Description: The The Ultimate WordPress Toolkit – WP Extended plugin for WordPress is vulnerable to time-based SQL Injection via the Login Attempts module in all versions up to, and including, 3.0.12 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into alre
the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/abab29c7-88a9-4c6f-9691-ed9087cde2ff?source=cve - https://plugins.trac.wordpress.org/browser/wpextended/trunk/includes/modules/core_extensions/wpext_limit_login_attempts/wpext_limit_login_attempts.php#L105 - https://wordpress.org/plugins/wpextended/#developers - https://plugins.trac.wordpress.org/changeset/3220003/
CVE ID: CVE-2024-13185 State: PUBLISHED Published: 2025-01-08T08:08:12.559Z Last Updated: 2025-01-08T14:13:33.525Z Vendors: vivo Products: MinigameCenter Problem Types: CWE-306 Description: The MinigameCenter module has insufficient restrictions on loading URLs, which may lead to some information leakage. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.vivo.com/en/support/security-advisory-detail?id=15
CVE ID: CVE-2024-13186 State: PUBLISHED Published: 2025-01-08T08:28:21.455Z Last Updated: 2025-01-08T14:02:21.920Z Vendors: vivo Products: MinigameCenter Problem Types: CWE-306 Description: The MinigameCenter module has insufficient restrictions on loading URLs, which may lead to some information leakage. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.vivo.com/en/support/security-advisory-detail?id=16
CVE ID: CVE-2024-13187 State: PUBLISHED Published: 2025-01-08T16:31:04.785Z Last Updated: 2025-01-08T20:38:46.481Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: Kingsoft Products: WPS Office Problem Types: CWE-94, CWE-74 Description: A vulnerability was found in Kingsoft WPS Office 6.14.0 on macOS. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the component TCC Handler. The manipulation leads to code injection. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any wa
closed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.290779 - https://vuldb.com/?ctiid.290779 - https://vuldb.com/?submit.468013 - https://github.com/Rsec-1/wps
CVE ID: CVE-2024-13188 State: PUBLISHED Published: 2025-01-08T19:00:14.454Z Last Updated: 2025-02-12T17:17:20.564Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: MicroWorld Products: eScan Antivirus Problem Types: CWE-276, CWE-266 Description: A vulnerability was found in MicroWorld eScan Antivirus 7.0.32 on Linux. It has been rated as critical. Affected by this issue is some unknown functionality of the file /opt/MicroWorld/var/ of the component Installation Handler. The manipulation leads to incorrect default permissions. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used. The vendor was contacted early
s to be approached locally. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.290780 - https://vuldb.com/?ctiid.290780 - https://vuldb.com/?submit.468796 - https://github.com/hawkteam404/RnD_Public/blob/main/escan_incorrect_default_perm.md
CVE ID: CVE-2024-13189 State: PUBLISHED Published: 2025-01-08T20:00:09.819Z Last Updated: 2025-01-08T20:41:31.199Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: ZeroWdd Products: myblog Problem Types: CWE-275, CWE-266 Description: A vulnerability classified as critical has been found in ZeroWdd myblog 1.0. This affects an unknown part of the file src/main/java/com/wdd/myblog/config/MyBlogMvcConfig.java. The manipulation leads to permission issues. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.290781 - https://vuldb.com/?ctiid.29
itional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.290781 - https://vuldb.com/?ctiid.290781 - https://vuldb.com/?submit.469223 - https://github.com/ZeroWdd/myblog/issues/1 - https://github.com/ZeroWdd/myblog/issues/1#issue-2759828006
CVE ID: CVE-2024-13190 State: PUBLISHED Published: 2025-01-08T21:00:11.283Z Last Updated: 2025-02-12T17:18:08.818Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: ZeroWdd Products: myblog Problem Types: CWE-91, CWE-74 Description: A vulnerability classified as critical was found in ZeroWdd myblog 1.0. This vulnerability affects unknown code of the file src/main/resources/mapper/BlogMapper.xml. The manipulation of the argument findBlogList/getTotalBlogs leads to xml injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.290782 - https://vu
may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.290782 - https://vuldb.com/?ctiid.290782 - https://vuldb.com/?submit.469226 - https://github.com/ZeroWdd/myblog/issues/2 - https://github.com/ZeroWdd/myblog/issues/2#issue-2759833644
CVE ID: CVE-2024-13191 State: PUBLISHED Published: 2025-01-08T22:31:04.729Z Last Updated: 2025-01-09T16:38:53.842Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: ZeroWdd Products: myblog Problem Types: CWE-434, CWE-284 Description: A vulnerability, which was classified as critical, has been found in ZeroWdd myblog 1.0. This issue affects the function upload of the file src/main/java/com/wdd/myblog/controller/admin/uploadController.java. The manipulation of the argument file leads to unrestricted upload. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuld
n disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.290783 - https://vuldb.com/?ctiid.290783 - https://vuldb.com/?submit.469229 - https://github.com/ZeroWdd/myblog/issues/3 - https://github.com/ZeroWdd/myblog/issues/3#issue-2759839215
CVE ID: CVE-2024-13192 State: PUBLISHED Published: 2025-01-08T23:00:15.430Z Last Updated: 2025-01-09T16:29:25.794Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: ZeroWdd Products: myblog Problem Types: CWE-79, CWE-94 Description: A vulnerability, which was classified as problematic, was found in ZeroWdd myblog 1.0. Affected is the function update of the file src/main/java/com/wdd/myblog/controller/admin/BlogController.java. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.290784 - https://
nd may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.290784 - https://vuldb.com/?ctiid.290784 - https://vuldb.com/?submit.469232 - https://github.com/ZeroWdd/myblog/issues/4 - https://github.com/ZeroWdd/myblog/issues/4#issue-2759845658
CVE ID: CVE-2024-13193 State: PUBLISHED Published: 2025-01-08T23:00:17.162Z Last Updated: 2025-01-09T16:25:08.131Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: n/a Products: SEMCMS Problem Types: CWE-89, CWE-74 Description: A vulnerability has been found in SEMCMS up to 4.8 and classified as critical. Affected by this vulnerability is an unknown functionality of the file SEMCMS_Images.php of the component Image Library Management Page. The manipulation leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst
nd may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.290785 - https://vuldb.com/?ctiid.290785 - https://vuldb.com/?submit.469563 - https://github.com/Upgradeextension/SEMCMS/blob/main/README.md
CVE ID: CVE-2024-13194 State: PUBLISHED Published: 2025-01-08T23:31:04.850Z Last Updated: 2025-01-09T16:24:01.975Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: n/a Products: Sucms Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in Sucms 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /admin/admin_members.php?ac=search. The manipulation of the argument uid leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.290786 - https://vuldb.com/?ctiid.290786 - htt
alyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.290786 - https://vuldb.com/?ctiid.290786 - https://vuldb.com/?submit.469566 - https://github.com/Upgradeextension/Sucms-v1.0SQLinjection/blob/main/README.md
CVE ID: CVE-2024-13195 State: PUBLISHED Published: 2025-01-08T23:31:06.435Z Last Updated: 2025-01-09T16:19:46.795Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: donglight Products: bookstore电商书城系统说明 Problem Types: CWE-918 Description: A vulnerability was found in donglight bookstore电商书城系统说明 1.0.0. It has been classified as critical. This affects the function getHtml of the file src/main/java/org/zdd/bookstore/rawl/HttpUtil.java. The manipulation of the argument url leads to server-side request forgery. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - ht
it has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.290787 - https://vuldb.com/?ctiid.290787 - https://vuldb.com/?submit.469689 - https://github.com/donglight/bookstore/issues/11 - https://github.com/donglight/bookstore/issues/11#issue-2760929273
CVE ID: CVE-2024-13196 State: PUBLISHED Published: 2025-01-09T00:00:15.649Z Last Updated: 2025-01-09T16:16:17.775Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: donglight Products: bookstore电商书城系统说明 Problem Types: CWE-79, CWE-94 Description: A vulnerability was found in donglight bookstore电商书城系统说明 1.0.0. It has been declared as problematic. This vulnerability affects the function BookSearchList of the file src/main/java/org/zdd/bookstore/web/controller/BookInfoController.java. The manipulation of the argument keywords leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA
an be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.290788 - https://vuldb.com/?ctiid.290788 - https://vuldb.com/?submit.469771 - https://github.com/donglight/bookstore/issues/12 - https://github.com/donglight/bookstore/issues/12#issue-2760934170
CVE ID: CVE-2024-13197 State: PUBLISHED Published: 2025-01-09T00:00:17.447Z Last Updated: 2025-01-09T15:39:51.600Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: donglight Products: bookstore电商书城系统说明 Problem Types: CWE-79, CWE-94 Description: A vulnerability was found in donglight bookstore电商书城系统说明 1.0.0. It has been rated as problematic. This issue affects the function updateUser of the file src/main/Java/org/zdd/bookstore/web/controller/admin/AdminUserControlle.java. The manipulation leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - h
oit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.290789 - https://vuldb.com/?ctiid.290789 - https://vuldb.com/?submit.469772 - https://github.com/donglight/bookstore/issues/13 - https://github.com/donglight/bookstore/issues/13#issue-2760943787
CVE ID: CVE-2024-13198 State: PUBLISHED Published: 2025-01-09T00:31:04.928Z Last Updated: 2025-01-09T15:37:11.281Z Severity: LOW (CVSS 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: langhsu Products: Mblog Blog System Problem Types: CWE-204, CWE-203 Description: A vulnerability classified as problematic has been found in langhsu Mblog Blog System 3.5.0. Affected is an unknown function of the file /login. The manipulation leads to observable response discrepancy. It is possible to launch the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted
ability is told to be difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.290790 - https://vuldb.com/?ctiid.290790 - https://vuldb.com/?submit.470429 - https://github.com/cydtseng/Vulnerability-Research/blob/main/mblog/ObservableDiscrepancy-UserLogin.md
CVE ID: CVE-2024-13199 State: PUBLISHED Published: 2025-01-09T00:31:06.388Z Last Updated: 2025-01-09T15:34:14.352Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: langhsu Products: Mblog Blog System Problem Types: CWE-79, CWE-94 Description: A vulnerability classified as problematic was found in langhsu Mblog Blog System 3.5.0. Affected by this vulnerability is an unknown functionality of the file /search of the component Search Bar. The manipulation of the argument kw leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
sed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.290791 - https://vuldb.com/?ctiid.290791 - https://vuldb.com/?submit.470430 - https://github.com/cydtseng/Vulnerability-Research/blob/main/mblog/ReflectedXSS-Search.md
CVE ID: CVE-2024-13200 State: PUBLISHED Published: 2025-01-09T01:00:14.956Z Last Updated: 2025-01-09T16:01:26.166Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: wander-chu Products: SpringBoot-Blog Problem Types: CWE-284, CWE-266 Description: A vulnerability, which was classified as critical, was found in wander-chu SpringBoot-Blog 1.0. This affects the function preHandle of the file src/main/java/com/my/blog/website/interceptor/BaseInterceptor.java of the component HTTP POST Request Handler. The manipulation leads to improper access controls. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted