Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-7772 State: PUBLISHED Published: 2024-09-26T04:29:58.902Z Last Updated: 2024-09-26T14:09:08.257Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: artbees Products: Jupiter X Core Problem Types: CWE-434 Description: The Jupiter X Core plugin for WordPress is vulnerable to arbitrary file uploads due to a mishandled file type validation in the 'validate' function in all versions up to, and including, 4.6.5. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfen
ake remote code execution possible. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/5b546d24-82c1-4598-8926-6e73a4784b38?source=cve - https://plugins.trac.wordpress.org/browser/jupiterx-core/trunk/includes/extensions/raven/includes/modules/forms/classes/ajax-handler.php - https://plugins.trac.wordpress.org/changeset/3139412/
CVE ID: CVE-2024-7773 State: REJECTED Published: 2025-03-20T10:09:13.433Z Last Updated: 2025-04-15T15:49:34.681Z Description: No description available.
CVE ID: CVE-2024-7774 State: PUBLISHED Published: 2024-10-29T12:49:21.165Z Last Updated: 2024-10-29T13:31:38.566Z Severity: MEDIUM (CVSS 6.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) Vendors: langchain-ai Products: langchain-ai/langchainjs Problem Types: CWE-29 Description: A path traversal vulnerability exists in the `getFullPath` method of langchain-ai/langchainjs version 0.2.5. This vulnerability allows attackers to save files anywhere in the filesystem, overwrite existing text files, read `.txt` files, and delete files. The vulnerability is exploited through the `setFileContent`, `getParsedFile`, and `mdelete` methods, which do not properly sanitize user input. Additional Analyst Not
tFileContent`, `getParsedFile`, and `mdelete` methods, which do not properly sanitize user input. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/8fe40685-b714-4191-af7a-3de5e5628cee - https://github.com/langchain-ai/langchainjs/commit/a0fad77d6b569e5872bd4a9d33be0c0785e538a9
CVE ID: CVE-2024-7775 State: PUBLISHED Published: 2024-08-20T03:21:08.498Z Last Updated: 2024-08-20T13:47:52.933Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N) Vendors: bitpressadmin Products: Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder Problem Types: CWE-79 Description: The Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder plugin for WordPress is vulnerable to arbitrary JavaScript file uploads due to missing input validation in the addCustomCode function in versions 2.0 to 2.13.9. This makes it possible for authenticated
ssing input validation in the addCustomCode function in versions 2.0 to 2.13.9. This makes it possible for authenticated attackers, with Administrator-level access and above, to upload arbitrary JavaScript files to the affected site's server. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/3936d7dc-840e-41fc-8af4-db40c0cff660?source=cve - https://plugins.trac.wordpress.org/browser/bit-form/tags/2.13.6/includes/Admin/AdminAjax.php#L1314
CVE ID: CVE-2024-7776 State: PUBLISHED Published: 2025-03-20T10:10:58.740Z Last Updated: 2025-03-20T15:52:00.491Z Severity: HIGH (CVSS 8.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H) Vendors: onnx Products: onnx/onnx Problem Types: CWE-22 Description: A vulnerability in the `download_model` function of the onnx/onnx framework, before and including version 1.16.1, allows for arbitrary file overwrite due to inadequate prevention of path traversal attacks in malicious tar files. This vulnerability can be exploited by an attacker to overwrite files in the user's directory, potentially leading to remote command execution. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://
tentially leading to remote command execution. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/a7a46cf6-1fa0-454b-988c-62d222e83f63
CVE ID: CVE-2024-7777 State: PUBLISHED Published: 2024-08-20T03:21:08.998Z Last Updated: 2024-08-20T13:14:05.606Z Severity: CRITICAL (CVSS 9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:H/A:H) Vendors: bitpressadmin Products: Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder Problem Types: CWE-22 Description: The Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder plugin for WordPress is vulnerable to arbitrary file read and deletion due to insufficient file path validation in multiple functions in versions 2.0 to 2.13.9. This makes it possible for authenticated
ufficient file path validation in multiple functions in versions 2.0 to 2.13.9. This makes it possible for authenticated attackers, with Administrator-level access and above, to read and delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/4deb128d-0163-4a8e-9591-87352f74c3ef?source=cve - https://plugins.trac.wordpress.org/browser/bit-form/tags/2.13.3/includes/Admin/AdminAjax.php#L829 - https://plugins.trac.wordpress.org/browser/bit-form/tags/2.13.3/includes/Admin/AdminAjax.php#L852 -
AdminAjax.php#L829 - https://plugins.trac.wordpress.org/browser/bit-form/tags/2.13.3/includes/Admin/AdminAjax.php#L852 - https://plugins.trac.wordpress.org/browser/bit-form/tags/2.13.3/includes/Admin/AdminAjax.php#L875 - https://plugins.trac.wordpress.org/browser/bit-form/tags/2.13.3/includes/Admin/AdminAjax.php#L898
CVE ID: CVE-2024-7778 State: PUBLISHED Published: 2024-08-22T09:29:30.119Z Last Updated: 2024-08-22T13:23:11.519Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: themeisle Products: Orbit Fox by ThemeIsle Problem Types: CWE-79 Description: The Orbit Fox by ThemeIsle plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 2.10.36 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file. Additional Analyst N
, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/be83c6be-fb6c-462f-b54a-ca12d6d2581f?source=cve - https://plugins.trac.wordpress.org/browser/themeisle-companion/tags/2.10.36/obfx_modules/custom-fonts/custom_fonts_admin.php#L376 - https://wordpress.org/plugins/themeisle-companion/#developers - https://plugins.trac.wordpress.org/changeset/3139233/#file71 - https://plugins.trac.wordpress.org/changeset/3139233/
CVE ID: CVE-2024-7779 State: PUBLISHED Published: 2025-03-20T10:08:52.888Z Last Updated: 2025-10-15T12:50:38.144Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: danswer-ai Products: danswer-ai/danswer Problem Types: CWE-1333 Description: A vulnerability in danswer-ai/danswer version 1 allows an attacker to perform a Regular Expression Denial of Service (ReDoS) by manipulating regular expressions. This can significantly slow down the application's response time and potentially render it completely unusable. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/829f7d9f-8755-4362-bd40-801e4690dcdc
CVE ID: CVE-2024-7780 State: PUBLISHED Published: 2024-08-20T03:21:10.510Z Last Updated: 2024-08-21T19:28:00.702Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: bitpressadmin Products: Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder Problem Types: CWE-89 Description: The Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder plugin for WordPress is vulnerable to generic SQL Injection via the id parameter in versions 2.0 to 2.13.9 due to insufficient escaping on the user-supplied parameter and lack of sufficient preparation o
versions 2.0 to 2.13.9 due to insufficient escaping on the user-supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/73b6b22a-4699-4307-8a03-148dd9e95d36?source=cve - https://plugins.trac.wordpress.org/browser/bit-form/tags/2.13.6/includes/Admin/AdminAjax.php#L1108 - https://plugins.trac.wordpress.org/browser/bit-form/t
/browser/bit-form/tags/2.13.6/includes/Admin/AdminAjax.php#L1108 - https://plugins.trac.wordpress.org/browser/bit-form/tags/2.13.6/includes/Admin/Form/AdminFormHandler.php#L2387 - https://plugins.trac.wordpress.org/browser/bit-form/tags/2.13.6/includes/Core/Messages/EmailTemplateHandler.php#L93
CVE ID: CVE-2024-7781 State: PUBLISHED Published: 2024-09-26T04:29:59.599Z Last Updated: 2024-09-26T14:08:53.334Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: artbees Products: Jupiter X Core Problem Types: CWE-288 Description: The Jupiter X Core plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 4.7.5. This is due to improper authentication via the Social Login widget. This makes it possible for unauthenticated attackers to log in as the first user to have logged in with a social media account, including administrator accounts. Attackers can exploit the vulnerability even if the Social Login element has been d
t, including administrator accounts. Attackers can exploit the vulnerability even if the Social Login element has been disabled, as long as it was previously enabled and used. The vulnerability was partially patched in version 4.7.5, and fully patched in version 4.7.8. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/efd279c2-9e95-45bd-9494-fb53a6333c65?source=cve - https://plugins.trac.wordpress.org/browser/jupiterx-core/trunk/includes/extensions/raven/includes/modules/forms/classes/social-login-handler/google.php - https://plugins.trac.wordpress.org/browser/jupiterx-core/trunk/includes/extensions/raven/includes/modul
ler/google.php - https://plugins.trac.wordpress.org/browser/jupiterx-core/trunk/includes/extensions/raven/includes/modules/forms/classes/social-login-handler/facebook.php - https://plugins.trac.wordpress.org/changeset/3153667/
CVE ID: CVE-2024-7782 State: PUBLISHED Published: 2024-08-20T03:21:11.466Z Last Updated: 2024-09-03T15:14:10.502Z Severity: HIGH (CVSS 8.7 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:H) Vendors: bitpressadmin Products: Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder Problem Types: CWE-22 Description: The Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the iconRemove function in versions 2.0 to 2.13.4. This makes it possible for authenticated attac
ile path validation in the iconRemove function in versions 2.0 to 2.13.4. This makes it possible for authenticated attackers, with Administrator-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/d4da8ead-326f-4c93-b56d-8bfa643d7906?source=cve - https://plugins.trac.wordpress.org/browser/bit-form/tags/2.13.0/includes/Admin/AdminAjax.php#L1271
CVE ID: CVE-2024-7783 State: PUBLISHED Published: 2024-10-29T12:49:34.965Z Last Updated: 2024-10-29T13:27:53.212Z Severity: MEDIUM (CVSS 5.9 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: mintplex-labs Products: mintplex-labs/anything-llm Problem Types: CWE-312 Description: mintplex-labs/anything-llm version latest contains a vulnerability where sensitive information, specifically a password, is improperly stored within a JWT (JSON Web Token) used as a bearer token in single user mode. When decoded, the JWT reveals the password in plaintext. This improper storage of sensitive information poses significant security risks, as an attacker who gains access to the JWT can easily decode it
sensitive information poses significant security risks, as an attacker who gains access to the JWT can easily decode it and retrieve the password. The issue is fixed in version 1.0.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/20e9950f-ad41-4d6b-8bd0-c7f7051695b3 - https://github.com/mintplex-labs/anything-llm/commit/4430ddb05988470bc8f0479e7d07db1f7d4646ba
CVE ID: CVE-2024-7784 State: PUBLISHED Published: 2024-09-10T05:14:33.855Z Last Updated: 2025-03-28T07:23:28.450Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) Vendors: Axis Communications AB Products: AXIS OS Problem Types: CWE-121 Description: During internal Axis Security Development Model (ASDM) threat-modelling, a flaw was found in the protection for device tampering (commonly known as Secure Boot) in AXIS OS making it vulnerable to a sophisticated attack to bypass this protection. To Axis' knowledge, there are no known exploits of the vulnerability at this time. Axis has released patched AXIS OS versions for the highlighted flaw. Please refer to the Axis secu
ability at this time. Axis has released patched AXIS OS versions for the highlighted flaw. Please refer to the Axis security advisory for more information and solution. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.axis.com/dam/public/ba/5f/4e/cve-2024-7784-en-US-448998.pdf
CVE ID: CVE-2024-7785 State: PUBLISHED Published: 2024-09-19T13:30:16.274Z Last Updated: 2024-09-19T13:46:33.766Z Vendors: Ece Software Products: Electronic Ticket System Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Ece Software Electronic Ticket System allows Reflected XSS, Cross-Site Scripting (XSS).This issue affects Electronic Ticket System: before 2024.08. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.usom.gov.tr/bildirim/tr-24-1506
CVE ID: CVE-2024-7786 State: PUBLISHED Published: 2024-09-04T06:00:04.429Z Last Updated: 2025-08-27T12:00:45.823Z Vendors: Unknown Products: Sensei LMS Problem Types: CWE-862 Missing Authorization Description: The Sensei LMS WordPress plugin before 4.24.2 does not properly protect some its REST API routes, allowing unauthenticated attackers to leak email templates. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/f44e6f8f-3ef2-45c9-ae9c-9403305a548a/
CVE ID: CVE-2024-7787 State: PUBLISHED Published: 2024-11-14T08:19:13.009Z Last Updated: 2024-11-14T14:12:11.650Z Vendors: ITG Computer Technology Products: vSRM Supplier Relationship Management System Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in ITG Computer Technology vSRM Supplier Relationship Management System allows Reflected XSS, Cross-Site Scripting (XSS).This issue affects vSRM Supplier Relationship Management System: before 28.08.2024. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.usom.gov.tr/bildirim/tr-24-1853
CVE ID: CVE-2024-7788 State: PUBLISHED Published: 2024-09-17T14:28:36.075Z Last Updated: 2024-10-12T13:05:35.355Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: The Document Foundation Products: LibreOffice Problem Types: CWE-347 Description: Improper Digital Signature Invalidation vulnerability in Zip Repair Mode of The Document Foundation LibreOffice allows Signature forgery vulnerability in LibreOfficeThis issue affects LibreOffice: from 24.2 before < 24.2.5. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.libreoffice.org/about-us/security/advisories/CVE-2024-7788
CVE ID: CVE-2024-7790 State: PUBLISHED Published: 2024-08-14T13:49:42.892Z Last Updated: 2025-03-25T16:38:55.565Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) Vendors: Devikia Products: DevikaAI Description: A stored cross site scripting vulnerabilities exists in DevikaAI from commit 6acce21fb08c3d1123ef05df6a33912bf0ee77c2 onwards via improperly decoded user input. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.tenable.com/security/research/tra-2024-31
CVE ID: CVE-2024-7791 State: PUBLISHED Published: 2024-08-27T10:59:49.364Z Last Updated: 2024-08-27T13:01:11.095Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: xpro Products: 140+ Widgets | Xpro Addons For Elementor – FREE Problem Types: CWE-79 Description: The 140+ Widgets | Xpro Addons For Elementor – FREE plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘arrow’ parameter within the Post Grid widget in all versions up to, and including, 1.4.4.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in
es it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/c6025dd5-a1d7-48cc-90b3-f020d3d2298b?source=cve - https://plugins.trac.wordpress.org/browser/xpro-elementor-addons/trunk/widgets/post-grid/post-grid.php#L1891 - https://wordpress.org/plugins/xpro-elementor-addons/#developers - https://plugins.trac.wordpress.org/changeset/3141892/#file2 - https://plugins.trac.wordpress.org/changeset/3141892/
CVE ID: CVE-2024-7792 State: PUBLISHED Published: 2024-08-14T18:31:04.492Z Last Updated: 2024-08-14T19:38:23.748Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: SourceCodester Products: Task Progress Tracker Problem Types: CWE-89 Description: A vulnerability was found in SourceCodester Task Progress Tracker 1.0. It has been classified as critical. Affected is an unknown function of the file /endpoint/delete-task.php. The manipulation of the argument task leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.274560 -
public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.274560 - https://vuldb.com/?ctiid.274560 - https://vuldb.com/?submit.389360 - https://github.com/joinia/webray.com.cn/blob/main/Task-Progress-Tracker/Task-Progress-Trackersql.md
CVE ID: CVE-2024-7793 State: PUBLISHED Published: 2024-08-14T21:00:06.947Z Last Updated: 2024-08-19T18:41:23.718Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: SourceCodester Products: Task Progress Tracker Problem Types: CWE-79 Description: A vulnerability was found in SourceCodester Task Progress Tracker 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /endpoint/add-task.php. The manipulation of the argument task_name leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http
has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.274561 - https://vuldb.com/?ctiid.274561 - https://vuldb.com/?submit.389362 - https://github.com/joinia/webray.com.cn/blob/main/Task-Progress-Tracker/Task-Progress-Trackerxss.md
CVE ID: CVE-2024-7794 State: PUBLISHED Published: 2024-08-14T21:00:08.612Z Last Updated: 2024-08-19T18:34:32.249Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: itsourcecode Products: Vehicle Management System Problem Types: CWE-89 Description: A vulnerability was found in itsourcecode Vehicle Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file mybill.php. The manipulation of the argument id leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.274562 - https
c and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.274562 - https://vuldb.com/?ctiid.274562 - https://vuldb.com/?submit.389900 - https://github.com/ppp-src/ha/issues/5
CVE ID: CVE-2024-7795 State: PUBLISHED Published: 2024-08-21T16:02:35.051Z Last Updated: 2024-08-22T13:33:48.533Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Autel Products: MaxiCharger AC Elite Business C50 Problem Types: CWE-121 Description: Autel MaxiCharger AC Elite Business C50 AppAuthenExchangeRandomNum Stack-Based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Autel MaxiCharger AC Elite Business C50 EV chargers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of the AppAuthenExch
ication is not required to exploit this vulnerability. The specific flaw exists within the handling of the AppAuthenExchangeRandomNum BLE command. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the device. Was ZDI-CAN-23384. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-24-1154/
CVE ID: CVE-2024-7797 State: PUBLISHED Published: 2024-08-14T23:00:06.334Z Last Updated: 2024-08-15T14:44:51.310Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: SourceCodester Products: Simple Online Bidding System Problem Types: CWE-89 Description: A vulnerability was found in SourceCodester Simple Online Bidding System 1.0. It has been classified as critical. Affected is an unknown function of the file /simple-online-bidding-system/bidding/admin/ajax.php?action=login. The manipulation of the argument username leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP
the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.274650 - https://vuldb.com/?ctiid.274650 - https://vuldb.com/?submit.390290 - https://github.com/Wsstiger/cve/blob/main/Sourcecoster_sql.md