Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-8131 State: PUBLISHED Published: 2024-08-24T17:31:05.870Z Last Updated: 2024-08-26T20:30:42.009Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: D-Link Products: DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05, DNS-1550-04 Problem Types: CWE-77 Description: A vulnerability was found in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20240814 and classified as c
R-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20240814 and classified as critical. Affected by this issue is the function module_enable_disable of the file /cgi-bin/apkg_mgr.cgi of the component HTTP POST Request Handler. The manipulation of the argument f_module_name leads to command injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: Vendor was contacted early and confirmed that the product is end-of-life. It should be retired and replaced. Additional Analyst Notes: - CISA ADP Vulnrichmen
med that the product is end-of-life. It should be retired and replaced. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.275702 - https://vuldb.com/?ctiid.275702 - https://vuldb.com/?submit.396292 - https://github.com/BuaaIOTTeam/Iot_Dlink_NAS/blob/main/DNS_module_enable_disable.md - https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10383 - https://www.dlink.com/
CVE ID: CVE-2024-8132 State: PUBLISHED Published: 2024-08-24T18:00:05.836Z Last Updated: 2024-08-26T15:54:41.469Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: D-Link Products: DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05, DNS-1550-04 Problem Types: CWE-77 Description: A vulnerability was found in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20240814. It has been classi
R-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20240814. It has been classified as critical. This affects the function webdav_mgr of the file /cgi-bin/webdav_mgr.cgi of the component HTTP POST Request Handler. The manipulation of the argument f_path leads to command injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: Vendor was contacted early and confirmed that the product is end-of-life. It should be retired and replaced. Additional Analyst Notes: - CISA ADP Vulnrichment: Refere
the product is end-of-life. It should be retired and replaced. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.275703 - https://vuldb.com/?ctiid.275703 - https://vuldb.com/?submit.396293 - https://github.com/BuaaIOTTeam/Iot_Dlink_NAS/blob/main/DNS_webdav_mgr.md - https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10383 - https://www.dlink.com/
CVE ID: CVE-2024-8133 State: PUBLISHED Published: 2024-08-24T19:00:06.248Z Last Updated: 2024-08-26T13:15:17.599Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: D-Link Products: DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05, DNS-1550-04 Problem Types: CWE-77 Description: A vulnerability was found in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20240814. It has been declar
R-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20240814. It has been declared as critical. This vulnerability affects the function cgi_FMT_R5_SpareDsk_DiskMGR of the file /cgi-bin/hd_config.cgi of the component HTTP POST Request Handler. The manipulation of the argument f_source_dev leads to command injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: Vendor was contacted early and confirmed that the product is end-of-life. It should be retired and replaced. Additional Analyst Notes: - CISA
arly and confirmed that the product is end-of-life. It should be retired and replaced. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.275704 - https://vuldb.com/?ctiid.275704 - https://vuldb.com/?submit.396295 - https://github.com/BuaaIOTTeam/Iot_Dlink_NAS/blob/main/DNS_cgi_FMT_R5_SpareDsk_DiskMGR.md - https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10383 - https://www.dlink.com/
CVE ID: CVE-2024-8134 State: PUBLISHED Published: 2024-08-24T20:00:06.287Z Last Updated: 2024-08-26T14:41:17.128Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: D-Link Products: DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05, DNS-1550-04 Problem Types: CWE-77 Description: A vulnerability was found in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20240814. It has been rated
R-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20240814. It has been rated as critical. This issue affects the function cgi_FMT_Std2R5_1st_DiskMGR of the file /cgi-bin/hd_config.cgi of the component HTTP POST Request Handler. The manipulation of the argument f_source_dev leads to command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: Vendor was contacted early and confirmed that the product is end-of-life. It should be retired and replaced. Additional Analyst Notes: - CISA ADP Vulnrich
firmed that the product is end-of-life. It should be retired and replaced. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.275705 - https://vuldb.com/?ctiid.275705 - https://vuldb.com/?submit.396296 - https://github.com/BuaaIOTTeam/Iot_Dlink_NAS/blob/main/DNS_cgi_FMT_Std2R5_1st_DiskMGR.md - https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10383 - https://www.dlink.com/
CVE ID: CVE-2024-8135 State: PUBLISHED Published: 2024-08-24T21:31:04.333Z Last Updated: 2024-08-26T17:29:08.496Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: Go-Tribe Products: gotribe Problem Types: CWE-798 Description: A vulnerability classified as critical has been found in Go-Tribe gotribe up to cd3ccd32cd77852c9ea73f986eaf8c301cfb6310. Affected is the function Sign of the file pkg/token/token.go. The manipulation of the argument config.key leads to hard-coded credentials. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The patch is identified as 4fb9b9e8
oduct. Therefore, no version details of affected nor updated releases are available. The patch is identified as 4fb9b9e80a2beedd09d9fde4b9cf5bd510baf18f. It is recommended to apply a patch to fix this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.275706 - https://vuldb.com/?ctiid.275706 - https://vuldb.com/?submit.396310 - https://github.com/Go-Tribe/gotribe/issues/1 - https://github.com/Go-Tribe/gotribe/issues/1#issuecomment-2307205980 - https://github.com/Go-Tribe/gotribe/commit/4fb9b9e80a2beedd09d9fde4b9cf5bd510baf18f
CVE ID: CVE-2024-8136 State: PUBLISHED Published: 2024-08-24T22:00:06.068Z Last Updated: 2024-08-26T13:14:58.934Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: SourceCodester Products: Record Management System Problem Types: CWE-79 Description: A vulnerability, which was classified as problematic, was found in SourceCodester Record Management System 1.0. This affects an unknown part of the file sort1_user.php. The manipulation of the argument position leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.275
o the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.275709 - https://vuldb.com/?ctiid.275709 - https://vuldb.com/?submit.396486 - https://github.com/acmglz/bug1_report/blob/main/Record-Management-System-1.md - https://www.sourcecodester.com/
CVE ID: CVE-2024-8137 State: PUBLISHED Published: 2024-08-24T23:00:06.187Z Last Updated: 2024-08-26T17:26:52.868Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: SourceCodester Products: Record Management System Problem Types: CWE-79 Description: A vulnerability has been found in SourceCodester Record Management System 1.0 and classified as problematic. This vulnerability affects unknown code of the file search_user.php. The manipulation of the argument search leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.275710
he public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.275710 - https://vuldb.com/?ctiid.275710 - https://vuldb.com/?submit.396487 - https://github.com/acmglz/bug1_report/blob/main/Record-Management-System-2.md - https://www.sourcecodester.com/
CVE ID: CVE-2024-8138 State: PUBLISHED Published: 2024-08-25T00:00:06.105Z Last Updated: 2024-08-26T13:46:25.673Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: code-projects Products: Pharmacy Management System Problem Types: CWE-89 Description: A vulnerability, which was classified as critical, was found in code-projects Pharmacy Management System 1.0. Affected is the function editManager of the file /index.php?action=editManager of the component Parameter Handler. The manipulation of the argument id as part of String leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Continious delivery with rol
o launch the attack remotely. The exploit has been disclosed to the public and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.275718 - https://vuldb.com/?ctiid.275718 - https://vuldb.com/?submit.396817 - https://github.com/SYQGITHUB/cve/blob/main/sql1.md - https://code-projects.org/
CVE ID: CVE-2024-8139 State: PUBLISHED Published: 2024-08-25T01:00:05.417Z Last Updated: 2024-08-26T15:28:26.887Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: itsourcecode Products: E-Commerce Website Problem Types: CWE-89 Description: A vulnerability has been found in itsourcecode E-Commerce Website 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file search_list.php. The manipulation of the argument user leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.275719 - https
c and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.275719 - https://vuldb.com/?ctiid.275719 - https://vuldb.com/?submit.396842 - https://github.com/ppp-src/ha/issues/7 - https://itsourcecode.com/
CVE ID: CVE-2024-8140 State: PUBLISHED Published: 2024-08-25T01:31:05.012Z Last Updated: 2024-08-26T15:46:37.359Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: SourceCodester Products: Task Progress Tracker Problem Types: CWE-79 Description: A vulnerability was found in SourceCodester Task Progress Tracker 1.0 and classified as problematic. Affected by this issue is some unknown functionality of the file update-task.php. The manipulation of the argument task_name leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.27
to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.275720 - https://vuldb.com/?ctiid.275720 - https://vuldb.com/?submit.396892 - https://github.com/jadu101/CVE/blob/main/SourceCodester_Task_Progress_Tracker_Update_Task_XSS.md - https://www.sourcecodester.com/
CVE ID: CVE-2024-8141 State: PUBLISHED Published: 2024-08-25T02:00:04.883Z Last Updated: 2024-08-26T12:16:25.227Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: SourceCodester Products: Daily Calories Monitoring Tool Problem Types: CWE-79 Description: A vulnerability was found in SourceCodester Daily Calories Monitoring Tool 1.0. It has been classified as problematic. This affects an unknown part of the file /endpoint/add-calorie.php. The manipulation of the argument calorie_date/calorie_name leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment
emotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.275721 - https://vuldb.com/?ctiid.275721 - https://vuldb.com/?submit.396895 - https://github.com/jadu101/CVE/blob/main/SourceCodester_Daily_Calories_Monitoring_Tool_add_calorie_XSS.md - https://www.sourcecodester.com/
CVE ID: CVE-2024-8142 State: PUBLISHED Published: 2024-08-25T02:31:04.486Z Last Updated: 2024-08-26T15:38:20.262Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: SourceCodester Products: Daily Calories Monitoring Tool Problem Types: CWE-79 Description: A vulnerability was found in SourceCodester Daily Calories Monitoring Tool 1.0. It has been declared as problematic. This vulnerability affects unknown code of the file /endpoint/delete-calorie.php. The manipulation of the argument calorie leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: -
loit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.275722 - https://vuldb.com/?ctiid.275722 - https://vuldb.com/?submit.396899 - https://github.com/jadu101/CVE/blob/main/SourceCodester_Daily_Calories_Monitoring_Tool_delete_calorie_XSS.md - https://www.sourcecodester.com/
CVE ID: CVE-2024-8143 State: PUBLISHED Published: 2024-10-29T12:49:09.525Z Last Updated: 2024-10-29T13:23:01.857Z Severity: MEDIUM (CVSS 6.5 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: gaizhenbiao Products: gaizhenbiao/chuanhuchatgpt Problem Types: CWE-1057 Description: In the latest version (20240628) of gaizhenbiao/chuanhuchatgpt, an issue exists in the /file endpoint that allows authenticated users to access the chat history of other users. When a user logs in, a directory is created in the history folder with the user's name. By manipulating the /file endpoint, an authenticated user can enumerate and access files in other users' directories, leading to unauthorized access to p
t, an authenticated user can enumerate and access files in other users' directories, leading to unauthorized access to private chat histories. This vulnerability can be exploited to read any user's private chat history. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/71c5ea4b-524a-4173-8fd4-2fbabd69502e - https://github.com/gaizhenbiao/chuanhuchatgpt/commit/ccc7479ace5c9e1a1d9f4daf2e794ffd3865fc2b
CVE ID: CVE-2024-8144 State: PUBLISHED Published: 2024-08-25T03:31:03.994Z Last Updated: 2024-08-26T16:24:27.546Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: n/a Products: ClassCMS Problem Types: CWE-79 Description: A vulnerability classified as problematic was found in ClassCMS 4.8. Affected by this vulnerability is an unknown functionality of the file /index.php/admin of the component Logo Handler. The manipulation leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.275725 - https://vuldb.com/?ctiid.275725 - http
lyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.275725 - https://vuldb.com/?ctiid.275725 - https://vuldb.com/?submit.397217 - https://github.com/acmglz/bug2_report/blob/main/classcms_xss.md
CVE ID: CVE-2024-8145 State: PUBLISHED Published: 2024-08-25T05:31:04.029Z Last Updated: 2024-08-26T13:48:34.820Z Severity: N/A (CVSS 3.3 AV:N/AC:L/Au:M/C:N/I:P/A:N) Vendors: n/a Products: ClassCMS Problem Types: CWE-80 Description: A vulnerability, which was classified as problematic, has been found in ClassCMS 4.8. Affected by this issue is some unknown functionality of the file /index.php/admin of the component Article Handler. The manipulation of the argument Title leads to basic cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.275
o the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.275726 - https://vuldb.com/?ctiid.275726 - https://vuldb.com/?submit.397219 - https://github.com/acmglz/bug2_report/blob/main/classcms_url_jump.md
CVE ID: CVE-2024-8146 State: PUBLISHED Published: 2024-08-25T08:00:04.464Z Last Updated: 2024-08-26T15:36:11.396Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: code-projects Products: Pharmacy Management System Problem Types: CWE-89 Description: A vulnerability has been found in code-projects Pharmacy Management System 1.0 and classified as critical. This vulnerability affects unknown code of the file /index.php?action=editSalesman. The manipulation of the argument id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.2
to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.275728 - https://vuldb.com/?ctiid.275728 - https://vuldb.com/?submit.397417 - https://github.com/maqingnan/cve/blob/main/sql1.md - https://code-projects.org/
CVE ID: CVE-2024-8147 State: PUBLISHED Published: 2024-08-25T09:00:06.514Z Last Updated: 2024-08-26T12:14:14.861Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: code-projects Products: Pharmacy Management System Problem Types: CWE-89 Description: A vulnerability was found in code-projects Pharmacy Management System 1.0 and classified as critical. This issue affects some unknown processing of the file /index.php?action=editPharmacist. The manipulation of the argument id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.2
to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.275729 - https://vuldb.com/?ctiid.275729 - https://vuldb.com/?submit.397418 - https://github.com/maqingnan/cve/blob/main/sql2.md - https://code-projects.org/
CVE ID: CVE-2024-8148 State: PUBLISHED Published: 2024-10-04T17:11:43.279Z Last Updated: 2025-04-10T19:11:58.566Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: Esri Products: Portal for ArcGIS Problem Types: CWE-601 Description: There is an unvalidated redirect vulnerability in Esri Portal for ArcGIS 11.2 and below that may allow a remote, unauthenticated attacker to craft a URL that could redirect a victim to an arbitrary website, simplifying phishing attacks. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.esri.com/arcgis-blog/products/trust-arcgis/administration/portal-for-arcgis-security-2024-update-2-released/
CVE ID: CVE-2024-8149 State: PUBLISHED Published: 2024-10-04T17:14:39.010Z Last Updated: 2024-10-08T16:36:22.657Z Severity: MEDIUM (CVSS 4.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N) Vendors: Esri Products: Portal for ArcGIS Problem Types: CWE-79 Description: There is a reflected XSS vulnerability in Esri Portal for ArcGIS versions 11.1 and 11.2 which may allow a remote, unauthenticated attacker to create a crafted link which when clicked could potentially execute arbitrary JavaScript code in the victim’s browser. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.esri.com/arcgis-blog/products/trust-arcgis/administration/portal-for-arcgis-security-2024-update-2-
ences: - https://www.esri.com/arcgis-blog/products/trust-arcgis/administration/portal-for-arcgis-security-2024-update-2-released/
CVE ID: CVE-2024-8150 State: PUBLISHED Published: 2024-08-25T22:00:04.814Z Last Updated: 2024-08-26T19:12:22.872Z Severity: N/A (CVSS 5.8 AV:N/AC:L/Au:M/C:P/I:P/A:P) Vendors: ContiNew Products: Admin Problem Types: CWE-89 Description: A vulnerability was found in ContiNew Admin 3.2.0 and classified as critical. Affected by this issue is the function top.continew.starter.extension.crud.controller.BaseController#page of the file /api/system/user?deptId=1&page=1&size=10. The manipulation of the argument sort leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. NOTE: The vendor was contacted early about this disclosure but did
oit has been disclosed to the public and may be used. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.275738 - https://vuldb.com/?ctiid.275738 - https://vuldb.com/?submit.391229 - https://github.com/Chiexf/cve/issues/2
CVE ID: CVE-2024-8151 State: PUBLISHED Published: 2024-08-25T22:00:06.910Z Last Updated: 2024-08-26T15:34:28.801Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: SourceCodester Products: Interactive Map with Marker Problem Types: CWE-79 Description: A vulnerability was found in SourceCodester Interactive Map with Marker 1.0. It has been classified as problematic. This affects an unknown part of the file /endpoint/delete-mark.php. The manipulation of the argument mark leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vul