Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-51260 State: PUBLISHED Published: 2024-10-31T00:00:00 Last Updated: 2024-10-31T18:22:54.560Z Vendors: n/a Products: n/a Problem Types: n/a Description: DrayTek Vigor3900 1.5.1.3 allows attackers to inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the acme_process function. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/fu37kola/cve/blob/main/DrayTek/Vigor3900/1.5.1.3/DrayTek_Vigor_3900_1.5.1.3.pdf
CVE ID: CVE-2024-51296 State: PUBLISHED Published: 2024-10-30T00:00:00 Last Updated: 2024-10-30T17:11:52.107Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the pingtrace function. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/fu37kola/cve/blob/main/DrayTek/Vigor3900/1.5.1.3/DrayTek_Vigor_3900_1.5.1.3.pdf
CVE ID: CVE-2024-51298 State: PUBLISHED Published: 2024-10-30T00:00:00.000Z Last Updated: 2025-03-19T20:47:20.953Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the doGRETunnel function. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/fu37kola/cve/blob/main/DrayTek/Vigor3900/1.5.1.3/DrayTek_Vigor_3900_1.5.1.3.pdf
CVE ID: CVE-2024-51299 State: PUBLISHED Published: 2024-10-30T00:00:00 Last Updated: 2024-10-30T17:21:27.321Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the dumpSyslog function. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/fu37kola/cve/blob/main/DrayTek/Vigor3900/1.5.1.3/DrayTek_Vigor_3900_1.5.1.3.pdf
CVE ID: CVE-2024-51300 State: PUBLISHED Published: 2024-10-30T00:00:00 Last Updated: 2024-10-30T17:16:55.650Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the get_rrd function. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/fu37kola/cve/blob/main/DrayTek/Vigor3900/1.5.1.3/DrayTek_Vigor_3900_1.5.1.3.pdf
CVE ID: CVE-2024-51301 State: PUBLISHED Published: 2024-10-30T00:00:00 Last Updated: 2024-10-30T17:15:48.466Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the packet_monitor function. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/fu37kola/cve/blob/main/DrayTek/Vigor3900/1.5.1.3/DrayTek_Vigor_3900_1.5.1.3.pdf
CVE ID: CVE-2024-51304 State: PUBLISHED Published: 2024-10-30T00:00:00 Last Updated: 2024-10-30T17:22:21.011Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the ldap_search_dn function. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/fu37kola/cve/blob/main/DrayTek/Vigor3900/1.5.1.3/DrayTek_Vigor_3900_1.5.1.3.pdf
CVE ID: CVE-2024-51317 State: PUBLISHED Published: 2025-11-03T00:00:00.000Z Last Updated: 2025-11-04T16:46:04.739Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in NetSurf v.3.11 allows a remote attacker to execute arbitrary code via the dom_node_normalize function Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Fysac/netsurf-disclosure/tree/main/CVE-2024-51317 - https://www.netsurf-browser.org/
CVE ID: CVE-2024-51319 State: PUBLISHED Published: 2025-03-11T00:00:00.000Z Last Updated: 2025-03-21T20:48:45.731Z Vendors: n/a Products: n/a Problem Types: n/a Description: A local file include vulnerability in the /servlet/Report of Zucchetti Ad Hoc Infinity 2.4 allows an authenticated attacker to achieve Remote Code Execution by uploading a jsp web/reverse shell through /jsp/zimg_upload.jsp. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://members.backbox.org/zucchetti-ad-hoc-infinity-multiple-vulnerabilities/
CVE ID: CVE-2024-51320 State: PUBLISHED Published: 2025-03-11T00:00:00.000Z Last Updated: 2025-03-11T19:35:09.870Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting vulnerability in Zucchetti Ad Hoc Infinity 2.4 allows an authenticated attacker to achieve Remote Code Execution via the /servlet/gsdm_fsave_htmltmp, /servlet/gsdm_btlk_openfile components Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://members.backbox.org/zucchetti-ad-hoc-infinity-multiple-vulnerabilities/
CVE ID: CVE-2024-51321 State: PUBLISHED Published: 2025-03-11T00:00:00.000Z Last Updated: 2025-03-21T20:47:01.303Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Zucchetti Ad Hoc Infinity 2.4, an improper check on the m_cURL parameter allows an attacker to redirect the victim to an attacker-controlled website after the authentication. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://members.backbox.org/zucchetti-ad-hoc-infinity-multiple-vulnerabilities/
CVE ID: CVE-2024-51322 State: PUBLISHED Published: 2025-03-11T00:00:00.000Z Last Updated: 2025-03-11T19:25:51.813Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting vulnerability in Zucchetti Ad Hoc Infinity 2.4 allows an authenticated attacker to achieve Remote Code Execution via the /jsp/home.jsp, /jsp/gsfr_feditorHTML.jsp, /servlet/SPVisualZoom, /jsp/gsmd_container.jsp components Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://members.backbox.org/zucchetti-ad-hoc-infinity-multiple-vulnerabilities/
CVE ID: CVE-2024-51324 State: PUBLISHED Published: 2025-02-11T00:00:00.000Z Last Updated: 2025-02-12T21:49:04.193Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in the BdApiUtil driver of Baidu Antivirus v5.2.3.116083 allows attackers to terminate arbitrary process via executing a BYOVD (Bring Your Own Vulnerable Driver) attack. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/magicsword-io/LOLDrivers/issues/204
CVE ID: CVE-2024-51326 State: PUBLISHED Published: 2024-11-04T00:00:00 Last Updated: 2024-11-05T17:41:01.882Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL Injection vulnerability in projectworlds Travel management System v.1.0 allows a remote attacker to execute arbitrary code via the 't2' parameter in deletesubcategory.php. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://projectworlds.in/ - https://github.com/redtrib3/CVEs/tree/main/CVE-2024-51326%20-%20Union%20SQLi
CVE ID: CVE-2024-51327 State: PUBLISHED Published: 2024-11-04T00:00:00 Last Updated: 2024-11-05T17:39:31.357Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL Injection in loginform.php in ProjectWorld's Travel Management System v1.0 allows remote attackers to bypass authentication via SQL Injection in the 'username' and 'password' fields. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://projectworlds.in/ - https://github.com/redtrib3/CVEs/tree/main/CVE-2024-51327%20-%20SQLi%20Auth%20Bypass
CVE ID: CVE-2024-51328 State: PUBLISHED Published: 2024-11-04T00:00:00 Last Updated: 2024-11-04T19:03:59.492Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting vulnerability in addcategory.php in projectworld's Travel Management System v1.0 allows remote attacker to inject arbitrary code via the t2 parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://projectworlds.in/ - https://github.com/redtrib3/CVEs/tree/main/CVE-2024-51328%20-%20Stored%20XSS%20
CVE ID: CVE-2024-51329 State: PUBLISHED Published: 2024-11-04T00:00:00 Last Updated: 2024-11-05T21:05:43.775Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Host header injection vulnerability in Agile-Board 1.0 allows attackers to obtain the password reset token via user interaction with a crafted password reset link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/idrsdev/agile-board/tree/main - https://github.com/redtrib3/CVEs/tree/main/CVE-2024-51329%20-%20Host%20Header%20Injection
CVE ID: CVE-2024-51330 State: PUBLISHED Published: 2024-11-15T00:00:00 Last Updated: 2024-11-27T17:06:12.423Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in UltiMaker Cura v.4.41 and 5.8.1 and before allows a local attacker to execute arbitrary code via Inter-process communication (IPC) mechanism between Cura application and CuraEngine processes, localhost network stack, printing settings and G-code processing and transmission components, Ultimaker 3D Printers. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gist.github.com/HalaAli198/ff06d7a94c06cdfb821dec4d6303e01b
CVE ID: CVE-2024-51337 State: PUBLISHED Published: 2024-11-21T00:00:00 Last Updated: 2024-11-21T19:56:23.694Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting vulnerability in Gibbon before v.27.0.01 and fixed in v.28.0.00 allows a remote attacker to obtain sensitive information via the email parameter found in /Gibbon/modules/User Admin/user_manage_editProcess.php. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/GibbonEdu/core - https://github.com/aziz0x48/CVEs-and-Vulnerabilities/blob/main/CVE-2024-51337.md
CVE ID: CVE-2024-51358 State: PUBLISHED Published: 2024-11-05T00:00:00 Last Updated: 2024-11-07T19:32:45.980Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in Linux Server Heimdall v.2.6.1 allows a remote attacker to execute arbitrary code via a crafted script to the Add new application. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Kov404/CVE-2024-51358
CVE ID: CVE-2024-51360 State: PUBLISHED Published: 2025-05-23T00:00:00.000Z Last Updated: 2025-05-29T15:16:21.750Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in Hospital Management System In PHP V4.0 allows a remote attacker to execute arbitrary code via the hms/doctor/edit-profile.php file Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Anil0x/CVE/blob/main/Session%20Hijacking.pdf
CVE ID: CVE-2024-51362 State: PUBLISHED Published: 2024-11-05T00:00:00 Last Updated: 2024-11-06T19:27:32.513Z Vendors: n/a Products: n/a Problem Types: n/a Description: The LSC Smart Connect Indoor IP Camera V7.6.32 is vulnerable to an information disclosure issue where live camera footage can be accessed through the RTSP protocol on port 8554 without requiring authentication. This allows unauthorized users with network access to view the camera's feed, potentially compromising user privacy and security. No credentials or special permissions are required, and access can be gained remotely over the network. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://shinxyy.githu
gained remotely over the network. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://shinxyy.github.io/blogs/CVE_2024_51362.html
CVE ID: CVE-2024-51363 State: PUBLISHED Published: 2024-12-03T00:00:00 Last Updated: 2024-12-11T14:39:22.544Z Vendors: n/a Products: n/a Problem Types: n/a Description: Insecure deserialization in Hodoku v2.3.0 to v2.3.2 allows attackers to execute arbitrary code. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Gelcon/PoC-of-Hodoku-V2.3.0-RCE
CVE ID: CVE-2024-51364 State: PUBLISHED Published: 2024-11-21T00:00:00 Last Updated: 2024-11-27T21:04:13.312Z Vendors: n/a Products: n/a Problem Types: n/a Description: An arbitrary file upload vulnerability in ModbusMechanic v3.0 allows attackers to execute arbitrary code via uploading a crafted .xml file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://modbusmechanic.com - https://github.com/Gelcon/PoC-ModbusMechanic-3.0-Insecure-Deserialization-and-RCE
CVE ID: CVE-2024-51365 State: REJECTED Published: 2024-11-21T00:00:00.000Z Last Updated: 2025-03-27T14:51:35.326Z Description: No description available.
CVE ID: CVE-2024-51366 State: PUBLISHED Published: 2024-11-21T00:00:00 Last Updated: 2024-12-04T15:51:43.657Z Vendors: n/a Products: n/a Problem Types: n/a Description: An arbitrary file upload vulnerability in the component \Roaming\Omega of OmegaT v6.0.1 allows attackers to execute arbitrary code via uploading a crafted .conf file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://omegat.com - https://github.com/Gelcon/PoCofOmegaTV6_0_1 - https://omegat.org/
CVE ID: CVE-2024-51367 State: PUBLISHED Published: 2024-11-21T00:00:00 Last Updated: 2024-11-27T17:01:20.581Z Vendors: n/a Products: n/a Problem Types: n/a Description: An arbitrary file upload vulnerability in the component \Users\username.BlackBoard of BlackBoard v2.0.0.2 allows attackers to execute arbitrary code via uploading a crafted .xml file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://blackboard.com - https://github.com/Gelcon/PoCofBlackBoard2.0.0.2
CVE ID: CVE-2024-51376 State: PUBLISHED Published: 2025-02-12T00:00:00.000Z Last Updated: 2025-02-13T20:35:14.299Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory Traversal vulnerability in yeqifu carRental v.1.0 allows a remote attacker to obtain sensitive information via the file/downloadFile.action?path= component. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/yeqifu/carRental/issues/43 - https://github.com/echo0d/vulnerability/blob/main/yeqifu_carRental/DirectoryTraversal.md
CVE ID: CVE-2024-51377 State: PUBLISHED Published: 2024-11-01T00:00:00 Last Updated: 2024-11-04T20:42:41.749Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in Ladybird Web Solution Faveo Helpdesk & Servicedesk (On-Premise and Cloud) 9.2.0 allows a remote attacker to execute arbitrary code via the Subject and Identifier fields Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Asadiqbal2/Vulnerabilities-Research/tree/main/CVE-2024-51377 - https://github.com/ladybirdweb/faveo-helpdesk/issues/8303
CVE ID: CVE-2024-51378 State: PUBLISHED Published: 2024-10-29T00:00:00.000Z Last Updated: 2025-10-21T22:55:37.800Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AC:L/AV:N/A:H/C:H/I:H/PR:N/S:C/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: getresetstatus in dns/views.py and ftp/views.py in CyberPanel (aka Cyber Panel) before 1c0c6cb allows remote attackers to bypass authentication and execute arbitrary commands via /dns/getresetstatus or /ftp/getresetstatus by bypassing secMiddleware (which is only for a POST request) and using shell metacharacters in the statusfile property, as exploited in the wild in October 2024 by PSAUX. Versions through 2.3.6 and (unpatched) 2.3.7 are affected.
property, as exploited in the wild in October 2024 by PSAUX. Versions through 2.3.6 and (unpatched) 2.3.7 are affected. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cwe.mitre.org/data/definitions/78.html - https://github.com/usmannasir/cyberpanel/commit/1c0c6cbcf71abe573da0b5fddfb9603e7477f683 - https://refr4g.github.io/posts/cyberpanel-command-injection-vulnerability/ - https://cyberpanel.net/KnowledgeBase/home/change-logs/ - https://cwe.mitre.org/data/definitions/420.html - https://cyberpanel.net/blog/detials-and-fix-of-recent-security-issue-and-patch-of-cyberpanel - https://www.bleepingcomputer.com/news/security/massive-psaux-ransomware-attack-targets-22-000-c
nd-patch-of-cyberpanel - https://www.bleepingcomputer.com/news/security/massive-psaux-ransomware-attack-targets-22-000-cyberpanel-instances/
CVE ID: CVE-2024-51379 State: PUBLISHED Published: 2024-11-05T00:00:00 Last Updated: 2024-11-06T16:53:19.458Z Vendors: n/a Products: n/a Problem Types: n/a Description: Stored Cross-Site Scripting (XSS) vulnerability discovered in JATOS v3.9.3. The vulnerability exists in the description component of the study section, where an attacker can inject JavaScript into the description field. This allows for the execution of malicious scripts when an admin views the description, potentially leading to account takeover and unauthorized actions. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://hacking-notes.medium.com/cve-2024-51379-jatos-v3-9-3-stored-xss-description-componen
Vulnrichment: References: - https://hacking-notes.medium.com/cve-2024-51379-jatos-v3-9-3-stored-xss-description-component-de49d0077a96
CVE ID: CVE-2024-51380 State: PUBLISHED Published: 2024-11-05T00:00:00 Last Updated: 2024-11-06T16:55:10.474Z Vendors: n/a Products: n/a Problem Types: n/a Description: Stored Cross-Site Scripting (XSS) vulnerability discovered in the Properties Component of JATOS v3.9.3. This flaw allows an attacker to inject malicious JavaScript into the properties section of a study, specifically within the UUID field. When an admin user accesses the study's properties, the injected script is executed in the admin's browser, which could lead to unauthorized actions, including account compromise and privilege escalation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://hacking-notes
promise and privilege escalation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://hacking-notes.medium.com/cve-2024-51380-jatos-v3-9-3-stored-xss-properties-component-44aea338ee9c
CVE ID: CVE-2024-51381 State: PUBLISHED Published: 2024-11-05T00:00:00 Last Updated: 2024-11-06T16:50:31.100Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-Site Request Forgery (CSRF) vulnerability in JATOS v3.9.3 that allows attackers to perform actions reserved for administrators, including creating admin accounts. This critical flaw can lead to unauthorized activities, compromising the security and integrity of the platform, especially if an attacker gains administrative control. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://hacking-notes.medium.com/cve-2024-51381-jatos-v3-9-3-csrf-admin-account-creation-94035f24d0be
CVE ID: CVE-2024-51382 State: PUBLISHED Published: 2024-11-05T00:00:00 Last Updated: 2024-11-06T16:48:36.097Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-Site Request Forgery (CSRF) vulnerability in JATOS v3.9.3 allows an attacker to reset the administrator's password. This critical security flaw can result in unauthorized access to the platform, enabling attackers to hijack admin accounts and compromise the integrity and security of the system. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://hacking-notes.medium.com/cve-2024-51382-jatos-v3-9-3-csrf-admin-password-reset-1adeff0386ed
CVE ID: CVE-2024-51392 State: PUBLISHED Published: 2025-05-29T00:00:00.000Z Last Updated: 2025-05-29T18:00:26.671Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in OpenKnowledgeMaps Headstart v7 allows a remote attacker to escalate privileges via the url parameter of the getPDF.php component Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/OpenKnowledgeMaps/Headstart - https://github.com/manisashank/CVE-Publish/blob/main/CVE-2024-51392.md
CVE ID: CVE-2024-51398 State: PUBLISHED Published: 2024-11-01T00:00:00 Last Updated: 2024-11-05T17:59:18.899Z Vendors: n/a Products: n/a Problem Types: n/a Description: Altai Technologies Ltd Altai X500 Indoor 22 802.11ac Wave 2 AP web Management Weak password leakage in the background may lead to unauthorized access, data theft, and network attacks, seriously threatening network security. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/HuhaiOvO/Altai/blob/main/Altai%20IX500%20Indoor%202%C3%972%20802.11ac%20Wave%202%20AP%20wake%20password.docx - https://github.com/HuhaiOvO/Altai/blob/main/Altai_IX500_Weak_Password.yaml
CVE ID: CVE-2024-51399 State: PUBLISHED Published: 2024-11-01T00:00:00 Last Updated: 2024-11-05T17:56:26.315Z Vendors: n/a Products: n/a Problem Types: n/a Description: Altai Technologies Ltd Altai IX500 Indoor 22 802.11ac Wave 2 AP After login, there are file reads in the background, and attackers can obtain sensitive information such as user credentials, system configuration, and database connection strings, which can lead to data breaches and identity theft. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/HuhaiOvO/Altai/blob/main/Altai%20IX500%20Indoor%202%C3%972%20802.11ac%20Wave%202%20AP%20file%20read.docx
CVE ID: CVE-2024-51406 State: PUBLISHED Published: 2024-11-01T00:00:00 Last Updated: 2024-11-04T19:11:07.872Z Vendors: n/a Products: n/a Problem Types: n/a Description: Floodlight SDN Open Flow Controller v.1.2 has an issue that allows local hosts to build fake LLDP packets that allow specific clusters to be missed by Floodlight, which in turn leads to missed hosts inside and outside the cluster. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/floodlight/floodlight/issues/870 - https://ieeexplore.ieee.org/document/10246976 - https://github.com/floodlight/floodlight
CVE ID: CVE-2024-51407 State: PUBLISHED Published: 2024-11-01T00:00:00 Last Updated: 2024-11-04T19:18:20.540Z Vendors: n/a Products: n/a Problem Types: n/a Description: Floodlight SDN OpenFlow Controller v.1.2 has an issue that allows local hosts to construct false broadcast ports causing inter-host communication anomalies. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://ieeexplore.ieee.org/document/10246976 - https://github.com/floodlight/floodlight - https://github.com/floodlight/floodlight/issues/869
CVE ID: CVE-2024-51408 State: PUBLISHED Published: 2024-11-04T00:00:00 Last Updated: 2024-11-05T21:26:15.936Z Severity: HIGH (CVSS 8.5 CVSS:3.1/AC:H/AV:N/A:H/C:H/I:H/PR:L/S:C/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: AppSmith Community 1.8.3 before 1.46 allows SSRF via New DataSource for application/json requests to 169.254.169.254 to retrieve AWS metadata credentials. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/appsmithorg/appsmith/pull/29286 - https://github.com/jahithoque/Vulnerability-Research/tree/main/CVE-2024-51408 - https://github.com/appsmithorg/appsmith/releases/tag/v1.46
CVE ID: CVE-2024-51409 State: PUBLISHED Published: 2024-11-06T00:00:00 Last Updated: 2024-11-07T15:21:14.065Z Vendors: n/a Products: n/a Problem Types: n/a Description: Buffer Overflow vulnerability in Tenda O3 v.1.0.0.5 allows a remote attacker to cause a denial of service via a network packet in a fixed format to a router running the corresponding version of the firmware. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/fireknight-hJ/Tenda-cve-pocs/blob/main/Tenda%20O3V1.0.0.5%284180%29/websReadEvent.md
CVE ID: CVE-2024-51417 State: PUBLISHED Published: 2025-01-21T00:00:00.000Z Last Updated: 2025-02-04T15:26:35.255Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in System.Linq.Dynamic.Core before 1.6.0 allows remote access to properties on reflection types and static properties/fields. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://dynamic-linq.net/expression-language#operators - https://zzzprojects.com/ - https://github.com/zzzprojects/System.Linq.Dynamic.Core/issues/867
CVE ID: CVE-2024-51419 State: PUBLISHED Published: 2024-10-30T00:00:00 Last Updated: 2024-10-31T14:12:44.540Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting vulnerability in Shenzhen Interconnection Harbor Network Technology Co., Ltd Ofweek Online Exhibition v.1.0.0 allows a remote attacker to execute arbitrary code. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gist.github.com/475bd8bc21c4f4dfc8f26ce35eb6ca28.git