Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-8075 State: PUBLISHED Published: 2024-08-22T19:31:05.823Z Last Updated: 2024-08-23T14:51:18.091Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: TOTOLINK Products: AC1200 T8 Problem Types: CWE-78 Description: A vulnerability has been found in TOTOLINK AC1200 T8 4.1.5cu.862_B20230228 and classified as critical. Affected by this vulnerability is the function setDiagnosisCfg. The manipulation leads to os command injection. The attack can be launched remotely. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.275557 - https://vuldb.com/?cti
. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.275557 - https://vuldb.com/?ctiid.275557 - https://vuldb.com/?submit.390929 - https://github.com/hawkteam404/RnD_Public/blob/main/TOTOLink_AC1200_T8_OsCmdI_BOF.md - https://www.totolink.net/
CVE ID: CVE-2024-8076 State: PUBLISHED Published: 2024-08-22T20:00:06.847Z Last Updated: 2024-08-22T20:32:31.329Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C) Vendors: TOTOLINK Products: AC1200 T8 Problem Types: CWE-120 Description: A vulnerability was found in TOTOLINK AC1200 T8 4.1.5cu.862_B20230228 and classified as critical. Affected by this issue is the function setDiagnosisCfg. The manipulation leads to buffer overflow. The attack may be launched remotely. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.275558 - https://vuldb.com/?ctiid.275558 - https:/
t Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.275558 - https://vuldb.com/?ctiid.275558 - https://github.com/hawkteam404/RnD_Public/blob/main/TOTOLink_AC1200_T8_OsCmdI_BOF.md - https://www.totolink.net/
CVE ID: CVE-2024-8077 State: PUBLISHED Published: 2024-08-22T20:00:09.118Z Last Updated: 2024-08-22T20:33:40.377Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: TOTOLINK Products: AC1200 T8 Problem Types: CWE-78 Description: A vulnerability was found in TOTOLINK AC1200 T8 4.1.5cu.862_B20230228. It has been classified as critical. This affects the function setTracerouteCfg. The manipulation leads to os command injection. It is possible to initiate the attack remotely. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.275559 - https://vuldb.com/?ctiid.27
itional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.275559 - https://vuldb.com/?ctiid.275559 - https://github.com/hawkteam404/RnD_Public/blob/main/TOTOLink_AC1200_T8_OsCmdI_BOF.md - https://www.totolink.net/
CVE ID: CVE-2024-8078 State: PUBLISHED Published: 2024-08-22T20:31:06.560Z Last Updated: 2024-08-23T14:50:50.604Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C) Vendors: TOTOLINK Products: AC1200 T8 Problem Types: CWE-120 Description: A vulnerability was found in TOTOLINK AC1200 T8 4.1.5cu.862_B20230228. It has been declared as critical. This vulnerability affects the function setTracerouteCfg. The manipulation leads to buffer overflow. The attack can be initiated remotely. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.275560 - https://vuldb.com/?ctiid.275560
nal Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.275560 - https://vuldb.com/?ctiid.275560 - https://github.com/hawkteam404/RnD_Public/blob/main/TOTOLink_AC1200_T8_OsCmdI_BOF.md - https://www.totolink.net/
CVE ID: CVE-2024-8079 State: PUBLISHED Published: 2024-08-22T21:00:07.075Z Last Updated: 2024-08-23T16:33:09.172Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C) Vendors: TOTOLINK Products: AC1200 T8 Problem Types: CWE-120 Description: A vulnerability was found in TOTOLINK AC1200 T8 4.1.5cu.862_B20230228. It has been rated as critical. This issue affects the function exportOvpn. The manipulation leads to buffer overflow. The attack may be initiated remotely. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.275561 - https://vuldb.com/?ctiid.275561 - https://vuldb.
: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.275561 - https://vuldb.com/?ctiid.275561 - https://vuldb.com/?submit.390937 - https://github.com/hawkteam404/RnD_Public/blob/main/TOTOLink_AC1200_T8_OsCmdI_BOF.md - https://www.totolink.net/
CVE ID: CVE-2024-8080 State: PUBLISHED Published: 2024-08-22T21:00:09.630Z Last Updated: 2024-08-23T14:49:44.902Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: SourceCodester Products: Online Health Care System Problem Types: CWE-89 Description: A vulnerability classified as critical has been found in SourceCodester Online Health Care System 1.0. Affected is an unknown function of the file search.php. The manipulation of the argument f_name with the input 1%' or 1=1 ) UNION SELECT 1,2,3,4,5,database(),7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23# as part of string leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the pub
f string leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.275562 - https://vuldb.com/?ctiid.275562 - https://vuldb.com/?submit.395465 - https://github.com/shang159/sqli-vul/blob/main/sql2.md - https://www.sourcecodester.com/
CVE ID: CVE-2024-8081 State: PUBLISHED Published: 2024-08-22T21:31:04.717Z Last Updated: 2024-08-23T14:47:32.162Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: itsourcecode Products: Payroll Management System Problem Types: CWE-89 Description: A vulnerability classified as critical was found in itsourcecode Payroll Management System 1.0. Affected by this vulnerability is an unknown functionality of the file login.php. The manipulation of the argument username leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.275563 - ht
blic and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.275563 - https://vuldb.com/?ctiid.275563 - https://vuldb.com/?submit.396110 - https://github.com/ppp-src/ha/issues/6 - https://itsourcecode.com/
CVE ID: CVE-2024-8082 State: PUBLISHED Published: 2025-05-15T20:07:13.191Z Last Updated: 2025-05-20T19:20:35.183Z Vendors: Unknown Products: Widgets Reset Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The Widgets Reset WordPress plugin through 0.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/47b2cd60-9ac4-49cf-8ca9-7d90656fc397/
CVE ID: CVE-2024-8083 State: PUBLISHED Published: 2024-08-22T22:00:07.187Z Last Updated: 2024-08-23T14:14:50.085Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: SourceCodester Products: Online Computer and Laptop Store Problem Types: CWE-89 Description: A vulnerability, which was classified as critical, has been found in SourceCodester Online Computer and Laptop Store 1.0. Affected by this issue is some unknown functionality of the file /php-ocls/classes/Master.php?f=pay_order. The manipulation of the argument id leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnric
hed remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.275564 - https://vuldb.com/?ctiid.275564 - https://vuldb.com/?submit.396315 - https://github.com/0xffaaa/cve/blob/main/php-ocls-Arbitrary%20Sqli.md - https://www.sourcecodester.com/
CVE ID: CVE-2024-8084 State: PUBLISHED Published: 2024-08-22T22:00:09.729Z Last Updated: 2024-08-23T14:13:45.257Z Severity: N/A (CVSS 3.3 AV:N/AC:L/Au:M/C:N/I:P/A:N) Vendors: SourceCodester Products: Online Computer and Laptop Store Problem Types: CWE-79 Description: A vulnerability, which was classified as problematic, was found in SourceCodester Online Computer and Laptop Store 1.0. This affects an unknown part of the file /php-ocls/classes/SystemSettings.php?f=update_settings of the component Setting Handler. The manipulation of the argument System Name leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be us
te scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.275565 - https://vuldb.com/?ctiid.275565 - https://vuldb.com/?submit.396318 - https://github.com/0xffaaa/cve/blob/main/php-ocls-Arbitrary%20Stored%20Cross-Site%20Scripting(XSS).md - https://www.sourcecodester.com/
CVE ID: CVE-2024-8085 State: PUBLISHED Published: 2025-05-15T20:07:13.392Z Last Updated: 2025-05-20T19:20:25.086Z Vendors: Unknown Products: PeoplePond Problem Types: CWE-79 Cross-Site Scripting (XSS), CWE-352 Cross-Site Request Forgery (CSRF) Description: The PeoplePond WordPress plugin through 1.1.9 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/8b43d3a2-4324-43fd-9c2a-90dbdc1d12a6/
CVE ID: CVE-2024-8086 State: PUBLISHED Published: 2024-08-22T22:31:05.395Z Last Updated: 2024-08-23T14:11:34.333Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: SourceCodester Products: E-Commerce System Problem Types: CWE-89 Description: A vulnerability has been found in SourceCodester E-Commerce System 1.0 and classified as critical. This vulnerability affects unknown code of the file /ecommerce/admin/login.php of the component Admin Login. The manipulation of the argument user_email leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https:
as been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.275566 - https://vuldb.com/?ctiid.275566 - https://vuldb.com/?submit.396320 - https://github.com/0xffaaa/cve/blob/main/ecommerce-Universal%20password%20bypasses%20login%20verification.md - https://www.sourcecodester.com/
CVE ID: CVE-2024-8087 State: PUBLISHED Published: 2024-08-22T23:00:06.392Z Last Updated: 2024-08-23T14:14:13.790Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: SourceCodester Products: E-Commerce System Problem Types: CWE-89 Description: A vulnerability was found in SourceCodester E-Commerce System 1.0 and classified as critical. This issue affects some unknown processing of the file /ecommerce/popup_Item.php. The manipulation of the argument id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.275567 - https://vuldb.c
be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.275567 - https://vuldb.com/?ctiid.275567 - https://vuldb.com/?submit.396321 - https://github.com/0xffaaa/cve/blob/main/ecommerce-Unauthorized%20sql%20union%20injection.md - https://www.sourcecodester.com/
CVE ID: CVE-2024-8088 State: PUBLISHED Published: 2024-08-22T18:45:31.807Z Last Updated: 2025-11-03T22:32:54.340Z Vendors: Python Software Foundation Products: CPython Problem Types: CWE-835 Description: There is a HIGH severity vulnerability affecting the CPython "zipfile" module affecting "zipfile.Path". Note that the more common API "zipfile.ZipFile" class is unaffected. When iterating over names of entries in a zip archive (for example, methods of "zipfile.Path" like "namelist()", "iterdir()", etc) the process can be put into an infinite loop with a maliciously crafted zip archive. This defect applies when reading only metadata or extracting the contents of the zip archive. Programs that
zip archive. This defect applies when reading only metadata or extracting the contents of the zip archive. Programs that are not handling user-controlled zip archives are not affected. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://mail.python.org/archives/list/security-announce@python.org/thread/GNFCKVI4TCATKQLALJ5SN4L4CSPSMILU/ - https://github.com/python/cpython/pull/122906 - https://github.com/python/cpython/issues/122905 - https://github.com/python/cpython/commit/795f2597a4be988e2bb19b69ff9958e981cb894e - https://github.com/python/cpython/commit/8c7348939d8a3ecd79d630075f6be1b0c5b41f64 - https://github.com/python/cpython/commit/dcc5182f
b.com/python/cpython/commit/8c7348939d8a3ecd79d630075f6be1b0c5b41f64 - https://github.com/python/cpython/commit/dcc5182f27c1500006a1ef78e10613bb45788dea - https://github.com/python/cpython/commit/e0264a61119d551658d9445af38323ba94fc16db - https://github.com/python/cpython/issues/123270 - https://github.com/python/cpython/commit/2231286d78d328c2f575e0b05b16fe447d1656d6 - https://github.com/python/cpython/commit/7e8883a3f04d308302361aeffc73e0e9837f19d4 - https://github.com/python/cpython/commit/95b073bddefa6243effa08e131e297c0383e7f6a - https://github.com/python/cpython/commit/7bc367e464ce50b956dd232c1dfa1cad4e7fb814 - https://github.com/python/cpython/commit/962055268ed4f2ca1d717bfc8b6385de50
t/7bc367e464ce50b956dd232c1dfa1cad4e7fb814 - https://github.com/python/cpython/commit/962055268ed4f2ca1d717bfc8b6385de50a23ab7 - https://github.com/python/cpython/commit/fc0b8259e693caa8400fa8b6ac1e494e47ea7798 - https://github.com/python/cpython/commit/0aa1ee22ab6e204e9d3d0e9dd63ea648ed691ef1 - https://github.com/python/cpython/commit/9cd03263100ddb1657826cc4a71470786cab3932
CVE ID: CVE-2024-8089 State: PUBLISHED Published: 2024-08-22T23:31:06.724Z Last Updated: 2024-08-23T15:33:06.214Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: SourceCodester Products: E-Commerce System Problem Types: CWE-434 Description: A vulnerability was found in SourceCodester E-Commerce System 1.0. It has been classified as critical. Affected is an unknown function of the file /ecommerce/admin/products/controller.php. The manipulation of the argument photo leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.c
isclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.275568 - https://vuldb.com/?ctiid.275568 - https://vuldb.com/?submit.396324 - https://github.com/0xffaaa/cve/blob/main/ecommerce-Unauthorized%20arbitrary%20file%20upload%20vulnerability.md - https://www.sourcecodester.com/
CVE ID: CVE-2024-8090 State: PUBLISHED Published: 2025-05-15T20:07:13.574Z Last Updated: 2025-05-20T19:20:15.080Z Vendors: Unknown Products: JavaScript Logic Problem Types: CWE-79 Cross-Site Scripting (XSS), CWE-352 Cross-Site Request Forgery (CSRF) Description: The JavaScript Logic WordPress plugin through 0.1 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/c9dcd450-e8ed-4058-b002-20fb3b879ee0/
CVE ID: CVE-2024-8091 State: PUBLISHED Published: 2024-09-17T06:00:06.131Z Last Updated: 2024-09-17T14:50:59.358Z Vendors: Unknown Products: Enhanced Search Box Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The Enhanced Search Box WordPress plugin through 0.6.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/1ca90b81-7539-4a15-8c5a-39a8d96a74a2/
CVE ID: CVE-2024-8092 State: PUBLISHED Published: 2024-09-17T06:00:06.467Z Last Updated: 2024-09-17T14:48:11.466Z Vendors: Unknown Products: Accordion Image Menu Problem Types: CWE-79 Cross-Site Scripting (XSS), CWE-352 Cross-Site Request Forgery (CSRF) Description: The Accordion Image Menu WordPress plugin through 3.1.3 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/d5a91ceb-8a92-4f99-b7b7-1c4e0a587022/
CVE ID: CVE-2024-8093 State: PUBLISHED Published: 2024-09-17T06:00:06.839Z Last Updated: 2024-09-17T13:53:06.906Z Vendors: Unknown Products: Posts reminder Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The Posts reminder WordPress plugin through 0.20 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/c7fd690a-5f02-491c-a3fb-6eac9ffffe96/
CVE ID: CVE-2024-8094 State: PUBLISHED Published: 2025-05-15T20:07:13.771Z Last Updated: 2025-05-20T19:20:01.105Z Vendors: Unknown Products: Ntz Antispam Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The Ntz Antispam WordPress plugin through 2.0e does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/cacfde9e-c6fa-4918-8e59-461b67b5e979/
CVE ID: CVE-2024-8095 State: PUBLISHED Published: 2025-05-15T20:07:13.968Z Last Updated: 2025-05-20T19:19:47.523Z Vendors: Unknown Products: BabelZ Problem Types: CWE-79 Cross-Site Scripting (XSS), CWE-352 Cross-Site Request Forgery (CSRF) Description: The BabelZ WordPress plugin through 1.1.5 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/56d22ad0-c5f5-488b-bc1f-73188dfc71d2/
CVE ID: CVE-2024-8096 State: PUBLISHED Published: 2024-09-11T10:03:59.489Z Last Updated: 2024-11-14T17:02:37.437Z Vendors: curl Products: curl Problem Types: CWE-295 Improper Certificate Validation Description: When curl is told to use the Certificate Status Request TLS extension, often referred to as OCSP stapling, to verify that the server certificate is valid, it might fail to detect some OCSP problems and instead wrongly consider the response as fine. If the returned status reports another error than 'revoked' (like for example 'unauthorized') it is not treated as a bad certficate. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://curl.se/d
certficate. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://curl.se/docs/CVE-2024-8096.json - https://curl.se/docs/CVE-2024-8096.html - https://hackerone.com/reports/2669852
CVE ID: CVE-2024-8097 State: PUBLISHED Published: 2024-09-11T16:32:10.475Z Last Updated: 2024-09-11T18:52:51.760Z Vendors: Payara Platform Products: Payara Server Problem Types: CWE-200 Description: Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Payara Platform Payara Server (Logging modules) allows Sensitive credentials posted in plain-text on the server log.This issue affects Payara Server: from 6.0.0 before 6.18.0, from 6.2022.1 before 6.2024.9, from 5.20.0 before 5.67.0, from 5.2020.2 before 5.2022.5, from 4.1.2.191.0 before 4.1.2.191.50. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://docs.payara.fish/community/docs/Release%20Notes/R
ditional Analyst Notes: - CISA ADP Vulnrichment: References: - https://docs.payara.fish/community/docs/Release%20Notes/Release%20Notes%206.2024.9.html - https://docs.payara.fish/enterprise/docs/Release%20Notes/Release%20Notes%206.18.0.html
CVE ID: CVE-2024-8099 State: PUBLISHED Published: 2025-03-20T10:09:47.018Z Last Updated: 2025-03-20T18:34:41.790Z Severity: HIGH (CVSS 8.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L) Vendors: vanna-ai Products: vanna-ai/vanna Problem Types: CWE-918 Description: A Server-Side Request Forgery (SSRF) vulnerability exists in the latest version of vanna-ai/vanna when using DuckDB as the database. An attacker can exploit this vulnerability by submitting crafted SQL queries that leverage DuckDB's default features, such as `read_csv`, `read_csv_auto`, `read_text`, and `read_blob`, to make unauthorized requests to internal or external resources. This can lead to unauthorized access to sensitive dat
, to make unauthorized requests to internal or external resources. This can lead to unauthorized access to sensitive data, internal systems, and potentially further attacks. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/19b96694-ed52-4ee4-8d2c-6cc7bd09c0ad
CVE ID: CVE-2024-8100 State: PUBLISHED Published: 2025-05-08T18:31:39.114Z Last Updated: 2025-05-08T18:57:09.478Z Severity: HIGH (CVSS 8.7 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N) Vendors: Arista Networks Products: CloudVision Problem Types: CWE-269 Description: On affected versions of the Arista CloudVision Portal (CVP on-prem), the time-bound device onboarding token can be used to gain admin privileges on CloudVision. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.arista.com/en/support/advisories-notices/security-advisory/21316-security-advisory-0116
CVE ID: CVE-2024-8101 State: PUBLISHED Published: 2025-03-20T10:11:29.974Z Last Updated: 2025-03-20T13:01:37.992Z Severity: HIGH (CVSS 7.2 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) Vendors: aimhubio Products: aimhubio/aim Problem Types: CWE-79 Description: A stored cross-site scripting (XSS) vulnerability exists in the Text Explorer component of aimhubio/aim version 3.23.0. The vulnerability arises due to the use of `dangerouslySetInnerHTML` without proper sanitization, allowing arbitrary JavaScript execution when rendering tracked texts. This can be exploited by injecting malicious HTML content during the training process, which is then rendered unsanitized in the Text Explorer. Additio
ing malicious HTML content during the training process, which is then rendered unsanitized in the Text Explorer. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/60cf2b93-a9a2-435e-a222-3d6abde26adb
CVE ID: CVE-2024-8102 State: PUBLISHED Published: 2024-09-04T06:49:05.286Z Last Updated: 2024-09-04T14:12:32.142Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: wpextended Products: The Ultimate WordPress Toolkit – WP Extended Problem Types: CWE-862 Description: The The Ultimate WordPress Toolkit – WP Extended plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the module_all_toggle_ajax() function in all versions up to, and including, 3.0.8. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update arbitrary options on th