Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-0515 State: PUBLISHED Published: 2024-02-20T18:56:38.059Z Last Updated: 2024-08-01T18:11:34.336Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: wproyal Products: Royal Elementor Addons and Templates Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.3.87. This is due to missing or incorrect nonce validation on the remove_from_compare function. This makes it possible for unauthenticated attackers to remove items from user compare lists via a forged request granted they can trick
sible for unauthenticated attackers to remove items from user compare lists via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/a4178271-c09e-4094-a616-5a00d28f39a3?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3026824%40royal-elementor-addons%2Ftags%2F1.3.87&new=3032004%40royal-elementor-addons%2Ftags%2F1.3.88
CVE ID: CVE-2024-0516 State: PUBLISHED Published: 2024-02-20T18:56:47.908Z Last Updated: 2024-08-01T18:11:34.418Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: wproyal Products: Royal Elementor Addons and Templates Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to unauthorized post metadata update due to a missing capability check on the wpr_update_form_action_meta function in all versions up to, and including, 1.3.87. This makes it possible for unauthenticated attackers to update certain metadata. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Prog
for unauthenticated attackers to update certain metadata. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/d3457b87-c860-4cf2-ac3d-2c6521b629ea?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3026824%40royal-elementor-addons%2Ftags%2F1.3.87&new=3032004%40royal-elementor-addons%2Ftags%2F1.3.88
CVE ID: CVE-2024-0517 State: PUBLISHED Published: 2024-01-16T21:14:48.895Z Last Updated: 2025-05-22T17:34:47.632Z Vendors: Google Products: Chrome Problem Types: Out of bounds write Description: Out of bounds write in V8 in Google Chrome prior to 120.0.6099.224 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2024/01/stable-channel-update-for-desktop_16.html - https://crbug.com/1515930 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IIUBRVICIC
.com/1515930 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IIUBRVICICWREJQUVT67RS7E4PVZQ5RS/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TNN4SO5UI3U3Q6ASTVT6WMZ4723FYDLH/
CVE ID: CVE-2024-0518 State: PUBLISHED Published: 2024-01-16T21:14:49.323Z Last Updated: 2025-02-13T17:27:12.162Z Vendors: Google Products: Chrome Problem Types: Type Confusion Description: Type confusion in V8 in Google Chrome prior to 120.0.6099.224 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://chromereleases.googleblog.com/2024/01/stable-channel-update-for-desktop_16.html - https://crbug.com/1507412 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IIUBRVICICWREJQUVT67
12 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IIUBRVICICWREJQUVT67RS7E4PVZQ5RS/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TNN4SO5UI3U3Q6ASTVT6WMZ4723FYDLH/
CVE ID: CVE-2024-0519 State: PUBLISHED Published: 2024-01-16T21:14:49.601Z Last Updated: 2025-10-21T23:05:28.347Z Vendors: Google Products: Chrome Problem Types: Out of bounds memory access Description: Out of bounds memory access in V8 in Google Chrome prior to 120.0.6099.224 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://chromereleases.googleblog.com/2024/01/stable-channel-update-for-desktop_16.html - https://crbug.com/1517354 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/me
- https://crbug.com/1517354 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IIUBRVICICWREJQUVT67RS7E4PVZQ5RS/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TNN4SO5UI3U3Q6ASTVT6WMZ4723FYDLH/ - https://www.couchbase.com/alerts/
CVE ID: CVE-2024-0520 State: PUBLISHED Published: 2024-06-06T18:19:36.380Z Last Updated: 2025-10-15T12:50:06.675Z Severity: CRITICAL (CVSS 10 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: mlflow Products: mlflow/mlflow Problem Types: CWE-22 Description: A vulnerability in mlflow/mlflow version 8.2.1 allows for remote code execution due to improper neutralization of special elements used in an OS command ('Command Injection') within the `mlflow.data.http_dataset_source.py` module. Specifically, when loading a dataset from a source URL with an HTTP scheme, the filename extracted from the `Content-Disposition` header or the URL path is used to generate the final file path without prope
me extracted from the `Content-Disposition` header or the URL path is used to generate the final file path without proper sanitization. This flaw enables an attacker to control the file path fully by utilizing path traversal or absolute path techniques, such as '../../tmp/poc.txt' or '/tmp/poc.txt', leading to arbitrary file write. Exploiting this vulnerability could allow a malicious user to execute commands on the vulnerable machine, potentially gaining access to data and model information. The issue is fixed in version 2.9.0. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://huntr.com/bounties/93e470d7-b6f0-409b-af63-49d3e2a26dbc - https://g
ment: - CVE Program Container: References: - https://huntr.com/bounties/93e470d7-b6f0-409b-af63-49d3e2a26dbc - https://github.com/mlflow/mlflow/commit/400c226953b4568f4361bc0a0c223511652c2b9d
CVE ID: CVE-2024-0521 State: PUBLISHED Published: 2024-01-20T20:24:06.475Z Last Updated: 2025-05-30T14:24:16.444Z Severity: CRITICAL (CVSS 9.3 CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: paddlepaddle Products: paddlepaddle/paddle Problem Types: CWE-94 Description: Code Injection in paddlepaddle/paddle Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/a569c64b-1e2b-4bed-a19f-47fd5a3da453
CVE ID: CVE-2024-0522 State: PUBLISHED Published: 2024-01-14T23:00:04.867Z Last Updated: 2025-06-03T14:02:09.180Z Severity: N/A (CVSS 5 AV:N/AC:L/Au:N/C:N/I:P/A:N) Vendors: Allegro Products: RomPager Problem Types: CWE-352 Description: A vulnerability was found in Allegro RomPager 4.01. It has been classified as problematic. Affected is an unknown function of the file usertable.htm?action=delete of the component HTTP POST Request Handler. The manipulation of the argument username leads to cross-site request forgery. It is possible to launch the attack remotely. Upgrading to version 4.30 is able to address this issue. It is recommended to upgrade the affected component. The identifier of this
version 4.30 is able to address this issue. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-250692. NOTE: The vendor explains that this is a very old issue that got fixed 20 years ago but without a public disclosure. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.250692 - https://vuldb.com/?ctiid.250692
CVE ID: CVE-2024-0523 State: PUBLISHED Published: 2024-01-14T23:00:06.144Z Last Updated: 2025-06-17T21:09:22.212Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: n/a Products: CmsEasy Problem Types: CWE-89 Description: A vulnerability was found in CmsEasy up to 7.7.7. It has been declared as critical. Affected by this vulnerability is the function getslide_child_action in the library lib/admin/language_admin.php. The manipulation of the argument sid leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-250693 was assigned to this vulnerability. NOTE: The vendor was contacted early about this
be used. The identifier VDB-250693 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.250693 - https://vuldb.com/?ctiid.250693 - https://github.com/V3geD4g/cmseasy_vul/blob/main/SQL1-EN.md
CVE ID: CVE-2024-0524 State: PUBLISHED Published: 2024-01-14T23:31:04.129Z Last Updated: 2024-11-13T21:46:41.031Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: CXBSoft Products: Url-shorting Problem Types: CWE-89 Description: A vulnerability was found in CXBSoft Url-shorting up to 1.3.1. It has been rated as critical. Affected by this issue is some unknown functionality of the file index.php. The manipulation of the argument url leads to sql injection. The exploit has been disclosed to the public and may be used. VDB-250694 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in an
ier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.250694 - https://vuldb.com/?ctiid.250694 - https://note.zhaoj.in/share/GdpwiaItePFq
CVE ID: CVE-2024-0525 State: PUBLISHED Published: 2024-01-14T23:31:05.196Z Last Updated: 2024-08-27T20:41:22.414Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: CXBSoft Products: Url-shorting Problem Types: CWE-89 Description: A vulnerability classified as critical has been found in CXBSoft Url-shorting up to 1.3.1. This affects an unknown part of the file /pages/long_s_short.php of the component HTTP POST Request Handler. The manipulation of the argument longurl leads to sql injection. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-250695. NOTE: The vendor was contacted early about this
be used. The associated identifier of this vulnerability is VDB-250695. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.250695 - https://vuldb.com/?ctiid.250695 - https://note.zhaoj.in/share/9tjcunCPidgI
CVE ID: CVE-2024-0526 State: PUBLISHED Published: 2024-01-15T00:00:07.523Z Last Updated: 2025-06-17T21:19:13.435Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: CXBSoft Products: Url-shorting Problem Types: CWE-89 Description: A vulnerability classified as critical was found in CXBSoft Url-shorting up to 1.3.1. This vulnerability affects unknown code of the file /pages/short_to_long.php of the component HTTP POST Request Handler. The manipulation of the argument shorturl leads to sql injection. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-250696. NOTE: The vendor was contacted early about this dis
and may be used. The identifier of this vulnerability is VDB-250696. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.250696 - https://vuldb.com/?ctiid.250696 - https://note.zhaoj.in/share/Zezf8fmoq7lk
CVE ID: CVE-2024-0527 State: PUBLISHED Published: 2024-01-15T00:31:04.051Z Last Updated: 2025-06-03T14:02:00.923Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: CXBSoft Products: Url-shorting Problem Types: CWE-89 Description: A vulnerability, which was classified as critical, has been found in CXBSoft Url-shorting up to 1.3.1. This issue affects some unknown processing of the file /admin/pages/update_go.php of the component HTTP POST Request Handler. The manipulation of the argument version leads to sql injection. The exploit has been disclosed to the public and may be used. The identifier VDB-250697 was assigned to this vulnerability. NOTE: The vendor was
closed to the public and may be used. The identifier VDB-250697 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.250697 - https://vuldb.com/?ctiid.250697 - https://note.zhaoj.in/share/6bz65C2dfgUk
CVE ID: CVE-2024-0528 State: PUBLISHED Published: 2024-01-15T00:31:05.064Z Last Updated: 2024-10-24T15:00:18.274Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: CXBSoft Products: Post-Office Problem Types: CWE-89 Description: A vulnerability, which was classified as critical, was found in CXBSoft Post-Office 1.0. Affected is an unknown function of the file /admin/pages/update_go.php of the component HTTP POST Request Handler. The manipulation of the argument version leads to sql injection. The exploit has been disclosed to the public and may be used. VDB-250698 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this
ay be used. VDB-250698 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.250698 - https://vuldb.com/?ctiid.250698 - https://note.zhaoj.in/share/grOgvdMgn0wg
CVE ID: CVE-2024-0529 State: PUBLISHED Published: 2024-01-15T01:00:05.418Z Last Updated: 2024-08-26T18:17:26.822Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: CXBSoft Products: Post-Office Problem Types: CWE-89 Description: A vulnerability has been found in CXBSoft Post-Office up to 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /apps/login_auth.php of the component HTTP POST Request Handler. The manipulation of the argument username_login leads to sql injection. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-250699. NOTE: The vend
n disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-250699. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.250699 - https://vuldb.com/?ctiid.250699 - https://note.zhaoj.in/share/neURUa2NSxzd
CVE ID: CVE-2024-0530 State: PUBLISHED Published: 2024-01-15T01:31:03.422Z Last Updated: 2025-06-03T14:01:51.835Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: CXBSoft Products: Post-Office Problem Types: CWE-89 Description: A vulnerability was found in CXBSoft Post-Office up to 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /apps/reg_go.php of the component HTTP POST Request Handler. The manipulation of the argument username_reg leads to sql injection. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-250700. NOTE: The vendor was contacted early about
e public and may be used. The identifier of this vulnerability is VDB-250700. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.250700 - https://vuldb.com/?ctiid.250700 - https://note.zhaoj.in/share/HUxa372VNwad
CVE ID: CVE-2024-0531 State: PUBLISHED Published: 2024-01-15T02:00:06.294Z Last Updated: 2025-06-03T14:01:45.143Z Severity: N/A (CVSS 8.3 AV:N/AC:L/Au:M/C:C/I:C/A:C) Vendors: Tenda Products: A15 Problem Types: CWE-121 Description: A vulnerability was found in Tenda A15 15.13.07.13. It has been classified as critical. This affects an unknown part of the file /goform/setBlackRule of the component Web-based Management Interface. The manipulation of the argument deviceList leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-250701 was assigned to this vulnerability. NOTE: The vendor
disclosed to the public and may be used. The identifier VDB-250701 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.250701 - https://vuldb.com/?ctiid.250701 - https://github.com/yaoyue123/iot/blob/main/Tenda/A15/setBlackRule.md
CVE ID: CVE-2024-0532 State: PUBLISHED Published: 2024-01-15T02:00:07.407Z Last Updated: 2025-05-14T14:40:54.727Z Severity: N/A (CVSS 8.3 AV:N/AC:L/Au:M/C:C/I:C/A:C) Vendors: Tenda Products: A15 Problem Types: CWE-121, CWE-119 Description: A vulnerability was found in Tenda A15 15.13.07.13. It has been declared as critical. This vulnerability affects the function set_repeat5 of the file /goform/WifiExtraSet of the component Web-based Management Interface. The manipulation of the argument wpapsk_crypto2_4g/wpapsk_crypto5g leads to stack-based buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early abou
be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.250702 - https://vuldb.com/?ctiid.250702 - https://vuldb.com/?submit.262690 - https://github.com/yaoyue123/iot/blob/main/Tenda/A15/WifExtraSet.md - https://www.tenda.com.cn/
CVE ID: CVE-2024-0533 State: PUBLISHED Published: 2024-01-15T02:31:04.275Z Last Updated: 2025-06-13T19:09:23.960Z Severity: N/A (CVSS 8.3 AV:N/AC:L/Au:M/C:C/I:C/A:C) Vendors: Tenda Products: A15 Problem Types: CWE-121 Description: A vulnerability was found in Tenda A15 15.13.07.13. It has been rated as critical. This issue affects some unknown processing of the file /goform/SetOnlineDevName of the component Web-based Management Interface. The manipulation of the argument devName leads to stack-based buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-250703. NOTE: The vendo
disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-250703. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.250703 - https://vuldb.com/?ctiid.250703 - https://github.com/yaoyue123/iot/blob/main/Tenda/A15/SetOnlineDevName.devname.md
CVE ID: CVE-2024-0534 State: PUBLISHED Published: 2024-01-15T02:31:05.308Z Last Updated: 2025-06-17T21:19:13.612Z Severity: N/A (CVSS 8.3 AV:N/AC:L/Au:M/C:C/I:C/A:C) Vendors: Tenda Products: A15 Problem Types: CWE-121 Description: A vulnerability classified as critical has been found in Tenda A15 15.13.07.13. Affected is an unknown function of the file /goform/SetOnlineDevName of the component Web-based Management Interface. The manipulation of the argument mac leads to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-250704. NOTE: The vendor was contacted early
to the public and may be used. The identifier of this vulnerability is VDB-250704. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.250704 - https://vuldb.com/?ctiid.250704 - https://github.com/yaoyue123/iot/blob/main/Tenda/A15/SetOnlineDevName.mac.md
CVE ID: CVE-2024-0535 State: PUBLISHED Published: 2024-01-15T03:00:05.330Z Last Updated: 2024-11-14T14:22:49.337Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C) Vendors: Tenda Products: PA6 Problem Types: CWE-121 Description: A vulnerability classified as critical was found in Tenda PA6 1.0.1.21. Affected by this vulnerability is the function cgiPortMapAdd of the file /portmap of the component httpd. The manipulation of the argument groupName leads to stack-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-250705 was assigned to this vulnerability. NOTE: The vendor was contacted early about this dis
used. The identifier VDB-250705 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.250705 - https://vuldb.com/?ctiid.250705 - https://github.com/jylsec/vuldb/blob/main/Tenda/PA6/2/README.md
CVE ID: CVE-2024-0536 State: PUBLISHED Published: 2024-01-15T03:31:03.398Z Last Updated: 2025-06-17T21:19:13.776Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C) Vendors: Tenda Products: W9 Problem Types: CWE-121 Description: A vulnerability, which was classified as critical, has been found in Tenda W9 1.0.0.7(4456). Affected by this issue is the function setWrlAccessList of the component httpd. The manipulation of the argument ssidIndex leads to stack-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-250706 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure
VDB-250706 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.250706 - https://vuldb.com/?ctiid.250706 - https://github.com/jylsec/vuldb/blob/main/Tenda/W9/1/README.md
CVE ID: CVE-2024-0537 State: PUBLISHED Published: 2024-01-15T04:00:05.361Z Last Updated: 2024-08-27T20:38:03.663Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C) Vendors: Tenda Products: W9 Problem Types: CWE-121 Description: A vulnerability, which was classified as critical, was found in Tenda W9 1.0.0.7(4456). This affects the function setWrlBasicInfo of the component httpd. The manipulation of the argument ssidIndex leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-250707. NOTE: The vendor was contacted early about this disclosure but d