Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-7593 State: PUBLISHED Published: 2024-08-13T18:17:47.248Z Last Updated: 2025-10-21T22:55:47.493Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Ivanti Products: vTM Problem Types: CWE-287, CWE-303 Description: Incorrect implementation of an authentication algorithm in Ivanti vTM other than versions 22.2R1 or 22.7R2 allows a remote unauthenticated attacker to bypass authentication of the admin panel. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Virtual-Traffic-Manager-vTM-CVE-2024-7593
CVE ID: CVE-2024-7594 State: PUBLISHED Published: 2024-09-26T19:52:55.652Z Last Updated: 2025-01-10T13:06:49.543Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: HashiCorp Products: Vault, Vault Enterprise Problem Types: CWE-732 Description: Vault’s SSH secrets engine did not require the valid_principals list to contain a value by default. If the valid_principals and default_user fields of the SSH secrets engine configuration are not set, an SSH certificate requested by an authorized user to Vault’s SSH secrets engine could be used to authenticate as any user on the host. Fixed in Vault Community Edition 1.17.6, and in Vault Enterprise 1.17.6, 1.16.10, and 1.1
icate as any user on the host. Fixed in Vault Community Edition 1.17.6, and in Vault Enterprise 1.17.6, 1.16.10, and 1.15.15. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://discuss.hashicorp.com/t/hcsec-2024-20-vault-ssh-secrets-engine-configuration-did-not-restrict-valid-principals-by-default/70251
CVE ID: CVE-2024-7595 State: PUBLISHED Published: 2025-02-05T17:36:33.199Z Last Updated: 2025-11-03T20:56:26.123Z Vendors: IETF Products: RFC2784 - Generic Routing Encapsulation (GRE) Problem Types: CWE-290 Authentication Bypass by Spoofing Description: GRE and GRE6 Protocols (RFC2784) do not validate or verify the source of a network packet allowing an attacker to spoof and route arbitrary traffic via an exposed network interface that can lead to spoofing, access control bypass, and other unexpected network behaviors. This can be considered similar to CVE-2020-10136. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://datatracker.ietf.org/doc/ht
ional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://datatracker.ietf.org/doc/html/rfc2784 - https://www.rfc-editor.org/rfc/rfc6169.html
CVE ID: CVE-2024-7596 State: PUBLISHED Published: 2025-02-05T17:37:33.876Z Last Updated: 2025-11-03T20:56:27.654Z Vendors: IETF Products: draft-ietf-intarea-gue-09 Problem Types: CWE-290 Authentication Bypass by Spoofing Description: Proposed Generic UDP Encapsulation (GUE) (IETF Draft) do not validate or verify the source of a network packet allowing an attacker to spoof and route arbitrary traffic via an exposed network interface that can lead to spoofing, access control bypass, and other unexpected network behaviors. This can be considered similar to CVE-2020-10136. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://datatracker.ietf.org/doc/d
tional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://datatracker.ietf.org/doc/draft-ietf-intarea-gue/ - https://www.rfc-editor.org/rfc/rfc6169.html
CVE ID: CVE-2024-7598 State: PUBLISHED Published: 2025-03-20T16:52:57.929Z Last Updated: 2025-03-20T21:02:37.374Z Severity: LOW (CVSS 3.1 CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Kubernetes Products: kube-apiserver Problem Types: CWE-362 Description: A security issue was discovered in Kubernetes where a malicious or compromised pod could bypass network restrictions enforced by network policies during namespace deletion. The order in which objects are deleted during namespace termination is not defined, and it is possible for network policies to be deleted before the pods that they protect. This can lead to a brief period in which the pods are running, but network policies that
re the pods that they protect. This can lead to a brief period in which the pods are running, but network policies that should apply to connections to and from the pods are not enforced. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/kubernetes/kubernetes/issues/126587 - https://groups.google.com/g/kubernetes-security-announce/c/67D7UFqiPRc
CVE ID: CVE-2024-7599 State: PUBLISHED Published: 2024-09-06T13:55:16.674Z Last Updated: 2024-09-06T14:12:17.517Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: wpcodeus Products: Advanced Sermons Problem Types: CWE-79 Description: The Advanced Sermons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘sermon_video_embed’ parameter in all versions up to, and including, 3.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional
above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/41859e1c-1ae0-49f1-82d3-5af3c15994ef?source=cve - https://plugins.trac.wordpress.org/browser/advanced-sermons/trunk/admin/meta/sermon-details.php#L396 - https://plugins.trac.wordpress.org/browser/advanced-sermons/trunk/include/templates/sections/video-template.php#L18 - https://plugins.trac.wordpress.org/browser/advanced-sermons/trunk/include/templates/sections/video-template.php#L124 - https://plugins.trac.wordpress.org/changeset/3147283/
CVE ID: CVE-2024-7600 State: PUBLISHED Published: 2024-08-21T16:06:01.959Z Last Updated: 2024-08-21T20:09:41.483Z Severity: HIGH (CVSS 7.1 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H) Vendors: Logsign Products: Unified SecOps Platform Problem Types: CWE-22 Description: Logsign Unified SecOps Platform Directory Traversal Arbitrary File Deletion Vulnerability. This vulnerability allows remote attackers to delete arbitrary files on affected installations of Logsign Unified SecOps Platform. Authentication is required to exploit this vulnerability. The specific flaw exists within the HTTP API service, which listens on TCP port 443 by default. The issue results from the lack of proper validation
in the HTTP API service, which listens on TCP port 443 by default. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to delete files in the context of root. Was ZDI-CAN-25025. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-24-1103/ - https://support.logsign.net/hc/en-us/articles/20617133769362-06-08-2024-Version-6-4-23-Release-Notes
CVE ID: CVE-2024-7601 State: PUBLISHED Published: 2024-08-21T16:06:06.261Z Last Updated: 2024-08-21T20:08:55.067Z Severity: HIGH (CVSS 7.1 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H) Vendors: Logsign Products: Unified SecOps Platform Problem Types: CWE-22 Description: Logsign Unified SecOps Platform Directory data_export_delete_all Traversal Arbitrary File Deletion Vulnerability. This vulnerability allows remote attackers to delete arbitrary files on affected installations of Logsign Unified SecOps Platform. Authentication is required to exploit this vulnerability. The specific flaw exists within the HTTP API service, which listens on TCP port 443 by default. The issue results from the lac
ecific flaw exists within the HTTP API service, which listens on TCP port 443 by default. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to delete files in the context of root. Was ZDI-CAN-25026. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-24-1106/ - https://support.logsign.net/hc/en-us/articles/20617133769362-06-08-2024-Version-6-4-23-Release-Notes
CVE ID: CVE-2024-7602 State: PUBLISHED Published: 2024-08-21T16:06:09.754Z Last Updated: 2024-08-21T19:58:11.201Z Severity: MEDIUM (CVSS 6.5 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: Logsign Products: Unified SecOps Platform Problem Types: CWE-22 Description: Logsign Unified SecOps Platform Directory Traversal Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Logsign Unified SecOps Platform. Authentication is required to exploit this vulnerability. The specific flaw exists within the HTTP API service, which listens on TCP port 443 by default. The issue results from the lack of proper va
ists within the HTTP API service, which listens on TCP port 443 by default. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to disclose information in the context of root. Was ZDI-CAN-25027. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-24-1102/ - https://support.logsign.net/hc/en-us/articles/20617133769362-06-08-2024-Version-6-4-23-Release-Notes
CVE ID: CVE-2024-7603 State: PUBLISHED Published: 2024-08-21T16:06:13.270Z Last Updated: 2024-08-21T19:57:02.482Z Severity: HIGH (CVSS 7.1 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H) Vendors: Logsign Products: Unified SecOps Platform Problem Types: CWE-22 Description: Logsign Unified SecOps Platform Directory Traversal Arbitrary Directory Deletion Vulnerability. This vulnerability allows remote attackers to delete arbitrary directories on affected installations of Logsign Unified SecOps Platform. Authentication is required to exploit this vulnerability. The specific flaw exists within the HTTP API service, which listens on TCP port 443 by default. The issue results from the lack of proper
exists within the HTTP API service, which listens on TCP port 443 by default. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to delete directories in the context of root. Was ZDI-CAN-25028. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-24-1105/ - https://support.logsign.net/hc/en-us/articles/20617133769362-06-08-2024-Version-6-4-23-Release-Notes
CVE ID: CVE-2024-7604 State: PUBLISHED Published: 2024-08-21T16:06:17.339Z Last Updated: 2024-08-21T19:55:29.507Z Severity: MEDIUM (CVSS 5.1 CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) Vendors: Logsign Products: Unified SecOps Platform Problem Types: CWE-863 Description: Logsign Unified SecOps Platform Incorrect Authorization Authentication Bypass Vulnerability. This vulnerability allows local attackers to bypass authentication on affected installations of Logsign Unified SecOps Platform. Authentication is required to exploit this vulnerability. The specific flaw exists within the HTTP API service, which listens on TCP port 443 by default. The issue results from the lack of proper validati
ithin the HTTP API service, which listens on TCP port 443 by default. The issue results from the lack of proper validation of the user's license expiration date. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-25029. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-24-1104/ - https://support.logsign.net/hc/en-us/articles/20617133769362-06-08-2024-Version-6-4-23-Release-Notes
CVE ID: CVE-2024-7605 State: PUBLISHED Published: 2024-09-05T11:00:13.521Z Last Updated: 2024-09-05T18:28:40.831Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: helloasso Products: HelloAsso Problem Types: CWE-862 Description: The HelloAsso plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'ha_ajax' function in all versions up to, and including, 1.1.10. This makes it possible for authenticated attackers, with Contributor-level access and above, to update plugin options, potentially disrupting the service. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/
ally disrupting the service. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/1690631b-0e5d-45d1-9db6-6ac426874762?source=cve - https://plugins.trac.wordpress.org/browser/helloasso/trunk/admin/class-hello-asso-admin.php#L457 - https://plugins.trac.wordpress.org/changeset/3145151/
CVE ID: CVE-2024-7606 State: PUBLISHED Published: 2024-08-29T05:30:55.535Z Last Updated: 2024-08-29T13:19:08.296Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: rustaurius Products: Front End Users Problem Types: CWE-79 Description: The Front End Users plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'user-search' shortcode in all versions up to, and including, 3.2.28 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user acce
with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/048ea84c-0d53-434b-ae49-d804ec1de8c4?source=cve - https://plugins.trac.wordpress.org/browser/front-end-only-users/trunk/Shortcodes/Insert_User_Search.php#L80 - https://plugins.trac.wordpress.org/browser/front-end-only-users/trunk/Shortcodes/Insert_User_Search.php#L106 - https://plugins.trac.wordpress.org/changeset/3142978/
CVE ID: CVE-2024-7607 State: PUBLISHED Published: 2024-08-29T05:30:57.846Z Last Updated: 2024-08-29T13:20:48.729Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: rustaurius Products: Front End Users Problem Types: CWE-89 Description: The Front End Users plugin for WordPress is vulnerable to time-based SQL Injection via the ‘order’ parameter in all versions up to, and including, 3.2.28 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Contributor-level access and above, to append additional SQL queries into already existing queries th
ed attackers, with Contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/ec162cdc-d4cd-47d9-b941-24bfee6c48fd?source=cve - https://plugins.trac.wordpress.org/browser/front-end-only-users/trunk/html/UsersPage.php#L42 - https://plugins.trac.wordpress.org/browser/front-end-only-users/trunk/html/UsersPage.php#L60 - https://plugins.trac.wordpress.org/browser/front-end-only-users/trunk/html/UsersPage.php#L63 - https://plugins.trac.wordpress.org/browser/front-end-on
.org/browser/front-end-only-users/trunk/html/UsersPage.php#L63 - https://plugins.trac.wordpress.org/browser/front-end-only-users/trunk/html/UsersPage.php#L76 - https://plugins.trac.wordpress.org/changeset/3142978/
CVE ID: CVE-2024-7608 State: PUBLISHED Published: 2024-08-27T07:40:15.791Z Last Updated: 2024-08-28T11:45:52.314Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:H) Vendors: Trellix Products: Trellix NX, EX, AX, FX, CMS and IVX Problem Types: CWE-35 Description: An authenticated user can access the restricted files from NX, EX, FX, AX, IVX and CMS using path traversal. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://thrive.trellix.com/s/article/000013844
CVE ID: CVE-2024-7609 State: PUBLISHED Published: 2024-09-11T11:38:03.218Z Last Updated: 2024-09-23T08:53:56.576Z Vendors: Vidco Software Products: VOC TESTER Problem Types: CWE-22 Description: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Vidco Software VOC TESTER allows Path Traversal.This issue affects VOC TESTER: before 12.34.8. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.usom.gov.tr/bildirim/tr-24-1447
CVE ID: CVE-2024-7610 State: PUBLISHED Published: 2024-08-08T10:30:43.133Z Last Updated: 2024-08-29T15:05:01.225Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: GitLab Products: GitLab Problem Types: CWE-400 Description: A Denial of Service (DoS) condition has been discovered in GitLab CE/EE affecting all versions starting with 15.9 before 17.0.6, 17.1 prior to 17.1.4, and 17.2 prior to 17.2.2. It is possible for an attacker to cause catastrophic backtracking while parsing results from Elasticsearch. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/468917
CVE ID: CVE-2024-7611 State: PUBLISHED Published: 2024-09-06T13:55:21.742Z Last Updated: 2024-09-06T14:08:22.322Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: themelooks Products: Enter Addons – Ultimate Template Builder for Elementor Problem Types: CWE-79 Description: The Enter Addons – Ultimate Template Builder for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'tag' attribute of the Events Card widget in all versions up to, and including, 2.1.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and
ping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/f7580145-03da-4aff-b804-39125e7daad1?source=cve - https://plugins.trac.wordpress.org/browser/enteraddons/trunk/widgets/events_card/traits/Templates_Components.php#L25
CVE ID: CVE-2024-7612 State: PUBLISHED Published: 2024-10-08T16:17:29.116Z Last Updated: 2024-10-17T18:10:58.624Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: Ivanti Products: Endpoint Manager Mobile Problem Types: CWE-732 Description: Insecure permissions in Ivanti EPMM before 12.1.0.4 allow a local authenticated attacker to modify sensitive application components. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Endpoint-Manager-Mobile-EPMM-CVE-2024-7612
CVE ID: CVE-2024-7613 State: PUBLISHED Published: 2024-08-08T22:00:10.117Z Last Updated: 2024-08-09T12:53:19.799Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C) Vendors: Tenda Products: FH1206 Problem Types: CWE-120 Description: A vulnerability was found in Tenda FH1206 1.2.0.8(8155) and classified as critical. This issue affects the function fromGstDhcpSetSer of the file /goform/GstDhcpSetSer. The manipulation of the argument dips leads to buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnric
r was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.273983 - https://vuldb.com/?ctiid.273983 - https://vuldb.com/?submit.383691 - https://github.com/BeaCox/IoT_vuln/tree/main/tenda/FH1206/GstDhcpSetSer_bof%26injection
CVE ID: CVE-2024-7614 State: PUBLISHED Published: 2024-08-08T22:31:03.812Z Last Updated: 2024-08-15T17:19:10.011Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C) Vendors: Tenda Products: FH1206 Problem Types: CWE-121 Description: A vulnerability was found in Tenda FH1206 1.2.0.8(8155). It has been classified as critical. Affected is the function fromqossetting of the file /goform/qossetting. The manipulation of the argument page leads to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: -
NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.273984 - https://vuldb.com/?ctiid.273984 - https://vuldb.com/?submit.383692 - https://github.com/BeaCox/IoT_vuln/tree/main/tenda/FH1206/qossetting_bof
CVE ID: CVE-2024-7615 State: PUBLISHED Published: 2024-08-08T22:31:05.314Z Last Updated: 2024-08-09T14:49:47.340Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C) Vendors: Tenda Products: FH1206 Problem Types: CWE-121 Description: A vulnerability was found in Tenda FH1206 1.2.0.8. It has been declared as critical. Affected by this vulnerability is the function fromSafeClientFilter/fromSafeMacFilter/fromSafeUrlFilter. The manipulation leads to stack-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA
: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.273985 - https://vuldb.com/?ctiid.273985 - https://vuldb.com/?submit.383693 - https://github.com/BeaCox/IoT_vuln/tree/main/tenda/FH1206/Safe_Client_or_Url_or_Mac_Filter_bof
CVE ID: CVE-2024-7616 State: PUBLISHED Published: 2024-08-08T23:00:06.211Z Last Updated: 2024-08-09T17:20:00.865Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: Edimax Products: IC-6220DC, IC-5150W Problem Types: CWE-77 Description: A vulnerability was found in Edimax IC-6220DC and IC-5150W up to 3.06. It has been rated as critical. Affected by this issue is the function cgiFormString of the file ipcam_cgi. The manipulation of the argument host leads to command injection. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.273986 - h
ot respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.273986 - https://vuldb.com/?ctiid.273986 - https://vuldb.com/?submit.383845 - https://yjz233.notion.site/edimax-IC-6220DC-has-command-injection-vulnerability-in-ipcam_cgi-2029d67721f2473b8cfce5e286a70307?pvs=4 - https://yjz233.notion.site/edimax-IC-5150W-has-command-injection-vulnerability-in-ipcam_cgi-cc72c7b7e2f24ba6a6609b6fcf78df34
CVE ID: CVE-2024-7617 State: PUBLISHED Published: 2024-09-25T02:05:08.929Z Last Updated: 2024-09-25T13:54:54.294Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) Vendors: itpathsolutions Products: Contact Form to Any API Problem Types: CWE-79 Description: The Contact Form to Any API plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Contact Form 7 form fields in all versions up to, and including, 1.2.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP