Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-3080 State: PUBLISHED Published: 2024-06-14T02:57:27.002Z Last Updated: 2024-08-01T19:32:42.618Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: ASUS Products: ZenWiFi XT8, ZenWiFi XT8 V2, RT-AX88U, RT-AX58U, RT-AX57, RT-AC86U, RT-AC68U Problem Types: CWE-287 Description: Certain ASUS router models have authentication bypass vulnerability, allowing unauthenticated remote attackers to log in the device. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.twcert.org.tw/tw/cp-132-7859-0e104-1.html - https://www.twcert.org.tw/en/cp-139-7860-760b1-2.html
CVE ID: CVE-2024-3081 State: PUBLISHED Published: 2024-03-29T14:31:05.512Z Last Updated: 2024-08-15T15:45:10.663Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: EasyCorp Products: EasyAdmin Problem Types: CWE-79 Description: A vulnerability was found in EasyCorp EasyAdmin up to 4.8.9. It has been declared as problematic. Affected by this vulnerability is the function Autocomplete of the file assets/js/autocomplete.js of the component Autocomplete. The manipulation of the argument item leads to cross site scripting. The attack can be launched remotely. Upgrading to version 4.8.10 is able to address this issue. The identifier of the patch is 127436e4c3f56276d548070f99e61b7234200a11
to version 4.8.10 is able to address this issue. The identifier of the patch is 127436e4c3f56276d548070f99e61b7234200a11. It is recommended to upgrade the affected component. The identifier VDB-258613 was assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.258613 - https://vuldb.com/?ctiid.258613 - https://github.com/EasyCorp/EasyAdminBundle/pull/5971 - https://github.com/EasyCorp/EasyAdminBundle/pull/6067 - https://github.com/EasyCorp/EasyAdminBundle/commit/127436e4c3f56276d548070f99e61b7234200a11 - https://github.com/EasyCorp/EasyAdminBundle/releases/tag/v4.8.10
CVE ID: CVE-2024-3082 State: PUBLISHED Published: 2024-07-31T13:14:32.092Z Last Updated: 2024-09-30T14:26:27.841Z Severity: MEDIUM (CVSS 4.2 CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Plug&Track Products: Sensor Net Connect V2 Problem Types: CWE-256 Description: A “CWE-256: Plaintext Storage of a Password” affecting the administrative account allows an attacker with physical access to the machine to retrieve the password in cleartext unless specific security measures at other layers (e.g., full-disk encryption) have been enabled. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2024-3082
CVE ID: CVE-2024-3083 State: PUBLISHED Published: 2024-07-31T13:15:35.210Z Last Updated: 2024-09-30T14:06:48.156Z Severity: HIGH (CVSS 8.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:H) Vendors: Plug&Track Products: Sensor Net Connect V2 Problem Types: CWE-352 Description: A “CWE-352: Cross-Site Request Forgery (CSRF)” can be exploited by remote attackers to perform state-changing operations with administrative privileges by luring authenticated victims into visiting a malicious web page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2024-3083
CVE ID: CVE-2024-3084 State: PUBLISHED Published: 2024-03-30T07:31:04.348Z Last Updated: 2024-08-01T19:32:42.624Z Severity: N/A (CVSS 5 AV:N/AC:L/Au:N/C:N/I:P/A:N) Vendors: PHPGurukul Products: Emergency Ambulance Hiring Portal Problem Types: CWE-79 Description: A vulnerability was found in PHPGurukul Emergency Ambulance Hiring Portal 1.0. It has been rated as problematic. This issue affects some unknown processing of the component Hire an Ambulance Page. The manipulation of the argument Patient Name/Relative Name/Relative Phone Number/City/State/Message leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The iden
scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-258677 was assigned to this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.258677 - https://vuldb.com/?ctiid.258677 - https://vuldb.com/?submit.306957 - https://github.com/dhabaleshwar/Open-Source-Vulnerabilities/blob/main/eahp_sxss.md
CVE ID: CVE-2024-3085 State: PUBLISHED Published: 2024-03-30T08:31:04.160Z Last Updated: 2025-03-25T14:37:00.464Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: PHPGurukul Products: Emergency Ambulance Hiring Portal Problem Types: CWE-89 Description: A vulnerability classified as critical has been found in PHPGurukul Emergency Ambulance Hiring Portal 1.0. Affected is an unknown function of the file /admin/login.php of the component Admin Login Page. The manipulation of the argument username leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-258678 is the identifier assigned to this vulnerabilit
The exploit has been disclosed to the public and may be used. VDB-258678 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.258678 - https://vuldb.com/?ctiid.258678 - https://vuldb.com/?submit.306958 - https://github.com/dhabaleshwar/Open-Source-Vulnerabilities/blob/main/eahp_sqli.md
CVE ID: CVE-2024-3086 State: PUBLISHED Published: 2024-03-30T09:00:04.100Z Last Updated: 2024-08-12T13:32:04.691Z Severity: N/A (CVSS 5 AV:N/AC:L/Au:N/C:N/I:P/A:N) Vendors: PHPGurukul Products: Emergency Ambulance Hiring Portal Problem Types: CWE-79 Description: A vulnerability classified as problematic was found in PHPGurukul Emergency Ambulance Hiring Portal 1.0. Affected by this vulnerability is an unknown functionality of the file ambulance-tracking.php of the component Ambulance Tracking Page. The manipulation of the argument searchdata leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identif
he attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-258679. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.258679 - https://vuldb.com/?ctiid.258679 - https://vuldb.com/?submit.306960 - https://github.com/dhabaleshwar/Open-Source-Vulnerabilities/blob/main/eahp_rxss.md
CVE ID: CVE-2024-3087 State: PUBLISHED Published: 2024-03-30T10:31:04.302Z Last Updated: 2024-08-21T22:43:08.381Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: PHPGurukul Products: Emergency Ambulance Hiring Portal Problem Types: CWE-89 Description: A vulnerability, which was classified as critical, has been found in PHPGurukul Emergency Ambulance Hiring Portal 1.0. Affected by this issue is some unknown functionality of the file ambulance-tracking.php of the component Ambulance Tracking Page. The manipulation of the argument searchdata leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of t
. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-258680. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.258680 - https://vuldb.com/?ctiid.258680 - https://vuldb.com/?submit.306961 - https://github.com/dhabaleshwar/Open-Source-Vulnerabilities/blob/main/eahp_rce.md
CVE ID: CVE-2024-3088 State: PUBLISHED Published: 2024-03-30T11:00:05.544Z Last Updated: 2025-08-27T21:23:01.222Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: PHPGurukul Products: Emergency Ambulance Hiring Portal Problem Types: CWE-89 Description: A vulnerability, which was classified as critical, was found in PHPGurukul Emergency Ambulance Hiring Portal 1.0. This affects an unknown part of the file /admin/forgot-password.php of the component Forgot Password Page. The manipulation of the argument username leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-258681 was assigned
he attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-258681 was assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.258681 - https://vuldb.com/?ctiid.258681 - https://vuldb.com/?submit.306962 - https://github.com/dhabaleshwar/Open-Source-Vulnerabilities/blob/main/eahp_forgotpasssqli.md
CVE ID: CVE-2024-3089 State: PUBLISHED Published: 2024-03-30T11:31:03.732Z Last Updated: 2024-08-01T19:32:42.679Z Severity: N/A (CVSS 5 AV:N/AC:L/Au:N/C:N/I:P/A:N) Vendors: PHPGurukul Products: Emergency Ambulance Hiring Portal Problem Types: CWE-352 Description: A vulnerability has been found in PHPGurukul Emergency Ambulance Hiring Portal 1.0 and classified as problematic. This vulnerability affects unknown code of the file /admin/manage-ambulance.php of the component Manage Ambulance Page. The manipulation of the argument del leads to cross-site request forgery. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-258682 is the identifier
ck can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-258682 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.258682 - https://vuldb.com/?ctiid.258682 - https://vuldb.com/?submit.306963 - https://github.com/dhabaleshwar/Open-Source-Vulnerabilities/blob/main/eahp_csrf.md
CVE ID: CVE-2024-3090 State: PUBLISHED Published: 2024-03-30T13:00:04.772Z Last Updated: 2024-08-21T22:42:39.186Z Severity: N/A (CVSS 3.3 AV:N/AC:L/Au:M/C:N/I:P/A:N) Vendors: PHPGurukul Products: Emergency Ambulance Hiring Portal Problem Types: CWE-79 Description: A vulnerability was found in PHPGurukul Emergency Ambulance Hiring Portal 1.0 and classified as problematic. This issue affects some unknown processing of the file /admin/add-ambulance.php of the component Add Ambulance Page. The manipulation of the argument Ambulance Reg No/Driver Name leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated i
ng. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-258683. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.258683 - https://vuldb.com/?ctiid.258683 - https://vuldb.com/?submit.306964 - https://github.com/dhabaleshwar/Open-Source-Vulnerabilities/blob/main/eahp_authsxss.md
CVE ID: CVE-2024-3091 State: PUBLISHED Published: 2024-03-30T13:31:03.574Z Last Updated: 2024-08-01T19:32:42.873Z Severity: N/A (CVSS 3.3 AV:N/AC:L/Au:M/C:N/I:P/A:N) Vendors: PHPGurukul Products: Emergency Ambulance Hiring Portal Problem Types: CWE-79 Description: A vulnerability was found in PHPGurukul Emergency Ambulance Hiring Portal 1.0. It has been classified as problematic. Affected is an unknown function of the file /admin/search.php of the component Search Request Page. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-258684. Additiona
exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-258684. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.258684 - https://vuldb.com/?ctiid.258684 - https://vuldb.com/?submit.306965 - https://github.com/dhabaleshwar/Open-Source-Vulnerabilities/blob/main/eahp_authrxss.md
CVE ID: CVE-2024-3092 State: PUBLISHED Published: 2024-04-12T00:53:11.346Z Last Updated: 2025-11-20T04:12:24.475Z Severity: HIGH (CVSS 8.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N) Vendors: GitLab Products: GitLab Problem Types: CWE-79 Description: An issue has been discovered in GitLab CE/EE affecting all versions starting from 16.9 before 16.9.4, all versions starting from 16.10 before 16.10.2. A payload may lead to a Stored XSS while using the diff viewer, allowing attackers to perform arbitrary actions on behalf of victims. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/452510 - https://hackerone
ichment: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/452510 - https://hackerone.com/reports/2441257
CVE ID: CVE-2024-3093 State: REJECTED Published: 2024-04-09T18:58:41.504Z Last Updated: 2024-05-07T12:19:15.587Z Description: No description available.
CVE ID: CVE-2024-3094 State: PUBLISHED Published: 2024-03-29T16:51:12.588Z Last Updated: 2025-11-20T07:17:48.594Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: Red Hat Products: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat JBoss Enterprise Application Platform 8 Problem Types: CWE-506 Description: Malicious code was discovered in the upstream tarballs of xz, starting with version 5.6.0. Through a series of complex obfuscations, the liblzma build process extracts a prebuilt object file from a disguised test file existing in the source code, which is then
lzma build process extracts a prebuilt object file from a disguised test file existing in the source code, which is then used to modify specific functions in the liblzma code. This results in a modified liblzma library that can be used by any software linked against this library, intercepting and modifying the data interaction with this library. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://access.redhat.com/security/cve/CVE-2024-3094 - https://bugzilla.redhat.com/show_bug.cgi?id=2272210 - https://www.openwall.com/lists/oss-security/2024/03/29/4 - https://www.redhat.com/en/blog/urgent-security-alert-fedora-41-and-rawhide-users
CVE ID: CVE-2024-3095 State: PUBLISHED Published: 2024-06-06T18:28:56.403Z Last Updated: 2024-08-01T19:32:42.601Z Severity: MEDIUM (CVSS 4.8 CVSS:3.0/AV:P/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N) Vendors: langchain-ai Products: langchain-ai/langchain Problem Types: CWE-918 Description: A Server-Side Request Forgery (SSRF) vulnerability exists in the Web Research Retriever component of langchain-ai/langchain version 0.1.5. The vulnerability arises because the Web Research Retriever does not restrict requests to remote internet addresses, allowing it to reach local addresses. This flaw enables attackers to execute port scans, access local services, and in some scenarios, read instance metadata from clo
w enables attackers to execute port scans, access local services, and in some scenarios, read instance metadata from cloud environments. The vulnerability is particularly concerning as it can be exploited to abuse the Web Explorer server as a proxy for web attacks on third parties and interact with servers in the local network, including reading their response data. This could potentially lead to arbitrary code execution, depending on the nature of the local services. The vulnerability is limited to GET requests, as POST requests are not possible, but the impact on confidentiality, integrity, and availability is significant due to the potential for stolen credentials and state-changing inter
tiality, integrity, and availability is significant due to the potential for stolen credentials and state-changing interactions with internal APIs. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://huntr.com/bounties/e62d4895-2901-405b-9559-38276b6a5273
CVE ID: CVE-2024-3096 State: PUBLISHED Published: 2024-04-29T03:42:04.093Z Last Updated: 2025-11-04T17:19:57.320Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) Vendors: PHP Group Products: PHP Problem Types: CWE-20 Description: In PHP version 8.1.* before 8.1.28, 8.2.* before 8.2.18, 8.3.* before 8.3.5, if a password stored with password_hash() starts with a null byte (\x00), testing a blank string as the password via password_verify() will incorrectly return true. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/php/php-src/security/advisories/GHSA-h746-cjrr-wfmr - http://www.openwall.com/lists/oss-securi
ces: - https://github.com/php/php-src/security/advisories/GHSA-h746-cjrr-wfmr - http://www.openwall.com/lists/oss-security/2024/04/12/11 - https://lists.debian.org/debian-lts-announce/2024/05/msg00005.html - https://security.netapp.com/advisory/ntap-20240510-0010/
CVE ID: CVE-2024-3097 State: PUBLISHED Published: 2024-04-09T18:58:58.660Z Last Updated: 2024-08-01T19:32:42.726Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: smub Products: WordPress Gallery Plugin – NextGEN Gallery Problem Types: CWE-862 Missing Authorization Description: The WordPress Gallery Plugin – NextGEN Gallery plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the get_item function in versions up to, and including, 3.59. This makes it possible for unauthenticated attackers to extract sensitive data including EXIF and other metadata of any image uploaded through the plugin. Additional Analyst No
extract sensitive data including EXIF and other metadata of any image uploaded through the plugin. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/75f87f99-9f0d-46c2-a6f1-3c1ea0176303?source=cve - https://zpbrent.github.io/pocs/8-plugin-nextgen-gallery-InfoDis-20240327.mp4 - https://plugins.trac.wordpress.org/browser/nextgen-gallery/trunk/src/REST/Admin/Block.php#L40 - https://plugins.trac.wordpress.org/changeset/3063940/nextgen-gallery/trunk/src/REST/Admin/Block.php?old=3003333&old_path=nextgen-gallery%2Ftrunk%2Fsrc%2FREST%2FAdmin%2FBlock.php
CVE ID: CVE-2024-3098 State: PUBLISHED Published: 2024-04-10T17:07:56.501Z Last Updated: 2024-08-01T19:32:42.914Z Severity: CRITICAL (CVSS 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: run-llama Products: run-llama/llama_index Problem Types: CWE-94 Description: A vulnerability was identified in the `exec_utils` class of the `llama_index` package, specifically within the `safe_eval` function, allowing for prompt injection leading to arbitrary code execution. This issue arises due to insufficient validation of input, which can be exploited to bypass method restrictions and execute unauthorized code. The vulnerability is a bypass of the previously addressed CVE-2023-39662, demonstr
ctions and execute unauthorized code. The vulnerability is a bypass of the previously addressed CVE-2023-39662, demonstrated through a proof of concept that creates a file on the system by exploiting the flaw. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://huntr.com/bounties/1bce0d61-ad03-4b22-bc32-8f99f92974e7 - https://github.com/run-llama/llama_index/commit/5fbcb5a8b9f20f81b791c7fc8849e352613ab475
CVE ID: CVE-2024-3099 State: PUBLISHED Published: 2024-06-06T18:08:16.402Z Last Updated: 2024-08-01T19:32:42.675Z Severity: MEDIUM (CVSS 5.4 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L) Vendors: mlflow Products: mlflow/mlflow Problem Types: CWE-475 Description: A vulnerability in mlflow/mlflow version 2.11.1 allows attackers to create multiple models with the same name by exploiting URL encoding. This flaw can lead to Denial of Service (DoS) as an authenticated user might not be able to use the intended model, as it will open a different model each time. Additionally, an attacker can exploit this vulnerability to perform data model poisoning by creating a model with the same name, potential
ttacker can exploit this vulnerability to perform data model poisoning by creating a model with the same name, potentially causing an authenticated user to become a victim by using the poisoned model. The issue stems from inadequate validation of model names, allowing for the creation of models with URL-encoded names that are treated as distinct from their URL-decoded counterparts. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://huntr.com/bounties/8d96374a-ce8d-480e-9cb0-0a7e5165c24a
CVE ID: CVE-2024-3100 State: PUBLISHED Published: 2024-09-13T17:26:33.357Z Last Updated: 2024-09-17T14:38:51.949Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Lenovo Products: 100w Gen 3 Laptop (Lenovo) BIOS, 100w Gen 4 Laptop (Lenovo) BIOS, 13w Yoga (Type 82S1, 82S2) Laptop (Lenovo) BIOS, 13w Yoga Gen 2 (Type 82YR, 82YS) Laptop (Lenovo) BIOS, 14W Gen 2 Laptop (Lenovo) BIOS, 300w Gen 3 Laptop (Lenovo) BIOS, 300w Yoga Gen 4 Laptop (Lenovo) BIOS, 500w Yoga Gen 4 Laptop (Lenovo) BIOS, Flex 5-14ITL05 Laptop (ideapad) BIOS, Flex 5-15ITL05 Laptop (ideapad) BIOS, IdeaPad 1 14ALC7 Laptop BIOS, IdeaPad 1 15ALC7 Laptop BIOS, IdeaPad 1-11IGL05 Laptop BIOS, IdeaPad 1
top (ideapad) BIOS, IdeaPad 1 14ALC7 Laptop BIOS, IdeaPad 1 15ALC7 Laptop BIOS, IdeaPad 1-11IGL05 Laptop BIOS, IdeaPad 1-14IGL05 Laptop BIOS, IdeaPad 3 14ABA7 Laptop BIOS, IdeaPad 3 15ABA7 Laptop BIOS, IdeaPad 3 17ABA7 Laptop BIOS, IdeaPad 3-14ALC6 Laptop BIOS, IdeaPad 3-15ALC6 Laptop BIOS, IdeaPad 3-17ALC6 Laptop BIOS, ideapad 5-15ALC05 Laptop BIOS, IdeaPad Flex 5 14ABR8 BIOS, IdeaPad Flex 5 14ALC7 Laptop BIOS, IdeaPad Flex 5 14IAU7 Laptop BIOS, IdeaPad Flex 5 14IRU8 BIOS, IdeaPad Flex 5 16ABR8 BIOS, IdeaPad Flex 5 16ALC7 BIOS, IdeaPad Flex 5 16IAU7 BIOS, IdeaPad Flex 5 16IRU8 BIOS, IdeaPad Slim 3 14ABR8 BIOS, IdeaPad Slim 3 14AMN8 BIOS, IdeaPad Slim 3 15ABR8 BIOS, IdeaPad Slim 3 15AMN8 BIO
IRU8 BIOS, IdeaPad Slim 3 14ABR8 BIOS, IdeaPad Slim 3 14AMN8 BIOS, IdeaPad Slim 3 15ABR8 BIOS, IdeaPad Slim 3 15AMN8 BIOS, IdeaPad Slim 3 16ABR8 BIOS, IdeaPad Slim 5 Light 14ABR8 BIOS, K14 G2 IRU BIOS, Lenovo Flex 7 14IAU7 BIOS, Lenovo Flex 7 14IRU8 BIOS, Lenovo V14 G3 ABA Laptop BIOS, Lenovo V14 G4 ABP BIOS, Lenovo V14 G4 AMN BIOS, Lenovo V15 G3 ABA Laptop BIOS, Lenovo V15 G4 ABP BIOS, Lenovo V15 G4 AMN BIOS, ThinkBook 13s G4 ARB BIOS, ThinkBook 13s G4 IAP BIOS, ThinkBook 13x G2 IAP Laptop BIOS, ThinkBook 14 G6 ABP BIOS, ThinkBook 14 G6 IRL BIOS, ThinkBook 16 G6 ABP BIOS, ThinkBook 16 G6 IRL BIOS, V14 G2-ALC Laptop (Lenovo) BIOS, V15 G2-ALC Laptop (Lenovo) BIOS, Yoga Slim 7 Pro-14ACH5 Lapto
ThinkBook 16 G6 IRL BIOS, V14 G2-ALC Laptop (Lenovo) BIOS, V15 G2-ALC Laptop (Lenovo) BIOS, Yoga Slim 7 Pro-14ACH5 Laptop (ideapad) BIOS, Yoga Slim 7 Pro-14ACH5 O Laptop (ideapad) BIOS Problem Types: CWE-121 Description: A potential buffer overflow vulnerability was reported in some Lenovo Notebook products that could allow a local attacker with elevated privileges to execute arbitrary code. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.lenovo.com/us/en/product_security/LEN-165524
CVE ID: CVE-2024-3101 State: PUBLISHED Published: 2024-04-10T17:08:08.472Z Last Updated: 2024-08-21T21:13:02.316Z Severity: MEDIUM (CVSS 6.7 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L) Vendors: mintplex-labs Products: mintplex-labs/anything-llm Problem Types: CWE-20 Description: In mintplex-labs/anything-llm, an improper input validation vulnerability allows attackers to escalate privileges by deactivating 'Multi-User Mode'. By sending a specially crafted curl request with the 'multi_user_mode' parameter set to false, an attacker can deactivate 'Multi-User Mode'. This action permits the creation of a new admin user without requiring a password, leading to unauthorized administrative access