Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-51152 State: PUBLISHED Published: 2024-11-08T00:00:00 Last Updated: 2024-11-13T15:06:22.177Z Vendors: n/a Products: n/a Problem Types: n/a Description: File Upload vulnerability in Laravel CMS v.1.4.7 and before allows a remote attacker to execute arbitrary code via the shell.php a component. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://co-a1natas.feishu.cn/docx/GuYjd2lDEoxNhVxPa9Yc1akknee
CVE ID: CVE-2024-51156 State: PUBLISHED Published: 2024-11-14T00:00:00 Last Updated: 2024-11-18T18:10:08.440Z Vendors: n/a Products: n/a Problem Types: n/a Description: 07FLYCMS V1.3.9 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component 'erp.07fly.net:80/admin/SysNotifyUser/del.html?id=93'. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/SamParkerXd/cms/tree/main/1
CVE ID: CVE-2024-51157 State: PUBLISHED Published: 2024-11-08T00:00:00 Last Updated: 2024-11-18T14:13:04.340Z Vendors: n/a Products: n/a Problem Types: n/a Description: 07FLYCMS V1.3.9 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component http://erp.07fly.net:80/oa/OaSchedule/add.html. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/xiaoyunzhui/cms/blob/main/2/readme.md
CVE ID: CVE-2024-51162 State: PUBLISHED Published: 2024-11-20T00:00:00.000Z Last Updated: 2025-03-17T14:54:44.452Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in Audimex EE versions 15.1.20 and earlier allowing a remote attacker to escalate privileges. Analyzing the offline client code, it was identified that it is possible for any user (with any privilege) of Audimex to dump the whole Audimex database. This gives visibility upon password hashes of any user, ongoing audit data and more. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Cameleon037/CVEs/blob/main/CVE-2024-51162/README.md - https://en.web-audimex.com/ee-auditmanagement
https://github.com/Cameleon037/CVEs/blob/main/CVE-2024-51162/README.md - https://en.web-audimex.com/ee-auditmanagement - https://github.com/Henkel-CyberVM/CVEs/tree/main/CVE-2024-51162
CVE ID: CVE-2024-51163 State: PUBLISHED Published: 2024-11-20T00:00:00.000Z Last Updated: 2025-03-18T18:33:49.067Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Local File Inclusion vulnerability in Vegam Solutions Vegam 4i versions 6.3.47.0 and earlier allows a remote attacker to obtain sensitive information through the print label function. Specifically, the filePathList parameter is susceptible to LFI, enabling a malicious user to include files from the web server, such as web.config or /etc/host, leading to the disclosure of sensitive information. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/rahulkadavil/CVEs/tree/main/CVE-2024-51163
nal Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/rahulkadavil/CVEs/tree/main/CVE-2024-51163 - https://github.com/Henkel-CyberVM/CVEs/tree/main/CVE-2024-51163
CVE ID: CVE-2024-51164 State: PUBLISHED Published: 2024-11-15T00:00:00 Last Updated: 2025-01-06T17:56:54.163Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple parameters have SQL injection vulnerability in JEPaaS 7.2.8 via /je/login/btnLog/insertBtnLog, which could allow a remote user to submit a specially crafted query, allowing an attacker to retrieve all the information stored in the DB. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/abcc111/vulns/blob/main/JEPaaS/Multiple%20parameters%20have%20SQL%20injection%20issues%20in%20JEPAAS.md - https://gitee.com/ketr/jepaas-release - https://abcc111.github.io/posts/CVE-2024-51164/
CVE ID: CVE-2024-51165 State: PUBLISHED Published: 2024-12-10T00:00:00 Last Updated: 2024-12-11T14:51:11.291Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in JEPAAS7.2.8, via /je/rbac/rbac/loadLoginCount in the dateVal parameter, which could allow a remote user to submit a specially crafted query, allowing an attacker to retrieve all the information stored in the DB. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/abcc111/vulns/blob/main/JEPaaS/SQL%20injection%20vulnerability%20in%20JEPaaS.md - https://abcc111.github.io/posts/CVE-2024-51165/
CVE ID: CVE-2024-51175 State: PUBLISHED Published: 2024-12-17T00:00:00 Last Updated: 2024-12-18T15:43:08.478Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in H3C switch h3c-S1526 allows a remote attacker to obtain sensitive information via the S1526.cfg component. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/a1drewlong/h3c-S1526/blob/main/Vulnerability%20Cases.md
CVE ID: CVE-2024-51179 State: PUBLISHED Published: 2024-11-12T00:00:00 Last Updated: 2024-11-13T19:58:02.629Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in Open 5GS v.2.7.1 allows a remote attacker to cause a denial of service via the Network Function Virtualizations (NFVs) such as the User Plane Function (UPF) and the Session Management Function (SMF), The Packet Data Unit (PDU) session establishment process. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Lakshmirnr/CVE-2024-51179
CVE ID: CVE-2024-51180 State: PUBLISHED Published: 2024-10-29T00:00:00 Last Updated: 2024-10-29T20:10:09.383Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Reflected Cross Site Scripting (XSS) vulnerability was found in /ifscfinder/index.php in PHPGurukul IFSC Code Finder Project v1.0, which allows remote attackers to execute arbitrary code via the "searchifsccode" parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Santoshcyber1/CVE-wirteup/blob/main/Phpgurukul/IFSC%20Code%20Finder/IFSC%20Code%20Finder%20do.pdf
CVE ID: CVE-2024-51181 State: PUBLISHED Published: 2024-10-29T00:00:00 Last Updated: 2024-10-29T20:09:17.898Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Reflected Cross Site Scripting (XSS) vulnerability was found in /ifscfinder/admin/profile.php in PHPGurukul IFSC Code Finder Project v1.0, which allows remote attackers to execute arbitrary code via " searchifsccode" parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Santoshcyber1/CVE-wirteup/blob/main/Phpgurukul/IFSC%20Code%20Finder/IFSC%20Code%20Finder%20Admin.pdf
CVE ID: CVE-2024-51182 State: PUBLISHED Published: 2025-01-29T00:00:00.000Z Last Updated: 2025-01-30T16:34:46.760Z Vendors: n/a Products: n/a Problem Types: n/a Description: HTML Injection vulnerability in Celk Sistemas Celk Saude v.3.1.252.1 allows a remote attacker to inject arbitrary HTML code via the "erro" parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/gabriel-bri/vulnerability-research/tree/main/CVE-2024-51182
CVE ID: CVE-2024-51186 State: PUBLISHED Published: 2024-11-11T00:00:00 Last Updated: 2024-11-12T19:07:58.571Z Vendors: n/a Products: n/a Problem Types: n/a Description: D-Link DIR-820L 1.05b03 was discovered to contain a remote code execution (RCE) vulnerability via the ping_addr parameter in the ping_v4 and ping_v6 functions. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.dlink.com/en/security-bulletin/ - https://www.dlink.com/en - https://legacy.us.dlink.com/pages/product.aspx?id=00c2150966b046b58ba95d8ae3a8f73d - https://github.com/4hsien/CVE-vulns/blob/main/D-Link/DIR-820L/CI_ping_addr/README.md
CVE ID: CVE-2024-51187 State: PUBLISHED Published: 2024-11-11T00:00:00 Last Updated: 2024-11-12T01:59:15.239Z Vendors: n/a Products: n/a Problem Types: n/a Description: TRENDnet TEW-651BR 2.04B1, TEW-652BRP 3.04b01, and TEW-652BRU 1.00b12 devices contain a Store Cross-site scripting (XSS) vulnerability via the firewallRule_Name_1.1.1.0.0 parameter on the /firewall_setting.htm page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.trendnet.com/products/product-detail?prod=245_TEW-652BRU - https://www.trendnet.com/products/product-detail?prod=235_TEW-651BR - https://www.trendnet.com/products/product-detail?prod=235_TEW-652BRP - https://github.com/4hsien/CVE-vulns/bl
EW-651BR - https://www.trendnet.com/products/product-detail?prod=235_TEW-652BRP - https://github.com/4hsien/CVE-vulns/blob/main/TRENDnet/TEW-652BRP/XSS_Firewall_Rule/README.md
CVE ID: CVE-2024-51188 State: PUBLISHED Published: 2024-11-11T00:00:00 Last Updated: 2024-11-12T01:58:54.182Z Vendors: n/a Products: n/a Problem Types: n/a Description: TRENDnet TEW-651BR 2.04B1, TEW-652BRP 3.04b01, and TEW-652BRU 1.00b12 devices contain a Store Cross-site scripting (XSS) vulnerability via the vsRule_VirtualServerName_1.1.10.0.0 parameter on the /virtual_server.htm page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.trendnet.com/products/product-detail?prod=245_TEW-652BRU - https://www.trendnet.com/products/product-detail?prod=235_TEW-651BR - https://www.trendnet.com/products/product-detail?prod=235_TEW-652BRP - https://github.com/4hsien/CVE-vu
=235_TEW-651BR - https://www.trendnet.com/products/product-detail?prod=235_TEW-652BRP - https://github.com/4hsien/CVE-vulns/blob/main/TRENDnet/TEW-652BRP/XSS_Virtual_Server/README.md
CVE ID: CVE-2024-51189 State: PUBLISHED Published: 2024-11-11T00:00:00 Last Updated: 2024-11-12T01:57:03.331Z Vendors: n/a Products: n/a Problem Types: n/a Description: TRENDnet TEW-651BR 2.04B1, TEW-652BRP 3.04b01, and TEW-652BRU 1.00b12 devices contain a Store Cross-site scripting (XSS) vulnerability via the macList_Name_1.1.1.0.0 parameter on the /filters.htm page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.trendnet.com/products/product-detail?prod=245_TEW-652BRU - https://www.trendnet.com/products/product-detail?prod=235_TEW-651BR - https://www.trendnet.com/products/product-detail?prod=235_TEW-652BRP - https://github.com/4hsien/CVE-vulns/blob/main/TRENDn
ps://www.trendnet.com/products/product-detail?prod=235_TEW-652BRP - https://github.com/4hsien/CVE-vulns/blob/main/TRENDnet/TEW-652BRP/XSS_Filter/README.md
CVE ID: CVE-2024-51190 State: PUBLISHED Published: 2024-11-11T00:00:00 Last Updated: 2024-11-12T01:58:32.502Z Vendors: n/a Products: n/a Problem Types: n/a Description: TRENDnet TEW-651BR 2.04B1, TEW-652BRP 3.04b01, and TEW-652BRU 1.00b12 devices contain a Store Cross-site scripting (XSS) vulnerability via the ptRule_ApplicationName_1.1.6.0.0 parameter on the /special_ap.htm page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.trendnet.com/products/product-detail?prod=245_TEW-652BRU - https://www.trendnet.com/products/product-detail?prod=235_TEW-651BR - https://www.trendnet.com/products/product-detail?prod=235_TEW-652BRP - https://github.com/4hsien/CVE-vulns/blo
W-651BR - https://www.trendnet.com/products/product-detail?prod=235_TEW-652BRP - https://github.com/4hsien/CVE-vulns/blob/main/TRENDnet/TEW-652BRP/XSS_Special_AP/README.md
CVE ID: CVE-2024-51208 State: PUBLISHED Published: 2024-11-20T00:00:00.000Z Last Updated: 2025-03-13T16:16:25.758Z Vendors: n/a Products: n/a Problem Types: n/a Description: File Upload vulnerability in change-image.php in Anuj Kumar's Boat Booking System version 1.0 allows local attackers to upload a malicious PHP script via the Image Upload Mechanism parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://phpgurukul.com/boat-booking-system-using-php-and-mysql/ - https://gist.github.com/Esquirez/985db6c65219a3e5a6521e291524aaa0
CVE ID: CVE-2024-51209 State: PUBLISHED Published: 2024-11-20T00:00:00 Last Updated: 2024-11-20T20:57:53.683Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-Site Scripting (XSS) vulnerabilities in Anuj Kumar's Client Management System Version 1.2 allow local attackers to inject arbitrary web script or HTML via the search input field parameter to admin search invoice page and client search invoice page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://phpgurukul.com/client-management-system-using-php-mysql/ - https://gist.github.com/Esquirez/0c41e0279ca11d9bfc52c3938041d935
CVE ID: CVE-2024-51210 State: PUBLISHED Published: 2024-12-04T00:00:00 Last Updated: 2024-12-05T17:13:13.998Z Vendors: n/a Products: n/a Problem Types: n/a Description: Firepad through 1.5.11 allows remote attackers, who have knowledge of a pad ID, to retrieve both the current text of a document and all content that has previously been pasted into the document. NOTE: in several similar products, this is the intentional behavior for anyone who knows the full document ID and corresponding URL. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://medium.com/@adityaahuja.work/access
maintainer. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://medium.com/@adityaahuja.work/accessing-full-history-of-firepad-users-ddc889e73936 - https://firebase.blog/posts/2013/04/announcing-firepad-our-open-source/ - https://github.com/FirebaseExtended/firepad/releases/tag/v1.5.11
CVE ID: CVE-2024-51211 State: PUBLISHED Published: 2024-11-08T00:00:00 Last Updated: 2024-11-21T16:24:26.645Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability exists in OS4ED openSIS-Classic Version 9.1, specifically in the resetuserinfo.php file. The vulnerability is due to improper input validation of the $username_stn_id parameter, which can be manipulated by an attacker to inject arbitrary SQL commands. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/kutsa1/My-CVE/tree/main/CVE-2024-51211
CVE ID: CVE-2024-51213 State: PUBLISHED Published: 2024-11-11T00:00:00 Last Updated: 2024-11-12T17:55:59.658Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting vulnerability in Online Shop Store v.1.0 allows a remote attacker to execute arbitrary code via the login.php component. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Prabhatsk7/CVE/blob/main/CVE-2024-51213
CVE ID: CVE-2024-51228 State: PUBLISHED Published: 2024-11-27T00:00:00 Last Updated: 2024-11-29T19:37:04.757Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in TOTOLINK-CX-A3002RU V1.0.4-B20171106.1512 and TOTOLINK-CX-N150RT V2.1.6-B20171121.1002 and TOTOLINK-CX-N300RT V2.1.6-B20170724.1420 and TOTOLINK-CX-N300RT V2.1.8-B20171113.1408 and TOTOLINK-CX-N300RT V2.1.8-B20191010.1107 and TOTOLINK-CX-N302RE V2.0.2-B20170511.1523 allows a remote attacker to execute arbitrary code via the /boafrm/formSysCmd component. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.totolink.tw/products_view/N302RE - https://www.totolink.tw/products_view/N300RT - http
chment: References: - https://www.totolink.tw/products_view/N302RE - https://www.totolink.tw/products_view/N300RT - https://totolink.tw/support_view/A3002RU - https://totolink.tw/support_view/N150RT - https://github.com/yckuo-sdc/totolink-boa-api-vulnerabilities
CVE ID: CVE-2024-51229 State: PUBLISHED Published: 2025-01-09T00:00:00 Last Updated: 2025-01-10T15:34:14.720Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting vulnerability in LinZhaoguan pb-cms v.2.0 allows a remote attacker to execute arbitrary code via the theme management function. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitee.com/LinZhaoguan/pb-cms/issues/IAYHUP
CVE ID: CVE-2024-51240 State: PUBLISHED Published: 2024-11-05T00:00:00 Last Updated: 2024-11-06T19:35:21.074Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in the luci-mod-rpc package in OpenWRT Luci LTS allows for privilege escalation from an admin account to root via the JSON-RPC-API, which is exposed by the luci-mod-rpc package Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/VitoCrl/vulnerability_research/tree/main/CVE-2024-51240
CVE ID: CVE-2024-51242 State: PUBLISHED Published: 2024-10-30T00:00:00 Last Updated: 2024-10-31T15:21:43.482Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Server-Side Request Forgery (SSRF) vulnerability has been identified in eladmin 2.7 and earlier in ServerDeployController.java. The manipulation of the HTTP Body ip parameter leads to SSRF. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/shadia0/Patienc/blob/main/eladmin_ssrf.md
CVE ID: CVE-2024-51243 State: PUBLISHED Published: 2024-10-30T00:00:00 Last Updated: 2024-10-31T14:24:39.285Z Vendors: n/a Products: n/a Problem Types: n/a Description: The eladmin v2.7 and before contains a remote code execution (RCE) vulnerability that can control all application deployment servers of this management system via DeployController.java. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/shadia0/Patienc/blob/main/eladmin_rce.md
CVE ID: CVE-2024-51244 State: PUBLISHED Published: 2024-11-01T00:00:00 Last Updated: 2024-11-04T17:05:00.519Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the doIPSec function. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/fu37kola/cve/blob/main/DrayTek/Vigor3900/1.5.1.3/DrayTek_Vigor_3900_1.5.1.3.pdf
CVE ID: CVE-2024-51245 State: PUBLISHED Published: 2024-11-01T00:00:00 Last Updated: 2024-11-04T17:04:44.600Z Vendors: n/a Products: n/a Problem Types: n/a Description: In DrayTek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the rename_table function. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/fu37kola/cve/blob/main/DrayTek/Vigor3900/1.5.1.3/DrayTek_Vigor_3900_1.5.1.3.pdf
CVE ID: CVE-2024-51246 State: PUBLISHED Published: 2024-11-04T00:00:00 Last Updated: 2024-11-04T17:03:47.852Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the doPPTP function. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/fu37kola/cve/blob/main/DrayTek/Vigor3900/1.5.1.3/DrayTek_Vigor_3900_1.5.1.3.pdf
CVE ID: CVE-2024-51247 State: PUBLISHED Published: 2024-11-01T00:00:00 Last Updated: 2024-11-04T17:04:32.329Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the doPPPo function. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/fu37kola/cve/blob/main/DrayTek/Vigor3900/1.5.1.3/DrayTek_Vigor_3900_1.5.1.3.pdf
CVE ID: CVE-2024-51248 State: PUBLISHED Published: 2024-11-01T00:00:00 Last Updated: 2024-11-04T17:04:23.603Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the modifyrow function. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/fu37kola/cve/blob/main/DrayTek/Vigor3900/1.5.1.3/DrayTek_Vigor_3900_1.5.1.3.pdf
CVE ID: CVE-2024-51249 State: PUBLISHED Published: 2024-11-04T00:00:00 Last Updated: 2024-11-04T17:01:44.361Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the reboot function. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/fu37kola/cve/blob/main/DrayTek/Vigor3900/1.5.1.3/DrayTek_Vigor_3900_1.5.1.3.pdf
CVE ID: CVE-2024-51251 State: PUBLISHED Published: 2024-11-04T00:00:00 Last Updated: 2024-11-04T17:01:34.076Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the backup function. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/fu37kola/cve/blob/main/DrayTek/Vigor3900/1.5.1.3/DrayTek_Vigor_3900_1.5.1.3.pdf
CVE ID: CVE-2024-51252 State: PUBLISHED Published: 2024-11-01T00:00:00 Last Updated: 2024-11-04T20:52:26.636Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the restore function. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/fu37kola/cve/blob/main/DrayTek/Vigor3900/1.5.1.3/DrayTek_Vigor_3900_1.5.1.3.pdf
CVE ID: CVE-2024-51253 State: PUBLISHED Published: 2024-11-04T00:00:00 Last Updated: 2024-11-04T17:01:54.259Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the doL2TP function. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/fu37kola/cve/blob/main/DrayTek/Vigor3900/1.5.1.3/DrayTek_Vigor_3900_1.5.1.3.pdf
CVE ID: CVE-2024-51254 State: PUBLISHED Published: 2024-10-31T00:00:00 Last Updated: 2024-10-31T14:51:54.845Z Vendors: n/a Products: n/a Problem Types: n/a Description: DrayTek Vigor3900 1.5.1.3 allows attackers to inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the sign_cacertificate function. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/fu37kola/cve/blob/main/DrayTek/Vigor3900/1.5.1.3/DrayTek_Vigor_3900_1.5.1.3.pdf
CVE ID: CVE-2024-51255 State: PUBLISHED Published: 2024-10-31T00:00:00 Last Updated: 2024-10-31T18:24:24.979Z Vendors: n/a Products: n/a Problem Types: n/a Description: DrayTek Vigor3900 1.5.1.3 allows attackers to inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the ruequest_certificate function. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/fu37kola/cve/blob/main/DrayTek/Vigor3900/1.5.1.3/DrayTek_Vigor_3900_1.5.1.3.pdf
CVE ID: CVE-2024-51257 State: PUBLISHED Published: 2024-10-30T00:00:00 Last Updated: 2024-10-30T15:17:40.091Z Vendors: n/a Products: n/a Problem Types: n/a Description: DrayTek Vigor3900 1.5.1.3 allows attackers to inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the doCertificate function. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/fu37kola/cve/blob/main/DrayTek/Vigor3900/1.5.1.3/DrayTek_Vigor_3900_1.5.1.3.pdf
CVE ID: CVE-2024-51258 State: PUBLISHED Published: 2024-10-30T00:00:00 Last Updated: 2024-10-30T17:35:03.692Z Vendors: n/a Products: n/a Problem Types: n/a Description: DrayTek Vigor3900 1.5.1.3 allows attackers to inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the doSSLTunnel function. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/fu37kola/cve/blob/main/DrayTek/Vigor3900/1.5.1.3/DrayTek_Vigor_3900_1.5.1.3.pdf
CVE ID: CVE-2024-51259 State: PUBLISHED Published: 2024-10-31T00:00:00 Last Updated: 2024-10-31T18:25:18.179Z Vendors: n/a Products: n/a Problem Types: n/a Description: DrayTek Vigor3900 1.5.1.3 allows attackers to inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the setup_cacertificate function. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/fu37kola/cve/blob/main/DrayTek/Vigor3900/1.5.1.3/DrayTek_Vigor_3900_1.5.1.3.pdf