Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-22722 State: PUBLISHED Published: 2024-04-11T00:00:00 Last Updated: 2024-08-01T22:51:11.111Z Vendors: n/a Products: n/a Problem Types: n/a Description: Server Side Template Injection (SSTI) vulnerability in Form Tools 3.1.1 allows attackers to run arbitrary commands via the Group Name field under the add forms section of the application. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://hakaisecurity.io/error-404-your-security-not-found-tales-of-web-vulnerabilities/
CVE ID: CVE-2024-22723 State: PUBLISHED Published: 2024-02-28T00:00:00 Last Updated: 2024-08-01T22:51:11.012Z Vendors: n/a Products: n/a Problem Types: n/a Description: Webtrees 2.1.18 is vulnerable to Directory Traversal. By manipulating the "media_folder" parameter in the URL, an attacker (in this case, an administrator) can navigate beyond the intended directory (the 'media/' directory) to access sensitive files in other parts of the application's file system. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://cupc4k3.medium.com/cve-2024-22723-webtrees-vulnerability-uncovering-sensitive-data-through-path-traversal-7442e7a38b68
CVE ID: CVE-2024-22724 State: PUBLISHED Published: 2024-03-21T00:00:00 Last Updated: 2024-08-06T14:32:24.651Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in osCommerce v4, allows local attackers to bypass file upload restrictions and execute arbitrary code via administrator profile photo upload feature. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://medium.com/%40cupc4k3/oscommerce-v4-rce-unveiling-the-file-upload-bypass-threat-f1ac0097880c - https://github.com/osCommerce/osCommerce-V4/issues/62
CVE ID: CVE-2024-22725 State: PUBLISHED Published: 2024-01-24T00:00:00.000Z Last Updated: 2025-06-04T21:15:17.975Z Vendors: n/a Products: n/a Problem Types: n/a Description: Orthanc versions before 1.12.2 are affected by a reflected cross-site scripting (XSS) vulnerability. The vulnerability was present in the server's error reporting. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://orthanc.uclouvain.be/hg/orthanc/rev/505416b269a0 - https://orthanc.uclouvain.be/hg/orthanc/file/Orthanc-1.12.2/NEWS
CVE ID: CVE-2024-22727 State: PUBLISHED Published: 2024-02-17T00:00:00 Last Updated: 2024-12-03T16:49:38.597Z Vendors: n/a Products: n/a Problem Types: n/a Description: Teltonika TRB1-series devices with firmware before TRB1_R_00.07.05.2 allow attackers to exploit a firmware vulnerability via Ethernet LAN or USB. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://teltonika-networks.com/newsroom/critical-security-update-for-trb1-series-gateways
CVE ID: CVE-2024-22729 State: PUBLISHED Published: 2024-01-25T00:00:00.000Z Last Updated: 2025-06-04T21:21:07.532Z Vendors: n/a Products: n/a Problem Types: n/a Description: NETIS SYSTEMS MW5360 V1.0.1.3031 was discovered to contain a command injection vulnerability via the password parameter on the login page. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/adhikara13/CVE/blob/main/netis_MW5360/blind%20command%20injection%20in%20password%20parameter%20in%20initial%20settings.md
CVE ID: CVE-2024-22733 State: PUBLISHED Published: 2024-11-01T00:00:00 Last Updated: 2024-11-05T20:57:12.662Z Vendors: n/a Products: n/a Problem Types: n/a Description: TP Link MR200 V4 Firmware version 210201 was discovered to contain a null-pointer-dereference in the web administration panel on /cgi/login via the sign, Action or LoginStatus query parameters which could lead to a denial of service by a local or remote unauthenticated attacker. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://lenoctambule.dev/post/dos-on-tp-link-web-admin-panel
CVE ID: CVE-2024-22734 State: PUBLISHED Published: 2024-04-12T00:00:00 Last Updated: 2024-08-01T22:51:11.079Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in AMCS Group Trux Waste Management Software before version 7.19.0018.26912, allows local attackers to obtain sensitive information via a static, hard-coded AES Key-IV pair in the TxUtilities.dll and TruxUser.cfg components. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.redlinecybersecurity.com/blog/cve-2024-22734
CVE ID: CVE-2024-22749 State: PUBLISHED Published: 2024-01-25T00:00:00.000Z Last Updated: 2025-06-16T18:27:47.734Z Vendors: n/a Products: n/a Problem Types: n/a Description: GPAC v2.3 was detected to contain a buffer overflow via the function gf_isom_new_generic_sample_description function in the isomedia/isom_write.c:4577 Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/hanxuer/crashes/blob/main/gapc/01/readme.md - https://github.com/gpac/gpac/issues/2713
CVE ID: CVE-2024-22751 State: PUBLISHED Published: 2024-01-24T00:00:00.000Z Last Updated: 2025-06-20T19:27:54.785Z Vendors: n/a Products: n/a Problem Types: n/a Description: D-Link DIR-882 DIR882A1_FW130B06 was discovered to contain a stack overflow via the sub_477AA0 function. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.dlink.com/en/security-bulletin/ - https://github.com/5erua/vuls/blob/main/dir882.md
CVE ID: CVE-2024-22752 State: PUBLISHED Published: 2024-03-07T00:00:00 Last Updated: 2024-08-29T17:51:21.420Z Vendors: n/a Products: n/a Problem Types: n/a Description: Insecure permissions issue in EaseUS MobiMover 6.0.5 Build 21620 allows attackers to gain escalated privileges via use of crafted executable launched from the application installation directory. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/hacker625/CVE-2024-22752
CVE ID: CVE-2024-22768 State: PUBLISHED Published: 2024-01-23T04:31:40.489Z Last Updated: 2025-05-30T14:19:56.241Z Severity: HIGH (CVSS 7.4 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H) Vendors: Hitron Systems Products: DVR HVR-4781 Problem Types: CWE-20 Description: Improper Input Validation in Hitron Systems DVR HVR-4781 1.03~4.02 allows an attacker to cause network attack in case of using defalut admin ID/PW. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://www.hitron.co.kr/firmware/
CVE ID: CVE-2024-22769 State: PUBLISHED Published: 2024-01-23T04:37:06.276Z Last Updated: 2025-05-30T14:19:50.183Z Severity: HIGH (CVSS 7.4 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H) Vendors: Hitron Systems Products: DVR HVR-8781 Problem Types: CWE-20 Description: Improper Input Validation in Hitron Systems DVR HVR-8781 1.03~4.02 allows an attacker to cause network attack in case of using defalut admin ID/PW. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://www.hitron.co.kr/firmware/
CVE ID: CVE-2024-22770 State: PUBLISHED Published: 2024-01-23T04:42:39.638Z Last Updated: 2025-05-22T14:58:05.088Z Severity: HIGH (CVSS 7.4 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H) Vendors: Hitron Systems Products: DVR HVR-16781 Problem Types: CWE-20 Description: Improper Input Validation in Hitron Systems DVR HVR-16781 1.03~4.02 allows an attacker to cause network attack in case of using defalut admin ID/PW. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://www.hitron.co.kr/firmware/
CVE ID: CVE-2024-22771 State: PUBLISHED Published: 2024-01-23T04:49:10.800Z Last Updated: 2024-10-22T03:55:42.957Z Severity: HIGH (CVSS 7.4 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H) Vendors: Hitron Systems Products: DVR LGUVR-4H Problem Types: CWE-20 Description: Improper Input Validation in Hitron Systems DVR LGUVR-4H 1.02~4.02 allows an attacker to cause network attack in case of using defalut admin ID/PW. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://www.hitron.co.kr/firmware/
CVE ID: CVE-2024-22772 State: PUBLISHED Published: 2024-01-23T04:52:06.708Z Last Updated: 2024-10-22T03:55:44.110Z Severity: HIGH (CVSS 7.4 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H) Vendors: Hitron Systems Products: DVR LGUVR-8H Problem Types: CWE-20 Description: Improper Input Validation in Hitron Systems DVR LGUVR-8H 1.02~4.02 allows an attacker to cause network attack in case of using defalut admin ID/PW. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://www.hitron.co.kr/firmware/
CVE ID: CVE-2024-22773 State: PUBLISHED Published: 2024-02-06T00:00:00.000Z Last Updated: 2025-06-05T16:22:28.669Z Vendors: n/a Products: n/a Problem Types: n/a Description: Intelbras Action RF 1200 routers 1.2.2 and earlier and Action RG 1200 routers 2.1.7 and earlier expose the Password in Cookie resulting in Login Bypass. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://medium.com/%40wagneralves_87750/poc-cve-2024-22773-febf0d3a5433 - https://www.youtube.com/watch?v=-r0TWJq55DU&t=7s - https://www.intelbras.com/en/router-wi-fi-5-dual-band-ac-1200-with-giga-port-action-rg-1200 - https://www.intelbras.com/en/router-wi-fi-5-dual-band-ac-1200-ac
-fi-5-dual-band-ac-1200-with-giga-port-action-rg-1200 - https://www.intelbras.com/en/router-wi-fi-5-dual-band-ac-1200-action-rf-1200
CVE ID: CVE-2024-22774 State: PUBLISHED Published: 2024-05-13T19:39:15.881Z Last Updated: 2025-02-21T16:57:26.998Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in Panoramic Corporation Digital Imaging Software v.9.1.2.7600 allows a local attacker to escalate privileges via the ccsservice.exe component. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://pancorp.com/software/files/PANCORP_DENTAL_IMAGING_9.1.2.7600.exe - https://pancorp.com/index.html - https://pancorp.com/pdf/Panoramic-Dental-Imaging-%28GLAN%29-Windows-10x64-Setup-Rev3.pdf - https://github.com/Gray-0men/CVE-2024-22774 - https://blueteamalpha.com/blog/new-vul
N%29-Windows-10x64-Setup-Rev3.pdf - https://github.com/Gray-0men/CVE-2024-22774 - https://blueteamalpha.com/blog/new-vulnerability-discovered-in-panoramic-x-ray-software/
CVE ID: CVE-2024-22776 State: PUBLISHED Published: 2024-02-23T00:00:00 Last Updated: 2024-08-14T15:27:10.706Z Vendors: n/a Products: n/a Problem Types: n/a Description: Wallos 0.9 is vulnerable to Cross Site Scripting (XSS) in all text-based input fields without proper validation, excluding those requiring specific formats like date fields. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/ellite/Wallos - https://webity-luescher.notion.site/webity-luescher/Wallos-v0-9-to-v1-2-2-CVE-2024-22776-Stored-XSS-Vulnerability-in-all-text-based-input-fields-6622fb4cfbe0430aa0b1d4b3edcb67b0
CVE ID: CVE-2024-22778 State: PUBLISHED Published: 2024-02-21T00:00:00 Last Updated: 2024-11-06T16:23:14.819Z Vendors: n/a Products: n/a Problem Types: n/a Description: HackMD CodiMD <2.5.2 is vulnerable to Denial of Service. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/hackmdio/codimd/issues/1846
CVE ID: CVE-2024-22779 State: PUBLISHED Published: 2024-02-02T00:00:00 Last Updated: 2024-08-01T22:51:11.121Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AC:L/AV:N/A:H/C:H/I:H/PR:N/S:U/UI:R) Vendors: n/a Products: n/a Problem Types: n/a Description: Directory Traversal vulnerability in Kihron ServerRPExposer v.1.0.2 and before allows a remote attacker to execute arbitrary code via the loadServerPack in ServerResourcePackProviderMixin.java. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://modrinth.com/mod/serverrpexposer - https://gist.github.com/apple502j/193358682885fe1a6708309ce934e4ed - https://github.com/Kihron/ServerRPExposer/commit/8f7b829df633f59
github.com/apple502j/193358682885fe1a6708309ce934e4ed - https://github.com/Kihron/ServerRPExposer/commit/8f7b829df633f59e828d677f736c53652d6f1b8f
CVE ID: CVE-2024-22780 State: PUBLISHED Published: 2024-04-02T00:00:00 Last Updated: 2024-12-04T21:05:27.932Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting vulnerability in CA17 TeamsACS v.1.0.1 allows a remote attacker to execute arbitrary code via a crafted script to the errmsg parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - http://ca17.com - https://github.com/CA17/TeamsACS - https://fuo.fi/CVE-2024-22780/
CVE ID: CVE-2024-22795 State: PUBLISHED Published: 2024-02-08T00:00:00.000Z Last Updated: 2025-06-05T16:07:43.409Z Vendors: n/a Products: n/a Problem Types: n/a Description: Insecure Permissions vulnerability in Forescout SecureConnector v.11.3.06.0063 allows a local attacker to escalate privileges via the Recheck Compliance Status component. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.forescout.com/ - https://github.com/Hagrid29/ForeScout-SecureConnector-EoP - https://gist.github.com/Hagrid29/aea0dc35a1e87813dbbb7b317853d023
CVE ID: CVE-2024-22807 State: PUBLISHED Published: 2024-04-22T00:00:00 Last Updated: 2024-08-01T22:51:11.039Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in Tormach xsTECH CNC Router, PathPilot Controller v2.9.6 allows attackers to erase a critical sector of the flash memory, causing the machine to lose network connectivity and suffer from firmware corruption. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://gist.github.com/VcuCyber/51075894d1728db07fc2df286c003df9
CVE ID: CVE-2024-22808 State: PUBLISHED Published: 2024-04-22T00:00:00 Last Updated: 2024-08-01T22:51:11.152Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in Tormach xsTECH CNC Router, PathPilot Controller v2.9.6 allows attackers to cause a Denial of Service (DoS) by disrupting the communication between the PathPilot controller and the CNC router via overwriting the card's name in the device memory. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://gist.github.com/VcuCyber/51075894d1728db07fc2df286c003df9
CVE ID: CVE-2024-22809 State: PUBLISHED Published: 2024-04-22T00:00:00 Last Updated: 2024-08-01T22:51:11.117Z Vendors: n/a Products: n/a Problem Types: n/a Description: Incorrect access control in Tormach xsTECH CNC Router, PathPilot Controller v2.9.6 allows attackers to access the G code's shared folder and view sensitive information. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://gist.github.com/VcuCyber/51075894d1728db07fc2df286c003df9
CVE ID: CVE-2024-22811 State: PUBLISHED Published: 2024-04-22T00:00:00.000Z Last Updated: 2025-03-13T15:22:22.364Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in Tormach xsTECH CNC Router, PathPilot Controller v2.9.6 allows attackers to cause a Denial of Service (DoS) by disrupting the communication between the PathPilot controller and the CNC router via overwriting the Hostmot2 configuration cookie in the device memory. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://gist.github.com/VcuCyber/51075894d1728db07fc2df286c003df9
CVE ID: CVE-2024-22813 State: PUBLISHED Published: 2024-04-22T00:00:00 Last Updated: 2024-08-01T22:51:11.142Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in Tormach xsTECH CNC Router, PathPilot Controller v2.9.6 allows attackers to overwrite the hardcoded IP address in the device memory, disrupting network connectivity between the router and the controller. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://gist.github.com/VcuCyber/51075894d1728db07fc2df286c003df9
CVE ID: CVE-2024-22815 State: PUBLISHED Published: 2024-04-22T00:00:00 Last Updated: 2024-08-01T22:51:11.106Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in the communication protocol of Tormach xsTECH CNC Router, PathPilot Controller v2.9.6 allows attackers to cause a Denial of Service (DoS) via crafted commands. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://gist.github.com/VcuCyber/51075894d1728db07fc2df286c003df9
CVE ID: CVE-2024-22817 State: PUBLISHED Published: 2024-01-18T00:00:00.000Z Last Updated: 2025-06-05T16:17:10.395Z Vendors: n/a Products: n/a Problem Types: n/a Description: FlyCms v1.0 contains a Cross-Site Request Forgery (CSRF) vulnerability via /system/email/email_conf_updagte Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/mafangqian/cms/blob/main/1.md
CVE ID: CVE-2024-22818 State: PUBLISHED Published: 2024-01-18T00:00:00.000Z Last Updated: 2025-06-09T20:50:22.523Z Vendors: n/a Products: n/a Problem Types: n/a Description: FlyCms v1.0 contains a Cross-Site Request Forgery (CSRF) vulnerbility via /system/site/filterKeyword_save Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/mafangqian/cms/blob/main/3.md
CVE ID: CVE-2024-22819 State: PUBLISHED Published: 2024-01-18T00:00:00.000Z Last Updated: 2025-06-02T15:04:55.941Z Vendors: n/a Products: n/a Problem Types: n/a Description: FlyCms v1.0 contains a Cross-Site Request Forgery (CSRF) vulnerability via /system/email/email_templets_update. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/mafangqian/cms/blob/main/2.md
CVE ID: CVE-2024-22824 State: PUBLISHED Published: 2024-02-20T00:00:00 Last Updated: 2024-08-29T15:15:47.732Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in Timo v.2.0.3 allows a remote attacker to execute arbitrary code via the filetype restrictions in the UploadController.java component. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/auntvt/Timo/issues/6
CVE ID: CVE-2024-22830 State: PUBLISHED Published: 2024-05-01T00:00:00 Last Updated: 2024-08-01T22:51:11.244Z Vendors: n/a Products: n/a Problem Types: n/a Description: Anti-Cheat Expert's Windows kernel module "ACE-BASE.sys" version 1.0.2202.6217 does not perform proper access control when handling system resources. This allows a local attacker to escalate privileges from regular user to System or PPL level. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - http://anti-cheat.com - https://intl.anticheatexpert.com/#/tool-center - https://www.defencetech.it/wp-content/uploads/2024/04/Report-CVE-2024-22830.pdf
CVE ID: CVE-2024-22836 State: PUBLISHED Published: 2024-02-08T00:00:00.000Z Last Updated: 2025-06-20T20:16:15.877Z Vendors: n/a Products: n/a Problem Types: n/a Description: An OS command injection vulnerability exists in Akaunting v3.1.3 and earlier. An attacker can manipulate the company locale when installing an app to execute system commands on the hosting server. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/akaunting/akaunting/releases/tag/3.1.4 - https://akaunting.com/ - https://github.com/u32i/cve/tree/main/CVE-2024-22836
CVE ID: CVE-2024-22851 State: PUBLISHED Published: 2024-02-02T00:00:00.000Z Last Updated: 2025-06-05T16:20:58.047Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory Traversal Vulnerability in LiveConfig before v.2.5.2 allows a remote attacker to obtain sensitive information via a crafted request to the /static/ endpoint. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.drive-byte.de/en/blog/liveconfig-advisory-cve-2024-22851 - https://www.liveconfig.com/de/kb/cve/cve-2024-22851/ - https://raeph123.github.io/BlogPosts/LiveConfig/LiveConfig_Advisory_CVE-2024-22851_en.html
CVE ID: CVE-2024-22852 State: PUBLISHED Published: 2024-02-06T00:00:00.000Z Last Updated: 2025-05-15T19:45:54.686Z Vendors: n/a Products: n/a Problem Types: n/a Description: D-Link Go-RT-AC750 GORTAC750_A1_FW_v101b03 contains a stack-based buffer overflow via the function genacgi_main. This vulnerability allows attackers to enable telnet service via a specially crafted payload. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.dlink.com/en/security-bulletin/ - https://github.com/Beckaf/vunl/blob/main/D-Link/AC750/1/1.md
CVE ID: CVE-2024-22853 State: PUBLISHED Published: 2024-02-06T00:00:00.000Z Last Updated: 2025-06-20T20:13:39.786Z Vendors: n/a Products: n/a Problem Types: n/a Description: D-LINK Go-RT-AC750 GORTAC750_A1_FW_v101b03 has a hardcoded password for the Alphanetworks account, which allows remote attackers to obtain root access via a telnet session. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.dlink.com/en/security-bulletin/ - https://github.com/Beckaf/vunl/blob/main/D-Link/AC750/2/2.md
CVE ID: CVE-2024-22854 State: PUBLISHED Published: 2024-02-16T00:00:00 Last Updated: 2024-08-16T17:58:22.184Z Vendors: n/a Products: n/a Problem Types: n/a Description: DOM-based HTML injection vulnerability in the main page of Darktrace Threat Visualizer version 6.1.27 (bundle version 61050) and before has been identified. A URL, crafted by a remote attacker and visited by an authenticated user, allows open redirect and potential credential stealing using an injected HTML form. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://tomekwasiak.pl/cve-2024-22854/
CVE ID: CVE-2024-22855 State: PUBLISHED Published: 2024-06-12T00:00:00.000Z Last Updated: 2025-03-27T14:23:42.076Z Vendors: n/a Products: n/a Problem Types: n/a Description: A cross-site scripting (XSS) vulnerability in the User Maintenance section of ITSS iMLog v1.307 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Last Name parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.exploit-db.com/exploits/52025
CVE ID: CVE-2024-22856 State: PUBLISHED Published: 2024-04-22T00:00:00 Last Updated: 2024-11-22T14:45:52.056Z Vendors: n/a Products: n/a Problem Types: n/a Description: A SQL injection vulnerability via the Save Favorite Search function in Axefinance Axe Credit Portal >= v.3.0 allows authenticated attackers to execute unintended queries and disclose sensitive information from DB tables via crafted requests. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.4rth4s.xyz/2024/04/cve-2024-22856-authenticated-blind-sql.html
CVE ID: CVE-2024-22857 State: PUBLISHED Published: 2024-03-07T00:00:00 Last Updated: 2024-08-27T19:45:25.342Z Vendors: n/a Products: n/a Problem Types: n/a Description: Heap based buffer flow in zlog v1.1.0 to v1.2.17 in zlog_rule_new().The size of record_name is MAXLEN_PATH(1024) + 1 but file_path may have data upto MAXLEN_CFG_LINE(MAXLEN_PATH*4) + 1. So a check was missing in zlog_rule_new() while copying the record_name from file_path + 1 which caused the buffer overflow. An attacker can exploit this vulnerability to overwrite the zlog_record_fn record_func function pointer to get arbitrary code execution or potentially cause remote code execution (RCE). Additional Analyst Notes: - CVE Pr
ter to get arbitrary code execution or potentially cause remote code execution (RCE). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/HardySimpson/zlog/ - https://github.com/HardySimpson/zlog/blob/1a7b1a6fb956b92a4079ccc91f30da21f34ca063/src/rule.h#L30 - https://www.cybersecurity-help.cz/vdb/SB2024022842 - https://github.com/HardySimpson/zlog/pull/251 - https://www.ebryx.com/blogs/arbitrary-code-execution-in-zlog-cve-2024-22857