Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-25344 State: PUBLISHED Published: 2024-02-26T00:00:00 Last Updated: 2024-08-02T18:25:20.180Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting vulnerability in ITFlow.org before commit v.432488eca3998c5be6b6b9e8f8ba01f54bc12378 allows a remtoe attacker to execute arbitrary code and obtain sensitive information via the settings.php, settings+company.php, settings_defaults.php,settings_integrations.php, settings_invoice.php, settings_localization.php, settings_mail.php components. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://itflow.org/ - https://github.com/itflow-org/itflow/commit/432488eca3998
: - CISA ADP Vulnrichment: References: - https://itflow.org/ - https://github.com/itflow-org/itflow/commit/432488eca3998c5be6b6b9e8f8ba01f54bc12378 - https://github.com/itflow-org/itflow/commit/8068cb6081e4760860a634c1066b2c64d0ee2d46 - https://packetstormsecurity.com/files/177224/ITFlow-Cross-Site-Request-Forgery.html
CVE ID: CVE-2024-25350 State: PUBLISHED Published: 2024-02-28T00:00:00.000Z Last Updated: 2025-04-22T15:59:21.882Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL Injection vulnerability in /zms/admin/edit-ticket.php in PHPGurukul Zoo Management System 1.0 via tickettype and tprice parameters. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/0xQRx/VulnerabilityResearch/blob/master/2024/ZooManagementSystem-SQL_Injection_Edit_Ticket.md
CVE ID: CVE-2024-25351 State: PUBLISHED Published: 2024-02-28T00:00:00 Last Updated: 2024-08-26T19:32:59.810Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL Injection vulnerability in /zms/admin/changeimage.php in PHPGurukul Zoo Management System 1.0 allows attackers to run arbitrary SQL commands via the editid parameter. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/0xQRx/VulnerabilityResearch/blob/master/2024/ZooManagementSystem-SQL_Injection_Change_Image.md
CVE ID: CVE-2024-25354 State: PUBLISHED Published: 2024-03-27T00:00:00.000Z Last Updated: 2025-03-14T18:12:35.320Z Vendors: n/a Products: n/a Problem Types: n/a Description: RegEx Denial of Service in domain-suffix 1.0.8 allows attackers to crash the application via crafted input to the parse function. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gist.github.com/6en6ar/c3b11b4058b8e2bc54717408d451fb79
CVE ID: CVE-2024-25355 State: PUBLISHED Published: 2024-05-01T00:00:00 Last Updated: 2024-08-01T23:44:08.608Z Vendors: n/a Products: n/a Problem Types: n/a Description: s3-url-parser 1.0.3 is vulnerable to Denial of service via the regexes component. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://gist.github.com/6en6ar/a4977866c59cbcfc716f0f2717b812bf
CVE ID: CVE-2024-25359 State: PUBLISHED Published: 2024-03-06T00:00:00 Last Updated: 2024-08-02T19:46:36.031Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in zuoxingdong lagom v.0.1.2 allows a local attacker to execute arbitrary code via the pickle_load function of the serialize.py file. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/bayuncao/vul-cve-10
CVE ID: CVE-2024-25360 State: PUBLISHED Published: 2024-02-12T00:00:00 Last Updated: 2024-10-30T19:14:43.119Z Vendors: n/a Products: n/a Problem Types: n/a Description: A hidden interface in Motorola CX2L Router firmware v1.0.1 leaks information regarding the SystemWizardStatus component via sending a crafted request to device_web_ip. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/leetsun/Hints/tree/main/moto-CX2L/4
CVE ID: CVE-2024-25366 State: PUBLISHED Published: 2024-02-20T00:00:00 Last Updated: 2024-08-16T17:28:45.872Z Vendors: n/a Products: n/a Problem Types: n/a Description: Buffer Overflow vulnerability in mz-automation.de libiec61859 v.1.4.0 allows a remote attacker to cause a denial of service via the mmsServer_handleGetNameListRequest function to the mms_getnamelist_service component. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/mz-automation/libiec61850 - https://github.com/mz-automation/libiec61850/issues/492 - https://www.mz-automation.de/
CVE ID: CVE-2024-25369 State: PUBLISHED Published: 2024-02-22T00:00:00 Last Updated: 2024-11-12T18:04:46.878Z Vendors: n/a Products: n/a Problem Types: n/a Description: A reflected Cross-Site Scripting (XSS) vulnerability in FUEL CMS 1.5.2allows attackers to run arbitrary code via crafted string after the group_id parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/liyako/vulnerability/blob/main/POC/FUEL%20CMS%20Reflected%20Cross-Site%20Scripting%20%28XSS%29.md
CVE ID: CVE-2024-25371 State: PUBLISHED Published: 2025-01-10T00:00:00 Last Updated: 2025-01-14T14:40:51.255Z Vendors: n/a Products: n/a Problem Types: n/a Description: Gramine before a390e33e16ed374a40de2344562a937f289be2e1 suffers from an Interface vulnerability due to mismatching SW signals vs HW exceptions. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/gramineproject/gramine/commit/a390e33e16ed374a40de2344562a937f289be2e1 - https://github.com/ahoi-attacks/sigy/blob/main/pocs/gramine/cve.md
CVE ID: CVE-2024-25373 State: PUBLISHED Published: 2024-02-15T00:00:00 Last Updated: 2024-11-12T18:05:48.143Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda AC10V4.0 V16.03.10.20 was discovered to contain a stack overflow via the page parameter in the sub_49B384 function. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/cvdyfbwa/IoT-Tenda-Router/blob/main/sub_49B384.md
CVE ID: CVE-2024-25376 State: PUBLISHED Published: 2024-04-11T00:00:00.000Z Last Updated: 2025-03-13T20:17:31.292Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue discovered in Thesycon Software Solutions Gmbh & Co. KG TUSBAudio MSI-based installers before 5.68.0 allows a local attacker to execute arbitrary code via the msiexec.exe repair mode. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.thesycon.de/eng/usb_audiodriver.shtml#SecurityAdvisory
CVE ID: CVE-2024-25381 State: PUBLISHED Published: 2024-02-21T00:00:00 Last Updated: 2024-08-26T14:03:08.122Z Vendors: n/a Products: n/a Problem Types: n/a Description: There is a Stored XSS Vulnerability in Emlog Pro 2.2.8 Article Publishing, due to non-filtering of quoted content. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/emlog/emlog/issues/285 - https://github.com/Ox130e07d/CVE-2024-25381/blob/main/description
CVE ID: CVE-2024-25385 State: PUBLISHED Published: 2024-02-22T00:00:00 Last Updated: 2024-08-16T17:25:57.462Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in flvmeta v.1.2.2 allows a local attacker to cause a denial of service via the flvmeta/src/flv.c:375:21 function in flv_close. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/hanxuer/crashes/blob/main/flvmeta/01/readme.md - https://github.com/noirotm/flvmeta/issues/23
CVE ID: CVE-2024-25386 State: PUBLISHED Published: 2024-03-01T00:00:00 Last Updated: 2024-08-16T16:49:55.907Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory Traversal vulnerability in DICOM® Connectivity Framework by laurelbridge before v.2.7.6b allows a remote attacker to execute arbitrary code via the format_logfile.pl file. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://sec.1i6w31fen9.top/2024/02/02/dcf-operations-window-remote-command-execute/ - https://gist.github.com/Shulelk/15c9ba8d6b54dd4256a50a24ac7dd0a2 - https://laurelbridge.com/security-notice-cve-2024-25386-potential-vulnerability/
CVE ID: CVE-2024-25388 State: PUBLISHED Published: 2024-03-27T00:00:00.000Z Last Updated: 2025-11-04T18:29:21.057Z Vendors: n/a Products: n/a Problem Types: n/a Description: drivers/wlan/wlan_mgmt,c in RT-Thread through 5.0.2 has an integer signedness error and resultant buffer overflow. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/RT-Thread/rt-thread/issues/8285 - https://github.com/hnsecurity/vulns/blob/main/HNS-2024-05-rt-thread.txt - https://security.humanativaspa.it/multiple-vulnerabilities-in-rt-thread-rtos/ - https://seclists.org/fulldisclosure/2024/Mar/28 - http://www.openwall.com/lists/oss-security/2024/03/05/1
CVE ID: CVE-2024-25389 State: PUBLISHED Published: 2024-03-27T00:00:00.000Z Last Updated: 2025-11-04T18:29:22.347Z Vendors: n/a Products: n/a Problem Types: n/a Description: RT-Thread through 5.0.2 generates random numbers with a weak algorithm of "seed = 214013L * seed + 2531011L; return (seed >> 16) & 0x7FFF;" in calc_random in drivers/misc/rt_random.c. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/RT-Thread/rt-thread/issues/8283 - https://github.com/hnsecurity/vulns/blob/main/HNS-2024-05-rt-thread.txt - https://security.humanativaspa.it/multiple-vulnerabilities-in-rt-thread-rtos/ - https://seclists.org/fulldisclosure/2024/Mar/
://security.humanativaspa.it/multiple-vulnerabilities-in-rt-thread-rtos/ - https://seclists.org/fulldisclosure/2024/Mar/28 - http://www.openwall.com/lists/oss-security/2024/03/05/1
CVE ID: CVE-2024-25390 State: PUBLISHED Published: 2024-03-27T00:00:00.000Z Last Updated: 2025-11-04T18:29:23.566Z Vendors: n/a Products: n/a Problem Types: n/a Description: A heap buffer overflow occurs in finsh/msh_file.c and finsh/msh.c in RT-Thread through 5.0.2. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/RT-Thread/rt-thread/issues/8286 - https://github.com/hnsecurity/vulns/blob/main/HNS-2024-05-rt-thread.txt - https://security.humanativaspa.it/multiple-vulnerabilities-in-rt-thread-rtos/ - https://seclists.org/fulldisclosure/2024/Mar/28 - http://www.openwall.com/lists/oss-security/2024/03/05/1
CVE ID: CVE-2024-25391 State: PUBLISHED Published: 2024-03-27T00:00:00.000Z Last Updated: 2025-11-04T18:29:24.811Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stack buffer overflow occurs in libc/posix/ipc/mqueue.c in RT-Thread through 5.0.2. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/RT-Thread/rt-thread/issues/8287 - https://github.com/hnsecurity/vulns/blob/main/HNS-2024-05-rt-thread.txt - https://security.humanativaspa.it/multiple-vulnerabilities-in-rt-thread-rtos/ - https://seclists.org/fulldisclosure/2024/Mar/28 - http://www.openwall.com/lists/oss-security/2024/03/05/1
CVE ID: CVE-2024-25392 State: PUBLISHED Published: 2024-03-27T00:00:00.000Z Last Updated: 2025-11-04T18:29:26.057Z Vendors: n/a Products: n/a Problem Types: n/a Description: An out-of-bounds access occurs in utilities/var_export/var_export.c in RT-Thread through 5.0.2. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/RT-Thread/rt-thread/issues/8290 - https://github.com/hnsecurity/vulns/blob/main/HNS-2024-05-rt-thread.txt - https://security.humanativaspa.it/multiple-vulnerabilities-in-rt-thread-rtos/ - https://seclists.org/fulldisclosure/2024/Mar/28 - http://www.openwall.com/lists/oss-security/2024/03/05/1
CVE ID: CVE-2024-25393 State: PUBLISHED Published: 2024-03-27T00:00:00.000Z Last Updated: 2025-11-04T18:29:27.209Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stack buffer overflow occurs in net/at/src/at_server.c in RT-Thread through 5.0.2. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/RT-Thread/rt-thread/issues/8288 - https://github.com/hnsecurity/vulns/blob/main/HNS-2024-05-rt-thread.txt - https://security.humanativaspa.it/multiple-vulnerabilities-in-rt-thread-rtos/ - https://seclists.org/fulldisclosure/2024/Mar/28 - http://www.openwall.com/lists/oss-security/2024/03/05/1
CVE ID: CVE-2024-25394 State: PUBLISHED Published: 2024-03-27T00:00:00.000Z Last Updated: 2025-11-04T18:29:28.394Z Vendors: n/a Products: n/a Problem Types: n/a Description: A buffer overflow occurs in utilities/ymodem/ry_sy.c in RT-Thread through 5.0.2 because of an incorrect sprintf call or a missing '\0' character. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/RT-Thread/rt-thread/issues/8291 - https://github.com/hnsecurity/vulns/blob/main/HNS-2024-05-rt-thread.txt - https://security.humanativaspa.it/multiple-vulnerabilities-in-rt-thread-rtos/ - https://seclists.org/fulldisclosure/2024/Mar/28 - http://www.openwall.com/lists/oss
vulnerabilities-in-rt-thread-rtos/ - https://seclists.org/fulldisclosure/2024/Mar/28 - http://www.openwall.com/lists/oss-security/2024/03/05/1
CVE ID: CVE-2024-25395 State: PUBLISHED Published: 2024-03-27T00:00:00.000Z Last Updated: 2025-11-04T18:29:29.565Z Vendors: n/a Products: n/a Problem Types: n/a Description: A buffer overflow occurs in utilities/rt-link/src/rtlink.c in RT-Thread through 5.0.2. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/RT-Thread/rt-thread/issues/8289 - https://github.com/hnsecurity/vulns/blob/main/HNS-2024-05-rt-thread.txt - https://security.humanativaspa.it/multiple-vulnerabilities-in-rt-thread-rtos/ - https://seclists.org/fulldisclosure/2024/Mar/28 - http://www.openwall.com/lists/oss-security/2024/03/05/1
CVE ID: CVE-2024-25398 State: PUBLISHED Published: 2024-02-27T00:00:00 Last Updated: 2024-08-27T20:38:52.852Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Srelay (the SOCKS proxy and Relay) v.0.4.8p3, a specially crafted network payload can trigger a denial of service condition and disrupt the service. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://sourceforge.net/projects/socks-relay/ - https://github.com/Nivedita-22/SRELAY-exploit-writeup/blob/main/Srelay.md
CVE ID: CVE-2024-25399 State: PUBLISHED Published: 2024-02-27T00:00:00 Last Updated: 2024-10-29T20:10:33.292Z Vendors: n/a Products: n/a Problem Types: n/a Description: Subrion CMS 4.2.1 is vulnerable to Cross Site Scripting (XSS) via adminer.php. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://cwe.mitre.org/data/definitions/79
CVE ID: CVE-2024-25400 State: PUBLISHED Published: 2024-02-27T00:00:00.000Z Last Updated: 2025-05-15T18:05:59.752Z Vendors: n/a Products: n/a Problem Types: n/a Description: Subrion CMS 4.2.1 is vulnerable to SQL Injection via ia.core.mysqli.php. NOTE: this is disputed by multiple third parties because it refers to an HTTP request to a PHP file that only contains a class, without any mechanism for accepting external input, and the reportedly vulnerable method is not present in the file. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/intelliants/subrion/issues/910
CVE ID: CVE-2024-25407 State: PUBLISHED Published: 2024-02-13T00:00:00.000Z Last Updated: 2025-05-08T18:26:55.365Z Vendors: n/a Products: n/a Problem Types: n/a Description: SteVe v3.6.0 was discovered to use predictable transaction ID's when receiving a StartTransaction request. This vulnerability can allow attackers to cause a Denial of Service (DoS) by using the predicted transaction ID's to terminate other transactions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/steve-community/steve/issues/1296
CVE ID: CVE-2024-25410 State: PUBLISHED Published: 2024-02-26T00:00:00 Last Updated: 2024-08-28T19:14:51.631Z Vendors: n/a Products: n/a Problem Types: n/a Description: flusity-CMS 2.33 is vulnerable to Unrestricted Upload of File with Dangerous Type in update_setting.php. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/flusity/flusity-CMS/issues/9 - https://github.com/flusity/flusity-CMS/commit/b99de3bd05677e8b61c04a70235faa6001556b3b
CVE ID: CVE-2024-25411 State: PUBLISHED Published: 2024-09-27T00:00:00 Last Updated: 2024-09-27T19:24:45.430Z Vendors: n/a Products: n/a Problem Types: n/a Description: A cross-site scripting (XSS) vulnerability in Flatpress v1.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the username parameter in setup.php. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://drive.google.com/file/d/1GBL-iY5ZRaxRqLVqpBe1w6dVgEfywAG7/view?usp=sharing - https://github.com/flatpressblog/flatpress/pull/261 - https://github.com/paragbagul111/CVE-2024-25411
CVE ID: CVE-2024-25412 State: PUBLISHED Published: 2024-09-27T00:00:00.000Z Last Updated: 2025-03-13T16:42:11.863Z Vendors: n/a Products: n/a Problem Types: n/a Description: A cross-site scripting (XSS) vulnerability in Flatpress v1.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the email field. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://drive.google.com/file/d/1GBL-iY5ZRaxRqLVqpBe1w6dVgEfywAG7/view?usp=sharing - https://github.com/paragbagul111/CVE-2024-25412
CVE ID: CVE-2024-25413 State: PUBLISHED Published: 2024-02-16T00:00:00.000Z Last Updated: 2025-03-26T14:06:49.563Z Vendors: n/a Products: n/a Problem Types: n/a Description: A XSLT Server Side injection vulnerability in the Import Jobs function of FireBear Improved Import And Export v3.8.6 allows attackers to execute arbitrary commands via a crafted XSLT file. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/capture0x/Magento-ver.-2.4.6 - https://packetstormsecurity.com/files/175801/FireBear-Improved-Import-And-Export-3.8.6-XSLT-Server-Side-Injection.html
CVE ID: CVE-2024-25414 State: PUBLISHED Published: 2024-02-16T00:00:00.000Z Last Updated: 2025-03-14T18:54:24.106Z Vendors: n/a Products: n/a Problem Types: n/a Description: An arbitrary file upload vulnerability in /admin/upgrade of CSZ CMS v1.3.0 allows attackers to execute arbitrary code via uploading a crafted Zip file. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://packetstormsecurity.com/files/175889/CSZ-CMS-1.3.0-Shell-Upload.html - https://github.com/capture0x/CSZ_CMS
CVE ID: CVE-2024-25415 State: PUBLISHED Published: 2024-02-16T00:00:00 Last Updated: 2024-08-28T20:04:01.539Z Vendors: n/a Products: n/a Problem Types: n/a Description: A remote code execution (RCE) vulnerability in /admin/define_language.php of CE Phoenix v1.0.8.20 allows attackers to execute arbitrary PHP code via injecting a crafted payload into the file english.php. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/capture0x/Phoenix - https://packetstormsecurity.com/files/175913/CE-Phoenix-1.0.8.20-Remote-Command-Execution.html - https://vulners.com/zdt/1337DAY-ID-39172 - https://www.exploit-db.com/exploits/51957
CVE ID: CVE-2024-25417 State: PUBLISHED Published: 2024-02-11T00:00:00.000Z Last Updated: 2025-06-12T15:01:29.337Z Vendors: n/a Products: n/a Problem Types: n/a Description: flusity-CMS v2.33 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /core/tools/add_translation.php. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/Carl0724/cms/blob/main/3.md
CVE ID: CVE-2024-25418 State: PUBLISHED Published: 2024-02-11T00:00:00.000Z Last Updated: 2025-05-15T19:38:46.544Z Vendors: n/a Products: n/a Problem Types: n/a Description: flusity-CMS v2.33 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /core/tools/delete_menu.php. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/Carl0724/cms/blob/main/2.md
CVE ID: CVE-2024-25419 State: PUBLISHED Published: 2024-02-11T00:00:00.000Z Last Updated: 2025-05-15T19:36:40.044Z Vendors: n/a Products: n/a Problem Types: n/a Description: flusity-CMS v2.33 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /core/tools/update_menu.php. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/Carl0724/cms/blob/main/1.md
CVE ID: CVE-2024-25420 State: PUBLISHED Published: 2024-03-26T00:00:00.000Z Last Updated: 2025-11-11T13:09:26.855Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in Ignite Realtime Openfire before 4.8.1 allows a remote attacker to escalate privileges via the admin.authorizedJIDs system property component. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.igniterealtime.org/projects/openfire/ - https://github.com/igniterealtime/Openfire/blob/main/xmppserver/src/main/java/org/jivesoftware/openfire/admin/AdminManager.java - https://www.hackthebox.com/blog/openfire-cves-explained-CVE-2024-25420-CVE-2024-25421 - https://igni
AdminManager.java - https://www.hackthebox.com/blog/openfire-cves-explained-CVE-2024-25420-CVE-2024-25421 - https://igniterealtime.atlassian.net/browse/OF-2758 - https://github.com/igniterealtime/Openfire/pull/2411 - https://github.com/igniterealtime/Openfire/releases/tag/v4.8.1
CVE ID: CVE-2024-25421 State: PUBLISHED Published: 2024-03-26T00:00:00 Last Updated: 2024-08-07T20:13:52.341Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in Ignite Realtime Openfire v.4.9.0 and before allows a remote attacker to escalate privileges via the ROOM_CACHE component. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.igniterealtime.org/projects/openfire/ - https://github.com/igniterealtime/Openfire/blob/main/xmppserver/src/main/java/org/jivesoftware/openfire/muc/spi/LocalMUCRoomManager.java - https://www.hackthebox.com/blog/openfire-cves-explained-CVE-2024-25420-CVE-2024-25421
CVE ID: CVE-2024-25422 State: PUBLISHED Published: 2024-02-28T00:00:00.000Z Last Updated: 2025-03-28T23:42:18.305Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL Injection vulnerability in SEMCMS v.4.8 allows a remote attacker to execute arbitrary code and obtain sensitive information via the SEMCMS_Menu.php component. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/tzyyyyyyy/semcms
CVE ID: CVE-2024-25423 State: PUBLISHED Published: 2024-02-22T00:00:00 Last Updated: 2024-08-01T23:44:09.156Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in MAXON CINEMA 4D R2024.2.0 allows a local attacker to execute arbitrary code via a crafted c4d_base.xdl64 file. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - http://cinema.com - http://maxon.com - https://github.com/DriverUnload/cve-2024-25423
CVE ID: CVE-2024-25428 State: PUBLISHED Published: 2024-02-20T00:00:00.000Z Last Updated: 2025-03-13T18:36:48.533Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL Injection vulnerability in MRCMS v3.1.2 allows attackers to run arbitrary system commands via the status parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/wuweiit/mushroom/issues/19