Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-7693 State: PUBLISHED Published: 2024-08-12T02:44:35.620Z Last Updated: 2024-08-13T18:13:58.380Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Team Johnlong software Products: Raiden MAILD Remote Management System Problem Types: CWE-23 Description: Raiden MAILD Remote Management System from Team Johnlong Software has a Relative Path Traversal vulnerability, allowing unauthenticated remote attackers to read arbitrary file on the remote server. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-7997-31bef-1.html - https://www.twcert.org.tw/en/cp-139-7999-208bf-2.html
CVE ID: CVE-2024-7694 State: PUBLISHED Published: 2024-08-12T03:00:55.680Z Last Updated: 2024-08-12T13:55:35.017Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: TeamT5 Products: ThreatSonar Anti-Ransomware Problem Types: CWE-434 Description: ThreatSonar Anti-Ransomware from TeamT5 does not properly validate the content of uploaded files. Remote attackers with administrator privileges on the product platform can upload malicious files, which can be used to execute arbitrary system command on the server. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-7998-d76dd-1.html - https://www.twcert.org.tw/en/cp-139-80
lnrichment: References: - https://www.twcert.org.tw/tw/cp-132-7998-d76dd-1.html - https://www.twcert.org.tw/en/cp-139-8000-e5a5c-2.html
CVE ID: CVE-2024-7695 State: PUBLISHED Published: 2025-01-29T07:42:54.913Z Last Updated: 2025-02-22T14:48:56.211Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Moxa Products: PT-7728 Series, PT-7828 Series, PT-G503 Series, PT-G510 Series, PT-G7728 Series, PT-G7828 Series, EDS-608 Series, EDS-611 Series, EDS-616 Series, EDS-619 Series, EDS-405A Series, EDS-408A Series, EDS-505A Series, EDS-508A Series, EDS-510A Series, EDS-516A Series, EDS-518A Series, EDS-G509 Series, EDS-P510 Series, EDS-P510A Series, EDS-510E Series, EDS-518E Series, EDS-528E Series, EDS-G508E Series, EDS-G512E Series, EDS-G516E Series, EDS-P506E Series, ICS-G7526A Series, ICS-G7528A Serie
528E Series, EDS-G508E Series, EDS-G512E Series, EDS-G516E Series, EDS-P506E Series, ICS-G7526A Series, ICS-G7528A Series, ICS-G7748A Series, ICS-G7750A Series, ICS-G7752A Series, ICS-G7826A Series, ICS-G7828A Series, ICS-G7848A Series, ICS-G7850A Series, ICS-G7852A Series, IKS-G6524A Series, IKS-6726A Series, IKS-6728A Series, IKS-G6824A Series, SDS-3006 Series, SDS-3008 Series, SDS-3010 Series, SDS-3016 Series, SDS-G3006 Series, SDS-G3008 Series, SDS-G3010 Series, SDS-G3016 Series, TN-G4500 Series, TN-G6500 Series Problem Types: CWE-787 Description: Multiple switches are affected by an out-of-bounds write vulnerability. This vulnerability is caused by insufficient input validation, which a
affected by an out-of-bounds write vulnerability. This vulnerability is caused by insufficient input validation, which allows data to be written to memory outside the bounds of the buffer. Successful exploitation of this vulnerability could result in a denial-of-service attack. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.moxa.com/en/support/product-support/security-advisory/mpsa-240162-cve-2024-7695-out-of-bounds-write-vulnerability-identified-in-multiple-pt-switches - https://www.moxa.com/en/support/product-support/security-advisory/mpsa-240163-cve-2024-7695-out-of-bounds-write-vulnerability-in-multiple-eds,-ics,-iks,-and-sds-switches - https://www.moxa.com/
0163-cve-2024-7695-out-of-bounds-write-vulnerability-in-multiple-eds,-ics,-iks,-and-sds-switches - https://www.moxa.com/en/support/product-support/security-advisory/mpsa-240164-cve-2024-7695-out-of-bounds-write-vulnerability-identified-in-en-50155-switches
CVE ID: CVE-2024-7696 State: PUBLISHED Published: 2025-01-07T05:38:42.879Z Last Updated: 2025-01-07T15:31:07.335Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H) Vendors: Axis Communications AB Products: AXIS Camera Station Pro Problem Types: CWE-117 Description: Seth Fogie, member of AXIS Camera Station Pro Bug Bounty Program, has found that it is possible for an authenticated malicious client to tamper with audit log creation in AXIS Camera Station, or perform a Denial-of-Service attack on the AXIS Camera Station server using maliciously crafted audit log entries. Axis has released a patched version for the highlighted flaw. Please refer to the Axis security adviso
udit log entries. Axis has released a patched version for the highlighted flaw. Please refer to the Axis security advisory for more information and solution. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.axis.com/dam/public/b3/53/03/cve-2024-7696-en-US-459552.pdf
CVE ID: CVE-2024-7697 State: PUBLISHED Published: 2024-08-12T08:12:27.536Z Last Updated: 2025-09-05T06:24:38.831Z Vendors: TECNO Products: com.transsion.carlcare Problem Types: CWE-359 Description: Logical vulnerability in the mobile application (com.transsion.carlcare) may lead to user information leakage risks. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://security.tecno.com/SRC/blogdetail/294?lang=en_US - https://security.tecno.com/SRC/securityUpdates?type=SA
CVE ID: CVE-2024-7698 State: PUBLISHED Published: 2024-09-10T08:42:42.629Z Last Updated: 2025-08-22T06:21:42.084Z Severity: MEDIUM (CVSS 5.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N) Vendors: PHOENIX CONTACT Products: FL MGUARD 2102, FL MGUARD 2105, FL MGUARD 4102 PCI, FL MGUARD 4102 PCIE, FL MGUARD 4302, FL MGUARD 4305, FL MGUARD CENTERPORT VPN-1000, FL MGUARD CORE TX, FL MGUARD CORE TX VPN, FL MGUARD DELTA TX/TX, FL MGUARD DELTA TX/TX VPN, FL MGUARD GT/GT, FL MGUARD GT/GT VPN, FL MGUARD PCI4000, FL MGUARD PCI4000 VPN, FL MGUARD PCIE4000, FL MGUARD PCIE4000 VPN, FL MGUARD RS2000 TX/TX-B, FL MGUARD RS2000 TX/TX VPN, FL MGUARD RS2005 TX VPN, FL MGUARD RS4000 TX/TX, FL MGUARD RS4000 TX/TX-
ARD RS2000 TX/TX-B, FL MGUARD RS2000 TX/TX VPN, FL MGUARD RS2005 TX VPN, FL MGUARD RS4000 TX/TX, FL MGUARD RS4000 TX/TX-M, FL MGUARD RS4000 TX/TX-P, FL MGUARD RS4000 TX/TX VPN, FL MGUARD RS4004 TX/DTX, FL MGUARD RS4004 TX/DTX VPN, FL MGUARD SMART2, FL MGUARD SMART2 VPN, TC MGUARD RS2000 3G VPN, TC MGUARD RS2000 4G ATT VPN, TC MGUARD RS2000 4G VPN, TC MGUARD RS2000 4G VZW VPN, TC MGUARD RS4000 3G VPN, TC MGUARD RS4000 4G ATT VPN, TC MGUARD RS4000 4G VPN, TC MGUARD RS4000 4G VZW VPN Problem Types: CWE-201 Description: A low privileged remote attacker can get access to CSRF tokens of higher privileged users which can be abused to mount CSRF attacks. Additional Analyst Notes: - CISA ADP Vulnrich
kens of higher privileged users which can be abused to mount CSRF attacks. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert.vde.com/en/advisories/VDE-2024-039
CVE ID: CVE-2024-7699 State: PUBLISHED Published: 2024-09-10T08:42:55.635Z Last Updated: 2024-09-10T14:25:56.498Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: PHOENIX CONTACT Products: FL MGUARD 2102, FL MGUARD 2105, FL MGUARD 4102 PCI, FL MGUARD 4102 PCIE, FL MGUARD 4302, FL MGUARD 4305, FL MGUARD CENTERPORT VPN-1000, FL MGUARD CORE TX, FL MGUARD CORE TX VPN, FL MGUARD DELTA TX/TX, FL MGUARD DELTA TX/TX VPN, FL MGUARD GT/GT, FL MGUARD GT/GT VPN, FL MGUARD PCI4000, FL MGUARD PCI4000 VPN, FL MGUARD PCIE4000, FL MGUARD PCIE4000 VPN, FL MGUARD RS2000 TX/TX-B, FL MGUARD RS2000 TX/TX VPN, FL MGUARD RS2005 TX VPN, FL MGUARD RS4000 TX/TX, FL MGUARD RS4000 TX/TX-M,
D RS2000 TX/TX-B, FL MGUARD RS2000 TX/TX VPN, FL MGUARD RS2005 TX VPN, FL MGUARD RS4000 TX/TX, FL MGUARD RS4000 TX/TX-M, FL MGUARD RS4000 TX/TX-P, FL MGUARD RS4000 TX/TX VPN, FL MGUARD RS4004 TX/DTX, FL MGUARD RS4004 TX/DTX VPN, FL MGUARD SMART2, FL MGUARD SMART2 VPN, TC MGUARD RS2000 3G VPN, TC MGUARD RS2000 4G ATT VPN, TC MGUARD RS2000 4G VPN, TC MGUARD RS2000 4G VZW VPN, TC MGUARD RS4000 3G VPN, TC MGUARD RS4000 4G ATT VPN, TC MGUARD RS4000 4G VPN, TC MGUARD RS4000 4G VZW VPN Problem Types: CWE-78 Description: An low privileged remote attacker can execute OS commands with root privileges due to improper neutralization of special elements in user data. Additional Analyst Notes: - CISA ADP
h root privileges due to improper neutralization of special elements in user data. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert.vde.com/en/advisories/VDE-2024-039
CVE ID: CVE-2024-7700 State: PUBLISHED Published: 2024-08-12T16:48:54.120Z Last Updated: 2025-11-20T20:56:57.209Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H) Vendors: Red Hat Products: Red Hat Satellite 6 Problem Types: CWE-77 Description: A command injection flaw was found in the "Host Init Config" template in the Foreman application via the "Install Packages" field on the "Register Host" page. This flaw allows an attacker with the necessary privileges to inject arbitrary commands into the configuration, potentially allowing unauthorized command execution during host registration. Although this issue requires user interaction to execute injected commands, it pos
d execution during host registration. Although this issue requires user interaction to execute injected commands, it poses a significant risk if an unsuspecting user runs the generated registration script. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://access.redhat.com/security/cve/CVE-2024-7700 - https://bugzilla.redhat.com/show_bug.cgi?id=2304090
CVE ID: CVE-2024-7701 State: PUBLISHED Published: 2024-12-15T10:56:26.124Z Last Updated: 2024-12-16T16:41:35.354Z Vendors: percona Products: percona-toolkit Problem Types: CWE-916 Description: Use of Password Hash With Insufficient Computational Effort vulnerability in percona percona-toolkit allows Encryption Brute Forcing.This issue affects percona-toolkit: 3.6.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/percona/percona-toolkit/blob/aa1ac0e6889168fddf73c3a72d447e9ea0c0c63b/src/go/pt-secure-collect/encrypt.go#L17
CVE ID: CVE-2024-7702 State: PUBLISHED Published: 2024-08-20T03:21:07.859Z Last Updated: 2024-08-20T16:20:05.224Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: bitpressadmin Products: Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder Problem Types: CWE-89 Description: The Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder plugin for WordPress is vulnerable to generic SQL Injection via the entryID parameter in versions 2.0 to 2.13.9 due to insufficient escaping on the user-supplied parameter and lack of sufficient preparat
er in versions 2.0 to 2.13.9 due to insufficient escaping on the user-supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Administrator-level access and above, to append additional SQL queries to already existing queries that can be used to extract sensitive information from the database. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/07847ba1-cbce-4d81-bd24-46887ac31a5d?source=cve - https://plugins.trac.wordpress.org/browser/bit-form/trunk/includes/Admin/AdminAjax.php#L944
CVE ID: CVE-2024-7703 State: PUBLISHED Published: 2024-08-17T11:15:02.207Z Last Updated: 2024-08-19T13:45:21.844Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: reputeinfosystems Products: ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup Problem Types: CWE-79 Description: The ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 4.0.37 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Su
due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/7bd057d5-5350-43c9-abfc-34d8f6537d2e?source=cve - https://plugins.trac.wordpress.org/browser/armember-membership/trunk/core/classes/class.arm_members_activity.php#L374 - https://wordpress.org/plugins/armember-membership/#developers - https://plugins.trac.wordpress.org/changeset/3136475/
CVE ID: CVE-2024-7704 State: PUBLISHED Published: 2024-08-12T20:31:03.873Z Last Updated: 2024-08-13T14:08:11.976Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Weaver Products: e-cology Problem Types: CWE-200 Description: A vulnerability was found in Weaver e-cology 8. It has been classified as problematic. Affected is an unknown function of the file /cloudstore/ecode/setup/ecology_dev.zip of the component Source Code Handler. The manipulation leads to information disclosure. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. NOTE: The vendor was contacted early about this disclosure but did not resp
een disclosed to the public and may be used. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.274182 - https://vuldb.com/?ctiid.274182 - https://vuldb.com/?submit.385494 - https://github.com/Dreamy-elfland/240731
CVE ID: CVE-2024-7705 State: PUBLISHED Published: 2024-08-12T22:31:04.237Z Last Updated: 2024-08-13T16:07:33.370Z Severity: N/A (CVSS 5.8 AV:N/AC:L/Au:M/C:P/I:P/A:P) Vendors: Fujian Products: mwcms Problem Types: CWE-434 Description: A vulnerability was found in Fujian mwcms 1.0.0. It has been declared as critical. Affected by this vulnerability is the function uploadeditor of the file /uploadeditor.html?action=uploadimage of the component Image Upload. The manipulation of the argument upfile leads to unrestricted upload. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. NOTE: The vendor was contacted early about this disclosure but did not re
been disclosed to the public and may be used. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.274183 - https://vuldb.com/?ctiid.274183 - https://vuldb.com/?submit.385617 - https://github.com/DeepMountains/Mirage/blob/main/CVE12-1.md
CVE ID: CVE-2024-7706 State: PUBLISHED Published: 2024-08-12T22:31:05.721Z Last Updated: 2024-08-13T14:04:49.921Z Severity: N/A (CVSS 5.8 AV:N/AC:L/Au:M/C:P/I:P/A:P) Vendors: Fujian Products: mwcms Problem Types: CWE-434 Description: A vulnerability was found in Fujian mwcms 1.0.0. It has been rated as critical. Affected by this issue is the function uploadimage of the file /uploadfile.html. The manipulation of the argument upfile leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrich
was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.274184 - https://vuldb.com/?ctiid.274184 - https://vuldb.com/?submit.385651 - https://github.com/DeepMountains/Mirage/blob/main/CVE12-2.md
CVE ID: CVE-2024-7707 State: PUBLISHED Published: 2024-08-13T00:00:07.511Z Last Updated: 2024-08-14T16:11:06.129Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C) Vendors: Tenda Products: FH1206 Problem Types: CWE-121 Description: A vulnerability was found in Tenda FH1206 02.03.01.35 and classified as critical. Affected by this issue is the function formSafeEmailFilter of the file /goform/SafeEmailFilter of the component HTTP POST Request Handler. The manipulation of the argument page leads to stack-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. NOTE: The vendor was contacted early about this disclosure but did not r
s been disclosed to the public and may be used. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.274190 - https://vuldb.com/?ctiid.274190 - https://vuldb.com/?submit.385670 - https://github.com/VodkaVortex/IoT/blob/main/formSafeEmailFilter.md
CVE ID: CVE-2024-7709 State: PUBLISHED Published: 2024-08-13T00:31:05.855Z Last Updated: 2024-09-03T19:54:06.107Z Severity: N/A (CVSS 5 AV:N/AC:L/Au:N/C:N/I:P/A:N) Vendors: n/a Products: OcoMon Problem Types: CWE-79 Description: A vulnerability, which was classified as problematic, has been found in OcoMon 4.0RC1/4.0/5.0RC1. This issue affects some unknown processing of the file /includes/common/require_access_recovery.php of the component URL Handler. The manipulation leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 4.0.1 and 5.0 is able to address this issue. It is recommended to upgrade
public and may be used. Upgrading to version 4.0.1 and 5.0 is able to address this issue. It is recommended to upgrade the affected component. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.274205 - https://vuldb.com/?ctiid.274205 - https://vuldb.com/?submit.388843 - https://ocomon.com.br/site/atualizacao-de-seguranca/ - https://ocomon.com.br/site/downloads/
CVE ID: CVE-2024-7711 State: PUBLISHED Published: 2024-08-20T19:17:37.776Z Last Updated: 2024-08-20T19:46:55.283Z Vendors: GitHub Products: GitHub Enterprise Server Problem Types: CWE-863 Description: An Incorrect Authorization vulnerability was identified in GitHub Enterprise Server, allowing an attacker to update the title, assignees, and labels of any issue inside a public repository. This was only exploitable inside a public repository. This vulnerability affected GitHub Enterprise Server versions before 3.14 and was fixed in versions 3.13.3, 3.12.8, and 3.11.14. Versions 3.10 of GitHub Enterprise Server are not affected. This vulnerability was reported via the GitHub Bug Bounty program.
ns 3.10 of GitHub Enterprise Server are not affected. This vulnerability was reported via the GitHub Bug Bounty program. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://docs.github.com/en/enterprise-server@3.13/admin/release-notes#3.13.3 - https://docs.github.com/en/enterprise-server@3.12/admin/release-notes#3.12.8 - https://docs.github.com/en/enterprise-server@3.11/admin/release-notes#3.11.14
CVE ID: CVE-2024-7712 State: REJECTED Published: N/A Last Updated: 2024-08-30T15:30:45.693Z Description: No description available.
CVE ID: CVE-2024-7713 State: PUBLISHED Published: 2024-09-27T06:00:05.128Z Last Updated: 2025-08-27T12:01:00.920Z Vendors: Unknown Products: AI ChatBot with ChatGPT and Content Generator by AYS Problem Types: CWE-201 Insertion of Sensitive Information Into Sent Data Description: The AI ChatBot with ChatGPT and Content Generator by AYS WordPress plugin before 2.1.0 discloses the Open AI API Key, allowing unauthenticated users to obtain it Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/061eab97-4a84-4738-a1e8-ef9a1261ff73/
CVE ID: CVE-2024-7714 State: PUBLISHED Published: 2024-09-27T06:00:06.287Z Last Updated: 2025-08-27T12:00:34.973Z Vendors: Unknown Products: AI ChatBot with ChatGPT and Content Generator by AYS Problem Types: CWE-862 Missing Authorization Description: The AI ChatBot with ChatGPT and Content Generator by AYS WordPress plugin before 2.1.0 lacks sufficient access controls allowing an unauthenticated user to disconnect the AI ChatBot with ChatGPT and Content Generator by AYS WordPress plugin before 2.1.0 from OpenAI, thereby disabling the AI ChatBot with ChatGPT and Content Generator by AYS WordPress plugin before 2.1.0. Multiple actions are accessible: 'ays_chatgpt_disconnect', 'ays_chatgpt_con
erator by AYS WordPress plugin before 2.1.0. Multiple actions are accessible: 'ays_chatgpt_disconnect', 'ays_chatgpt_connect', and 'ays_chatgpt_save_feedback' Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/04447c76-a61b-4091-a510-c76fc8ca5664/
CVE ID: CVE-2024-7715 State: PUBLISHED Published: 2024-08-13T06:31:04.655Z Last Updated: 2024-08-15T14:28:38.576Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: D-Link Products: DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05, DNS-1550-04 Problem Types: CWE-77 Description: ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up
, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20240812. It has been classified as critical. This affects the function sprintf of the file /cgi-bin/photocenter_mgr.cgi. The manipulation of the argument filter leads to command injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: Vendor was contacted early and confirmed that the product is end-of-life. It should be retired and replaced. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - h
ct is end-of-life. It should be retired and replaced. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.274281 - https://vuldb.com/?ctiid.274281 - https://vuldb.com/?submit.389261 - https://github.com/BuaaIOTTeam/Iot_Dlink_NAS/blob/main/DNS_cgi_photo_search.md - https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10383
CVE ID: CVE-2024-7716 State: PUBLISHED Published: 2024-09-11T06:00:02.104Z Last Updated: 2024-09-11T15:15:11.391Z Vendors: Unknown Products: Logo Slider Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Logo Slider WordPress plugin before 3.6.9 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/cfa67c43-6f09-43f5-9fbe-32a98a82f548/
CVE ID: CVE-2024-7717 State: PUBLISHED Published: 2024-08-31T08:35:19.104Z Last Updated: 2024-09-03T14:18:31.310Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: thimpress Products: WP Events Manager Problem Types: CWE-89 Description: The WP Events Manager plugin for WordPress is vulnerable to time-based SQL Injection via the ‘order’ parameter in all versions up to, and including, 2.1.11 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries