Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
o improper sanitization of user input passed to the os.path.join function, which can be exploited to access files outside the intended directory. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/7cd8f519-7c75-4936-889d-a17ea1bcb3ea
CVE ID: CVE-2024-8551 State: PUBLISHED Published: 2025-03-20T10:10:21.361Z Last Updated: 2025-10-15T12:50:41.115Z Severity: CRITICAL (CVSS 9.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H) Vendors: modelscope Products: modelscope/agentscope Problem Types: CWE-23 Description: A path traversal vulnerability exists in the save-workflow and load-workflow functionality of modelscope/agentscope versions prior to the fix. This vulnerability allows an attacker to read and write arbitrary JSON files on the filesystem, potentially leading to the exposure or modification of sensitive information such as configuration files, API keys, and hardcoded passwords. Additional Analyst Notes: - CISA ADP Vulnric
information such as configuration files, API keys, and hardcoded passwords. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/e0c0c294-f1e2-4f2c-a632-a9be9fd06989
CVE ID: CVE-2024-8552 State: PUBLISHED Published: 2024-09-26T02:03:24.869Z Last Updated: 2024-09-26T14:56:16.845Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: wpchill Products: Download Monitor Problem Types: CWE-862 Description: The Download Monitor plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the enable_shop() function in all versions up to, and including, 5.0.9. This makes it possible for authenticated attackers, with Subscriber-level access and above, to enable shop functionality. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulne
tionality. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/3acaedff-f616-4b66-9208-f7e6a4df920d?source=cve - https://plugins.trac.wordpress.org/browser/download-monitor/tags/5.0.8/src/AjaxHandler.php#L317 - https://plugins.trac.wordpress.org/changeset/3157424/#file17
CVE ID: CVE-2024-8553 State: PUBLISHED Published: 2024-10-31T15:01:16.401Z Last Updated: 2025-11-11T16:10:06.757Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: Red Hat Products: Red Hat Satellite 6.13 for RHEL 8, Red Hat Satellite 6.14 for RHEL 8, Red Hat Satellite 6.15 for RHEL 8, Red Hat Satellite 6.16 for RHEL 8, Red Hat Satellite 6.16 for RHEL 9 Problem Types: CWE-200 Description: A vulnerability was found in Foreman's loader macros introduced with report templates. These macros may allow an authenticated user with permissions to view and create templates to read any field from Foreman's database. By using specific strings in the loader macros, users c
and create templates to read any field from Foreman's database. By using specific strings in the loader macros, users can bypass permissions and access sensitive information. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://access.redhat.com/errata/RHSA-2024:8717 - https://access.redhat.com/errata/RHSA-2024:8718 - https://access.redhat.com/errata/RHSA-2024:8719 - https://access.redhat.com/errata/RHSA-2024:8906 - https://access.redhat.com/security/cve/CVE-2024-8553 - https://bugzilla.redhat.com/show_bug.cgi?id=2312524
CVE ID: CVE-2024-8554 State: PUBLISHED Published: 2024-09-07T13:31:05.079Z Last Updated: 2024-09-09T14:07:11.246Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: SourceCodester Products: Clinics Patient Management System Problem Types: CWE-79 Description: A vulnerability was found in SourceCodester Clinics Patient Management System 2.0 and classified as problematic. This issue affects some unknown processing of the file /users.php. The manipulation of the argument message leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.co
sclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.276773 - https://vuldb.com/?ctiid.276773 - https://vuldb.com/?submit.402384 - https://github.com/gurudattch/CVEs/blob/main/Sourcecodester-Clinic's-Patient-Management-System-Reflected-XSS.md - https://www.sourcecodester.com/
CVE ID: CVE-2024-8555 State: PUBLISHED Published: 2024-09-07T14:31:04.341Z Last Updated: 2024-09-09T15:13:49.072Z Severity: N/A (CVSS 5 AV:N/AC:L/Au:N/C:N/I:P/A:N) Vendors: SourceCodester Products: Clinics Patient Management System Problem Types: CWE-601 Description: A vulnerability was found in SourceCodester Clinics Patient Management System 2.0. It has been classified as problematic. Affected is an unknown function of the file congratulations.php. The manipulation of the argument goto_page leads to open redirect. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https
has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.276774 - https://vuldb.com/?ctiid.276774 - https://vuldb.com/?submit.402386 - https://github.com/gurudattch/CVEs/blob/main/Sourcecodester-Clinic's-Patient-Management-System-Open-Redirect.md - https://www.sourcecodester.com/
CVE ID: CVE-2024-8556 State: PUBLISHED Published: 2025-03-20T10:11:21.587Z Last Updated: 2025-03-20T13:05:54.203Z Severity: MEDIUM (CVSS 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: modelscope Products: modelscope/agentscope Problem Types: CWE-79 Description: A stored cross-site scripting (XSS) vulnerability exists in modelscope/agentscope, as of the latest commit 21161fe on the main branch. The vulnerability occurs in the view for inspecting detailed run information, where a user-controllable string (run ID) is appended and rendered as HTML. This allows an attacker to execute arbitrary JavaScript code in the context of the user's browser. Additional Analyst Notes: - CISA ADP V
tacker to execute arbitrary JavaScript code in the context of the user's browser. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/8439f16b-5256-4466-bb7d-371572572a4b
CVE ID: CVE-2024-8557 State: PUBLISHED Published: 2024-09-07T15:00:05.934Z Last Updated: 2024-09-09T17:46:31.544Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: SourceCodester Products: Food Ordering Management System Problem Types: CWE-89 Description: A vulnerability classified as critical has been found in SourceCodester Food Ordering Management System 1.0. This affects an unknown part of the file /foms/routers/cancel-order.php. The manipulation of the argument id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.co
sclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.276777 - https://vuldb.com/?ctiid.276777 - https://vuldb.com/?submit.403082 - https://github.com/tldjgggg/cve/blob/main/sql2.md - https://www.sourcecodester.com/
CVE ID: CVE-2024-8558 State: PUBLISHED Published: 2024-09-07T15:31:04.463Z Last Updated: 2024-09-09T18:20:23.290Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: SourceCodester Products: Food Ordering Management System Problem Types: CWE-1284 Description: A vulnerability classified as problematic was found in SourceCodester Food Ordering Management System 1.0. This vulnerability affects unknown code of the file /foms/routers/place-order.php of the component Price Handler. The manipulation of the argument total leads to improper validation of specified quantity in input. The attack can be initiated remotely. The exploit has been disclosed to the public and ma
f specified quantity in input. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.276778 - https://vuldb.com/?ctiid.276778 - https://vuldb.com/?submit.403345 - https://github.com/Niu-zida/cve/blob/main/Payment%20loopholes.md - https://www.sourcecodester.com/
CVE ID: CVE-2024-8559 State: PUBLISHED Published: 2024-09-07T17:31:07.138Z Last Updated: 2024-09-09T18:20:53.212Z Severity: N/A (CVSS 5.8 AV:N/AC:L/Au:M/C:P/I:P/A:P) Vendors: SourceCodester Products: Online Food Menu Problem Types: CWE-89 Description: A vulnerability, which was classified as critical, has been found in SourceCodester Online Food Menu 1.0. This issue affects some unknown processing of the file /endpoint/delete-menu.php. The manipulation of the argument menu leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.276779 - ht
blic and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.276779 - https://vuldb.com/?ctiid.276779 - https://vuldb.com/?submit.403497 - https://www.sourcecodester.com/
CVE ID: CVE-2024-8560 State: PUBLISHED Published: 2024-09-07T18:00:04.648Z Last Updated: 2024-09-09T18:21:29.170Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: SourceCodester Products: Simple Invoice Generator System Problem Types: CWE-89 Description: A vulnerability, which was classified as critical, was found in SourceCodester Simple Invoice Generator System 1.0. Affected is an unknown function of the file /save_invoice.php. The manipulation of the argument invoice_code/customer/cashier/total_amount/discount_percentage/discount_amount/tendered_amount leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be
to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.276780 - https://vuldb.com/?ctiid.276780 - https://vuldb.com/?submit.403629 - https://www.sourcecodester.com/
CVE ID: CVE-2024-8561 State: PUBLISHED Published: 2024-09-07T18:31:03.892Z Last Updated: 2024-09-09T18:30:30.365Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: SourceCodester Products: PHP CRUD Problem Types: CWE-89 Description: A vulnerability has been found in SourceCodester PHP CRUD 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /endpoint/delete.php of the component Delete Person Handler. The manipulation of the argument person leads to sql injection. The attack can be launched remotely. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.276781 - https://vuldb.com/?ctiid.276781 - htt
alyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.276781 - https://vuldb.com/?ctiid.276781 - https://vuldb.com/?submit.403651 - https://www.sourcecodester.com/
CVE ID: CVE-2024-8562 State: PUBLISHED Published: 2024-09-07T19:00:05.069Z Last Updated: 2024-09-09T18:30:56.902Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: SourceCodester Products: PHP CRUD Problem Types: CWE-79 Description: A vulnerability was found in SourceCodester PHP CRUD 1.0 and classified as problematic. Affected by this issue is some unknown functionality of the file /endpoint/Add.php. The manipulation of the argument first_name/middle_name/last_name leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.276
o the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.276782 - https://vuldb.com/?ctiid.276782 - https://www.sourcecodester.com/
CVE ID: CVE-2024-8563 State: PUBLISHED Published: 2024-09-07T20:00:04.571Z Last Updated: 2024-09-09T13:35:27.828Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: SourceCodester Products: PHP CRUD Problem Types: CWE-79 Description: A vulnerability was found in SourceCodester PHP CRUD 1.0. It has been classified as problematic. This affects an unknown part of the file /endpoint/update.php. The manipulation of the argument first_name/middle_name/last_name leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.2767
the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.276783 - https://vuldb.com/?ctiid.276783 - https://vuldb.com/?submit.403661 - https://www.sourcecodester.com/
CVE ID: CVE-2024-8564 State: PUBLISHED Published: 2024-09-07T20:31:03.916Z Last Updated: 2024-09-09T13:33:44.484Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: SourceCodester Products: PHP CRUD Problem Types: CWE-89 Description: A vulnerability was found in SourceCodester PHP CRUD 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /endpoint/update.php. The manipulation of the argument tbl_person_id/first_name/middle_name/last_name leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id
ed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.276784 - https://vuldb.com/?ctiid.276784 - https://vuldb.com/?submit.403662 - https://www.sourcecodester.com/
CVE ID: CVE-2024-8565 State: PUBLISHED Published: 2024-09-07T22:31:04.048Z Last Updated: 2024-09-09T19:23:51.503Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: SourceCodesters Products: Clinics Patient Management System Problem Types: CWE-89 Description: A vulnerability was found in SourceCodesters Clinics Patient Management System 2.0. It has been rated as critical. This issue affects some unknown processing of the file /print_diseases.php. The manipulation of the argument disease/from/to leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - h
oit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.276785 - https://vuldb.com/?ctiid.276785 - https://vuldb.com/?submit.402425 - https://github.com/gurudattch/CVEs/blob/main/Sourcecodester-Clinic's-Patient-Management-System-SQLi.md
CVE ID: CVE-2024-8566 State: PUBLISHED Published: 2024-09-07T23:31:05.821Z Last Updated: 2024-09-09T19:24:58.351Z Severity: N/A (CVSS 5 AV:N/AC:L/Au:N/C:N/I:P/A:N) Vendors: code-projects Products: Online Shop Store Problem Types: CWE-79 Description: A vulnerability classified as problematic was found in code-projects Online Shop Store 1.0. This vulnerability affects unknown code of the file /settings.php. The manipulation of the argument error leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.276796 - https://vuldb.com/?ctiid.
dditional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.276796 - https://vuldb.com/?ctiid.276796 - https://vuldb.com/?submit.403671 - https://drive.google.com/file/d/1MmShihcKuzB9Sw54asriKkRKvdUD8-Ag/view?usp=sharing - https://code-projects.org/
CVE ID: CVE-2024-8567 State: PUBLISHED Published: 2024-09-08T01:31:05.125Z Last Updated: 2024-09-09T19:26:14.584Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: itsourcecode Products: Payroll Management System Problem Types: CWE-89 Description: A vulnerability, which was classified as critical, has been found in itsourcecode Payroll Management System 1.0. This issue affects some unknown processing of the file /ajax.php?action=delete_deductions. The manipulation of the argument id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuld
n disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.276797 - https://vuldb.com/?ctiid.276797 - https://vuldb.com/?submit.403998 - https://github.com/ppp-src/ha/issues/8 - https://itsourcecode.com/
CVE ID: CVE-2024-8568 State: PUBLISHED Published: 2024-09-08T02:31:13.759Z Last Updated: 2024-09-09T14:40:52.935Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: n/a Products: Mini-Tmall Problem Types: CWE-89 Description: A vulnerability, which was classified as critical, was found in Mini-Tmall up to 20240901. Affected is the function rewardMapper.select of the file tmall/admin/order/1/1. The manipulation of the argument orderBy leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP
he vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.276798 - https://vuldb.com/?ctiid.276798 - https://vuldb.com/?submit.401010 - https://gitee.com/A0kooo/cve_article/blob/master/Mini-Tmall/Tmall_demo%20OrderController.java%20SQL%20Injection.md
CVE ID: CVE-2024-8569 State: PUBLISHED Published: 2024-09-08T05:00:04.302Z Last Updated: 2024-09-09T19:27:07.738Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: code-projects Products: Hospital Management System Problem Types: CWE-89 Description: A vulnerability has been found in code-projects Hospital Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file user-login.php. The manipulation of the argument username leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.c
isclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.276799 - https://vuldb.com/?ctiid.276799 - https://vuldb.com/?submit.403125 - https://github.com/teachersongsec/cve/issues/1 - https://code-projects.org/
CVE ID: CVE-2024-8570 State: PUBLISHED Published: 2024-09-08T06:31:04.811Z Last Updated: 2024-09-09T14:50:06.466Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: itsourcecode Products: Tailoring Management System Problem Types: CWE-89 Description: A vulnerability was found in itsourcecode Tailoring Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /inccatadd.php. The manipulation of the argument title leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.276800
e public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.276800 - https://vuldb.com/?ctiid.276800 - https://vuldb.com/?submit.403126 - https://github.com/teachersongsec/cve/issues/2 - https://itsourcecode.com/
CVE ID: CVE-2024-8571 State: PUBLISHED Published: 2024-09-08T07:31:04.205Z Last Updated: 2024-09-09T14:55:49.858Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: erjemin Products: roll_cms Problem Types: CWE-209 Description: A vulnerability was found in erjemin roll_cms up to 1484fe2c4e0805946a7bcf46218509fcb34883a9. It has been classified as problematic. This affects an unknown part of the file roll_cms/roll_cms/views.py. The manipulation leads to information exposure through error message. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. Addition
to provide continious delivery. Therefore, version details for affected and updated releases are not available. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.276801 - https://vuldb.com/?ctiid.276801 - https://vuldb.com/?submit.400796 - https://github.com/erjemin/roll_cms/issues/1
CVE ID: CVE-2024-8572 State: PUBLISHED Published: 2024-09-08T08:00:05.183Z Last Updated: 2024-09-10T14:17:01.889Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: Gouniverse Products: GoLang CMS Problem Types: CWE-79 Description: A vulnerability was found in Gouniverse GoLang CMS 1.4.0. It has been declared as problematic. This vulnerability affects the function PageRenderHtmlByAlias of the file FrontendHandler.go. The manipulation of the argument alias leads to cross site scripting. The attack can be initiated remotely. Upgrading to version 1.4.1 is able to address this issue. The patch is identified as 3e661cdfb4beeb9fe2ad507cdb8104c0b17d072c. It is recommended to upgrade the aff
ss this issue. The patch is identified as 3e661cdfb4beeb9fe2ad507cdb8104c0b17d072c. It is recommended to upgrade the affected component. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.276802 - https://vuldb.com/?ctiid.276802 - https://vuldb.com/?submit.401896 - https://github.com/gouniverse/cms/issues/5 - https://github.com/gouniverse/cms/issues/5#issuecomment-2330848731 - https://github.com/gouniverse/cms/commit/3e661cdfb4beeb9fe2ad507cdb8104c0b17d072c - https://github.com/gouniverse/cms/releases/tag/v1.4.1
CVE ID: CVE-2024-8573 State: PUBLISHED Published: 2024-09-08T10:00:06.219Z Last Updated: 2025-03-03T18:05:09.848Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C) Vendors: TOTOLINK Products: AC1200 T8, AC1200 T10 Problem Types: CWE-120, CWE-119 Description: A vulnerability, which was classified as critical, was found in TOTOLINK AC1200 T8 and AC1200 T10 4.1.5cu.861_B20230220/4.1.8cu.5207. This affects the function setParentalRules of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument desc/week/sTime/eTime leads to buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as w
e attack remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.276807 - https://vuldb.com/?ctiid.276807 - https://vuldb.com/?submit.401262 - https://github.com/noahze01/IoT-vulnerable/blob/main/TOTOLink/AC1200T8/setParentalRules.md - https://www.totolink.net/
CVE ID: CVE-2024-8574 State: PUBLISHED Published: 2024-09-08T11:00:06.220Z Last Updated: 2024-09-10T14:47:43.829Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: TOTOLINK Products: AC1200 T8 Problem Types: CWE-78 Description: A vulnerability has been found in TOTOLINK AC1200 T8 4.1.5cu.861_B20230220 and classified as critical. This vulnerability affects the function setParentalRules of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument slaveIpList leads to os command injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additi