Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-37679 State: PUBLISHED Published: 2024-06-24T00:00:00 Last Updated: 2024-08-02T03:57:39.691Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting vulnerability in Hangzhou Meisoft Information Technology Co., Ltd. Finesoft v.8.0 and before allows a remote attacker to execute arbitrary code via a crafted script to the login.jsp parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/dabaizhizhu/123/issues/4
CVE ID: CVE-2024-37680 State: PUBLISHED Published: 2024-06-24T00:00:00.000Z Last Updated: 2025-03-27T15:11:22.031Z Vendors: n/a Products: n/a Problem Types: n/a Description: Hangzhou Meisoft Information Technology Co., Ltd. FineSoft <=8.0 is affected by Cross Site Scripting (XSS) which allows remote attackers to execute arbitrary code. Enter any account and password, click Login, the page will report an error, and a controllable parameter will appear at the URL:weburl. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/dabaizhizhu/123/issues/5
CVE ID: CVE-2024-37681 State: PUBLISHED Published: 2024-06-24T00:00:00 Last Updated: 2024-08-02T03:57:39.727Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue the background management system of Shanxi Internet Chuangxiang Technology Co., Ltd v1.0.1 allows a remote attacker to cause a denial of service via the index.html component. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/dabaizhizhu/123/issues/6
CVE ID: CVE-2024-37694 State: REJECTED Published: 2024-06-21T00:00:00 Last Updated: 2024-06-27T19:25:17.378Z Description: No description available.
CVE ID: CVE-2024-37699 State: PUBLISHED Published: 2024-06-20T00:00:00 Last Updated: 2024-08-02T03:57:39.764Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in DataLife Engine v.17.1 and before is vulnerable to SQL Injection in dboption. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://exploit.az/threads/datalife-engine-dle-sql-inyeksiyasi-17-0.19/ - https://dle-news.ru/pressrelease/1909-datalife-engine-v172-press-release.html - https://exploit.az/threads/datalife-engine-dle-sql-inyeksiyasi-sql-injection-sql-inekcija-17-1.19/
CVE ID: CVE-2024-37726 State: PUBLISHED Published: 2024-07-03T00:00:00 Last Updated: 2024-08-02T03:57:39.811Z Vendors: n/a Products: n/a Problem Types: n/a Description: Insecure Permissions vulnerability in Micro-Star International Co., Ltd MSI Center v.2.0.36.0 allows a local attacker to escalate privileges via the Export System Info function in MSI.CentralServer.exe Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/carsonchan12345/CVE-2024-37726-MSI-Center-Local-Privilege-Escalation
CVE ID: CVE-2024-37728 State: PUBLISHED Published: 2024-09-10T00:00:00 Last Updated: 2024-09-11T15:00:57.614543 Vendors: n/a Products: n/a Problem Types: n/a Description: Arbitrary File Read vulnerability in Xi'an Daxi Information Technology Co., Ltd OfficeWeb365 v.7.18.23.0 and v8.6.1.0 allows a remote attacker to obtain sensitive information via the "Pic/Indexes" interface Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/wy876/POC/blob/main/OfficeWeb365/OfficeWeb365_%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E8%AF%BB%E5%8F%96%E6%BC%8F%E6%B4%9E.md - https://github.com/xuetang1125/OfficeWeb365/blob/main/OfficeWeb365_%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E8%AF%BB%E
.md - https://github.com/xuetang1125/OfficeWeb365/blob/main/OfficeWeb365_%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E8%AF%BB%E5%8F%96%E6%BC%8F%E6%B4%9E%20.md
CVE ID: CVE-2024-37732 State: PUBLISHED Published: 2024-06-24T00:00:00 Last Updated: 2024-08-02T03:57:39.760Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting vulnerability in Anchor CMS v.0.12.7 allows a remote attacker to execute arbitrary code via a crafted .pdf file. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://gitee.com/Aa272899/CHG-sec/issues/I9UO7X
CVE ID: CVE-2024-37734 State: PUBLISHED Published: 2024-06-26T00:00:00 Last Updated: 2024-08-02T03:57:39.749Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in OpenEMR 7.0.2 allows a remote attacker to escalate privileges viaa crafted POST request using the noteid parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/A3h1nt/CVEs/tree/main/OpenEMR - https://github.com/openemr/openemr/pull/7435#event-12872646667
CVE ID: CVE-2024-37741 State: PUBLISHED Published: 2024-06-28T00:00:00 Last Updated: 2024-08-02T03:57:39.697Z Vendors: n/a Products: n/a Problem Types: n/a Description: OpenPLC 3 through 9cd8f1b allows XSS via an SVG document as a profile picture. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/thiagoralves/OpenPLC_v3/issues/242 - https://github.com/thiagoralves/OpenPLC_v3/blob/9cd8f1b53a50f9d38708096bfc72bcbb1ef47343/webserver/pages.py#L992 - https://1d8.github.io/cves/cve_2024_37741/
CVE ID: CVE-2024-37742 State: PUBLISHED Published: 2024-06-25T00:00:00 Last Updated: 2024-08-02T03:57:39.751Z Vendors: n/a Products: n/a Problem Types: n/a Description: Insecure Access Control in Safe Exam Browser (SEB) = 3.5.0 on Windows. The vulnerability allows an attacker to share clipboard data between the SEB kiosk mode and the underlying system, compromising exam integrity. By exploiting this flaw, an attacker can bypass exam controls and gain an unfair advantage during exams. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://youtu.be/SOm0Hgny_3U - https://github.com/Eteblue/CVE-2024-37742
CVE ID: CVE-2024-37743 State: PUBLISHED Published: 2025-06-24T00:00:00.000Z Last Updated: 2025-06-24T19:59:36.630Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in mmzdev KnowledgeGPT V.0.0.5 allows a remote attacker to execute arbitrary code via the Document Display Component. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/mmz-001/knowledge_gpt/blob/main/knowledge_gpt/main.py - https://medium.com/@cnetsec/vulnerability-identified-in-knowledgegpt-version-0-0-5-5168ec081842
CVE ID: CVE-2024-37758 State: PUBLISHED Published: 2024-12-20T00:00:00 Last Updated: 2024-12-20T19:56:37.091Z Vendors: n/a Products: n/a Problem Types: n/a Description: Improper access control in the endpoint /RoleMenuMapping/AddRoleMenu of Digiteam v4.21.0.0 allows authenticated attackers to escalate privileges. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://medium.com/@hamzanadeem1337/unauthorized-full-vertical-privilege-escalation-in-digiteam-sales-gamification-portal-version-4-21-0-c3e3282e9053
CVE ID: CVE-2024-37759 State: PUBLISHED Published: 2024-06-24T00:00:00 Last Updated: 2024-08-02T03:57:39.771Z Vendors: n/a Products: n/a Problem Types: n/a Description: DataGear v5.0.0 and earlier was discovered to contain a SpEL (Spring Expression Language) expression injection vulnerability via the Data Viewing interface. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/datageartech/datagear/issues/32 - https://github.com/crumbledwall/CVE-2024-37759_PoC
CVE ID: CVE-2024-37762 State: PUBLISHED Published: 2024-07-01T00:00:00 Last Updated: 2024-08-02T03:57:39.761Z Vendors: n/a Products: n/a Problem Types: n/a Description: MachForm up to version 21 is affected by an authenticated unrestricted file upload which leads to a remote code execution. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/Atreb92/cve-2024-37762
CVE ID: CVE-2024-37763 State: PUBLISHED Published: 2024-07-01T00:00:00 Last Updated: 2024-10-31T18:06:09.549Z Vendors: n/a Products: n/a Problem Types: n/a Description: MachForm up to version 19 is affected by an unauthenticated stored cross-site scripting which affects users with valid sessions whom can view compiled forms results. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/Atreb92/cve-2024-37763
CVE ID: CVE-2024-37764 State: PUBLISHED Published: 2024-07-01T00:00:00 Last Updated: 2024-08-02T03:57:39.784Z Vendors: n/a Products: n/a Problem Types: n/a Description: MachForm up to version 19 is affected by an authenticated stored cross-site scripting. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/Atreb92/cve-2024-37764
CVE ID: CVE-2024-37765 State: PUBLISHED Published: 2024-07-01T00:00:00 Last Updated: 2024-08-02T03:57:39.812Z Vendors: n/a Products: n/a Problem Types: n/a Description: Machform up to version 19 is affected by an authenticated Blind SQL injection in the user account settings page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/Atreb92/cve-2024-37765
CVE ID: CVE-2024-37767 State: PUBLISHED Published: 2024-07-05T00:00:00 Last Updated: 2024-11-07T16:02:01.518Z Vendors: n/a Products: n/a Problem Types: n/a Description: Insecure permissions in the component /api/admin/user of 14Finger v1.1 allows attackers to access all user information via a crafted GET request. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/b1ackc4t/14Finger/issues/12
CVE ID: CVE-2024-37768 State: PUBLISHED Published: 2024-07-05T00:00:00.000Z Last Updated: 2025-03-13T17:24:48.732Z Vendors: n/a Products: n/a Problem Types: n/a Description: 14Finger v1.1 was discovered to contain an arbitrary user deletion vulnerability via the component /api/admin/user?id. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/b1ackc4t/14Finger/issues/12
CVE ID: CVE-2024-37769 State: PUBLISHED Published: 2024-07-05T00:00:00 Last Updated: 2024-08-02T03:57:39.806Z Vendors: n/a Products: n/a Problem Types: n/a Description: Insecure permissions in 14Finger v1.1 allow attackers to escalate privileges from normal user to Administrator via a crafted POST request. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/b1ackc4t/14Finger/issues/12
CVE ID: CVE-2024-37770 State: PUBLISHED Published: 2024-07-10T00:00:00 Last Updated: 2024-08-02T03:57:39.788Z Vendors: n/a Products: n/a Problem Types: n/a Description: 14Finger v1.1 was discovered to contain a remote command execution (RCE) vulnerability in the fingerprint function. This vulnerability allows attackers to execute arbitrary commands via a crafted payload. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/b1ackc4t/14Finger/issues/13 - https://github.com/k3ppf0r/CVE-2024-37770
CVE ID: CVE-2024-37773 State: PUBLISHED Published: 2024-12-16T00:00:00 Last Updated: 2024-12-17T15:10:35.123Z Vendors: n/a Products: n/a Problem Types: n/a Description: An HTML injection vulnerability in Sunbird DCIM dcTrack 9.1.2 allows attackers authenticated as administrators to inject arbitrary HTML code in an admin screen. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://dctrack.com - https://s3.us-east-1.amazonaws.com/dcTrack.Docs/dcTrack_9.2.0_GA/dcTrack_9.2.0_Release_Notes.pdf
CVE ID: CVE-2024-37774 State: PUBLISHED Published: 2024-12-16T00:00:00 Last Updated: 2024-12-17T15:06:07.944Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Cross-Site Request Forgery (CSRF) in Sunbird DCIM dcTrack v9.1.2 allows authenticated attackers to escalate their privileges by forcing an Administrator user to perform sensitive requests in some admin screens. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://dctrack.com - https://s3.us-east-1.amazonaws.com/dcTrack.Docs/dcTrack_9.2.0_GA/dcTrack_9.2.0_Release_Notes.pdf
CVE ID: CVE-2024-37775 State: PUBLISHED Published: 2024-12-16T00:00:00 Last Updated: 2024-12-17T15:01:53.490Z Vendors: n/a Products: n/a Problem Types: n/a Description: Incorrect access control in Sunbird DCIM dcTrack v9.1.2 allows attackers to create or update a ticket with a location which bypasses an RBAC check. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://dctrack.com - https://s3.us-east-1.amazonaws.com/dcTrack.Docs/dcTrack_9.2.0_GA/dcTrack_9.2.0_Release_Notes.pdf
CVE ID: CVE-2024-37776 State: PUBLISHED Published: 2024-12-16T00:00:00 Last Updated: 2024-12-17T16:59:08.713Z Vendors: n/a Products: n/a Problem Types: n/a Description: A cross-site scripting (XSS) vulnerability in Sunbird DCIM dcTrack v9.1.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload in some admin screens. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://dctrack.com - https://s3.us-east-1.amazonaws.com/dcTrack.Docs/dcTrack_9.2.0_GA/dcTrack_9.2.0_Release_Notes.pdf
CVE ID: CVE-2024-37777 State: PUBLISHED Published: 2025-08-27T00:00:00.000Z Last Updated: 2025-08-27T19:44:42.897Z Vendors: n/a Products: n/a Problem Types: n/a Description: O2OA v9.0.3 was discovered to contain a remote code execution (RCE) vulnerability via the mainOutput() function. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/o2oa/o2oa/issues/158
CVE ID: CVE-2024-37779 State: PUBLISHED Published: 2024-09-23T00:00:00 Last Updated: 2024-09-27T14:06:15.365Z Vendors: n/a Products: n/a Problem Types: n/a Description: WoodWing Elvis DAM v6.98.1 was discovered to contain an authenticated remote command execution (RCE) vulnerability via the Apache Ant script functionality. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.woodwing.com/ - https://medium.com/%40daviddepaulasantos/our-brand-new-cve-authenticated-remote-code-execution-rce-on-elvis-dam-c544d879ef1e
CVE ID: CVE-2024-37782 State: PUBLISHED Published: 2024-11-22T00:00:00 Last Updated: 2024-11-27T16:51:37.606Z Vendors: n/a Products: n/a Problem Types: n/a Description: An LDAP injection vulnerability in the login page of Gladinet CentreStack v13.12.9934.54690 allows attackers to access sensitive data or execute arbitrary commands via a crafted payload injected into the username field. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.centrestack.com/p/gce_latest_release.html - https://medium.com/%40jkoreamo/centrestack-vulnerability-disclosure-d28dc8f21a56 - https://gist.githubusercontent.com/Draoken/ab5465fc339df7a1e42281540b61f887/raw/fb28d4148e311e8cde9778dee4f
8dc8f21a56 - https://gist.githubusercontent.com/Draoken/ab5465fc339df7a1e42281540b61f887/raw/fb28d4148e311e8cde9778dee4f8b2e64e27ea92/CVE-2024-37782.txt
CVE ID: CVE-2024-37783 State: PUBLISHED Published: 2024-11-22T00:00:00 Last Updated: 2024-11-22T18:11:38.223Z Vendors: n/a Products: n/a Problem Types: n/a Description: A reflected cross-site scripting (XSS) vulnerability in Gladinet CentreStack v13.12.9934.54690 allows attackers to inject malicious JavaScript into the web browser of a victim via the sessionId parameter at /portal/ForgotPassword.aspx. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.centrestack.com/p/gce_latest_release.html - https://medium.com/%40jkoreamo/centrestack-vulnerability-disclosure-d28dc8f21a56 - https://gist.githubusercontent.com/Draoken/9526cd338b7941340b7bf12340324215/raw/f32c03ee229
ty-disclosure-d28dc8f21a56 - https://gist.githubusercontent.com/Draoken/9526cd338b7941340b7bf12340324215/raw/f32c03ee229210f9f039293bd2f3c7fe1d9be8c4/CVE-2024-37783.txt
CVE ID: CVE-2024-37790 State: REJECTED Published: N/A Last Updated: 2024-06-21T15:49:38.270518 Description: No description available.
CVE ID: CVE-2024-37791 State: PUBLISHED Published: 2024-06-18T00:00:00 Last Updated: 2024-11-13T22:08:51.741Z Vendors: n/a Products: n/a Problem Types: n/a Description: DuxCMS3 v3.1.3 was discovered to contain a SQL injection vulnerability via the keyword parameter at /article/Content/index?class_id. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/duxphp/DuxCMS3/ - https://github.com/duxphp/DuxCMS3/issues/5
CVE ID: CVE-2024-37794 State: PUBLISHED Published: 2024-06-17T00:00:00 Last Updated: 2024-08-02T03:57:39.727Z Vendors: n/a Products: n/a Problem Types: n/a Description: Improper input validation in CVC5 Solver v1.1.3 allows attackers to cause a Denial of Service (DoS) via a crafted SMT2 input file. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/cvc5/cvc5/issues/10813
CVE ID: CVE-2024-37795 State: PUBLISHED Published: 2024-06-17T00:00:00 Last Updated: 2024-08-02T03:57:39.827Z Vendors: n/a Products: n/a Problem Types: n/a Description: A segmentation fault in CVC5 Solver v1.1.3 allows attackers to cause a Denial of Service (DoS) via a crafted SMT-LIB input file containing the `set-logic` command with specific formatting errors. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/cvc5/cvc5/issues/10813
CVE ID: CVE-2024-37798 State: PUBLISHED Published: 2024-06-17T00:00:00 Last Updated: 2024-08-02T03:57:39.815Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in search-appointment.php in the Admin Panel in Phpgurukul Beauty Parlour Management System 1.0 allows remote attackers to inject arbitrary web script or HTML via the search input field. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://owasp.org/www-community/attacks/xss/ - https://cyberxtron.com/blog/cve-2024-37798---cross-site-scripting-xss-in-beauty-parlour-management-system--5187
CVE ID: CVE-2024-37799 State: PUBLISHED Published: 2024-06-18T00:00:00 Last Updated: 2024-08-02T03:57:39.929Z Vendors: n/a Products: n/a Problem Types: n/a Description: CodeProjects Restaurant Reservation System v1.0 was discovered to contain a SQL injection vulnerability via the reserv_id parameter at view_reservations.php. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://code-projects.org/restaurant-reservation-system-in-php-with-source-code/ - https://github.com/himanshubindra/CVEs/blob/main/CVE-2024-37799
CVE ID: CVE-2024-37800 State: PUBLISHED Published: 2024-06-18T00:00:00 Last Updated: 2024-08-09T18:18:05.129Z Vendors: n/a Products: n/a Problem Types: n/a Description: CodeProjects Restaurant Reservation System v1.0 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the Date parameter at index.php. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://code-projects.org/restaurant-reservation-system-in-php-with-source-code/ - https://github.com/SandeepRajauriya/CVEs/blob/main/CVE-2024-37800
CVE ID: CVE-2024-37802 State: PUBLISHED Published: 2024-06-18T00:00:00 Last Updated: 2024-08-02T03:57:39.981Z Vendors: n/a Products: n/a Problem Types: n/a Description: CodeProjects Health Care hospital Management System v1.0 was discovered to contain a SQL injection vulnerability in the Patient Info module via the searvalu parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://code-projects.org/health-care-hospital-in-php-css-js-and-mysql-free-download/ - https://github.com/SandeepRajauriya/CVEs/blob/main/CVE-2024-37802
CVE ID: CVE-2024-37803 State: PUBLISHED Published: 2024-06-18T00:00:00.000Z Last Updated: 2025-03-18T20:46:31.451Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple stored cross-site scripting (XSS) vulnerabilities in CodeProjects Health Care hospital Management System v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the fname and lname parameters under the Staff Info page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://code-projects.org/health-care-hospital-in-php-css-js-and-mysql-free-download/ - https://github.com/himanshubindra/CVEs/blob/main/CVE-2024-37803
CVE ID: CVE-2024-37816 State: PUBLISHED Published: 2024-11-27T00:00:00 Last Updated: 2024-11-27T19:34:39.809Z Vendors: n/a Products: n/a Problem Types: n/a Description: Quectel EC25-EUX EC25EUXGAR08A05M1G was discovered to contain a stack overflow. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://quectel.com - https://github.com/quectel-official/Quectel-Security
CVE ID: CVE-2024-37818 State: PUBLISHED Published: 2024-06-20T00:00:00 Last Updated: 2024-10-04T18:52:23.687581 Vendors: n/a Products: n/a Problem Types: n/a Description: Strapi v4.24.4 was discovered to contain a Server-Side Request Forgery (SSRF) via the component /strapi.io/_next/image. This vulnerability allows attackers to scan for open ports or access sensitive information via a crafted GET request. NOTE: The Strapi Development Community argues that this issue is not valid. They contend that "the strapi/admin was wrongly attributed a flaw that only pertains to the strapi.io website, and which, at the end of the day, does not pose any real SSRF risk to applications that make use of the
api.io website, and which, at the end of the day, does not pose any real SSRF risk to applications that make use of the Strapi library." Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://strapi.io/ - https://medium.com/%40barkadevaibhav491/server-side-request-forgery-in-strapi-e02d5fe218ab
CVE ID: CVE-2024-37820 State: PUBLISHED Published: 2024-06-25T00:00:00 Last Updated: 2024-11-21T19:03:29.772Z Vendors: n/a Products: n/a Problem Types: n/a Description: A nil pointer dereference in PingCAP TiDB v8.2.0-alpha-216-gfe5858b allows attackers to crash the application via expression.inferCollation. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/pingcap/tidb/issues/53580 - https://gist.github.com/ycybfhb/a9c1e14ce281f2f553adca84d384b761
CVE ID: CVE-2024-37821 State: PUBLISHED Published: 2024-06-18T00:00:00 Last Updated: 2024-08-02T03:57:39.894Z Vendors: n/a Products: n/a Problem Types: n/a Description: An arbitrary file upload vulnerability in the Upload Template function of Dolibarr ERP CRM up to v19.0.1 allows attackers to execute arbitrary code via uploading a crafted .SQL file. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - http://dolibarr.com - https://github.com/alexbsec/CVEs/blob/master/2024/CVE-2024-37821.md
CVE ID: CVE-2024-37825 State: PUBLISHED Published: 2024-06-24T00:00:00 Last Updated: 2024-11-08T15:27:22.326Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in EnvisionWare Computer Access & Reservation Control SelfCheck v1.0 (fixed in OneStop 3.2.0.27184 Hotfix May 2024) allows unauthenticated attackers on the same network to perform a directory traversal. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.envisionware.com/?lang=au - https://www.envisionware.com/pcres/?lang=au - https://gist.github.com/J0rdanis99/74ae1ee2f9777cdd1c9756f958064d7c
CVE ID: CVE-2024-37826 State: PUBLISHED Published: 2024-08-09T00:00:00 Last Updated: 2024-08-12T20:22:05.463Z Vendors: n/a Products: n/a Problem Types: n/a Description: A NULL pointer dereference in vercot Serva v4.6.0 allows attackers to cause a Denial of Service (DoS) via a crafted HTTP request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gist.github.com/Evian-Zhang/4453e7ac0da7cfa421c76c5ab514dba4