Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-7829 State: PUBLISHED Published: 2024-08-15T12:31:05.244Z Last Updated: 2024-08-15T16:01:13.603Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C) Vendors: D-Link Products: DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05, DNS-1550-04 Problem Types: CWE-120 Description: ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability, which was classified as critical, has been found in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS
, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20240814. This issue affects the function cgi_del_photo of the file /cgi-bin/photocenter_mgr.cgi. The manipulation of the argument current_path leads to buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: Vendor was contacted early and confirmed that the product is end-of-life. It should be retired and replaced. Additional Analyst Notes: - CISA ADP Vulnrichment: Refere
the product is end-of-life. It should be retired and replaced. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.274727 - https://vuldb.com/?ctiid.274727 - https://vuldb.com/?submit.390117 - https://github.com/BuaaIOTTeam/Iot_Dlink_NAS/blob/main/DNS_cgi_del_photo.md - https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10383
CVE ID: CVE-2024-7830 State: PUBLISHED Published: 2024-08-15T13:00:06.188Z Last Updated: 2024-08-15T16:01:15.692Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C) Vendors: D-Link Products: DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05, DNS-1550-04 Problem Types: CWE-120 Description: ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability, which was classified as critical, was found in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100
-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20240814. Affected is the function cgi_move_photo of the file /cgi-bin/photocenter_mgr.cgi. The manipulation of the argument photo_name leads to buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: Vendor was contacted early and confirmed that the product is end-of-life. It should be retired and replaced. Additional Analyst Notes: - CISA ADP Vulnrichment: References:
roduct is end-of-life. It should be retired and replaced. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.274728 - https://vuldb.com/?ctiid.274728 - https://vuldb.com/?submit.390118 - https://github.com/BuaaIOTTeam/Iot_Dlink_NAS/blob/main/DNS_cgi_move_photo.md - https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10383
CVE ID: CVE-2024-7831 State: PUBLISHED Published: 2024-08-15T13:00:08.266Z Last Updated: 2024-08-15T16:01:17.786Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C) Vendors: D-Link Products: DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05, DNS-1550-04 Problem Types: CWE-120 Description: ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability has been found in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-0
-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20240814 and classified as critical. Affected by this vulnerability is the function cgi_get_cooliris of the file /cgi-bin/photocenter_mgr.cgi. The manipulation of the argument path leads to buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: Vendor was contacted early and confirmed that the product is end-of-life. It should be retired and replaced. Additional Analyst Notes: - CISA ADP Vulnrichment: Refer
the product is end-of-life. It should be retired and replaced. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.274729 - https://vuldb.com/?ctiid.274729 - https://vuldb.com/?submit.390119 - https://github.com/BuaaIOTTeam/Iot_Dlink_NAS/blob/main/DNS_cgi_get_cooliris.md - https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10383
CVE ID: CVE-2024-7832 State: PUBLISHED Published: 2024-08-15T13:31:04.175Z Last Updated: 2024-08-16T15:09:53.544Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C) Vendors: D-Link Products: DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05, DNS-1550-04 Problem Types: CWE-120 Description: ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up
DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20240814 and classified as critical. Affected by this issue is the function cgi_get_fullscreen_photos of the file /cgi-bin/photocenter_mgr.cgi. The manipulation of the argument user leads to buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: Vendor was contacted early and confirmed that the product is end-of-life. It should be retired and replaced. Additional Analyst Notes: - CISA ADP Vulnrichment: Reference
product is end-of-life. It should be retired and replaced. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.274730 - https://vuldb.com/?ctiid.274730 - https://vuldb.com/?submit.390120 - https://github.com/BuaaIOTTeam/Iot_Dlink_NAS/blob/main/DNS_cgi_get_fullscreen_photos.md - https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10383
CVE ID: CVE-2024-7833 State: PUBLISHED Published: 2024-08-15T14:00:04.876Z Last Updated: 2024-09-03T18:03:42.204Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: D-Link Products: DI-8100 Problem Types: CWE-77 Description: A vulnerability was found in D-Link DI-8100 16.07. It has been classified as critical. This affects the function upgrade_filter_asp of the file upgrade_filter.asp. The manipulation of the argument path leads to command injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.274731 - https://vuldb.com/?ctiid.2747
ional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.274731 - https://vuldb.com/?ctiid.274731 - https://vuldb.com/?submit.385338 - https://github.com/aLtEr6/pdf/blob/main/3.pdf
CVE ID: CVE-2024-7834 State: PUBLISHED Published: 2024-09-04T12:35:27.628Z Last Updated: 2024-09-04T13:15:24.562Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Overwolf Products: Overwolf Problem Types: CWE-427 Description: A local privilege escalation is caused by Overwolf loading and executing certain dynamic link library files from a user-writeable folder in SYSTEM context on launch. This allows an attacker with unprivileged access to the system to run arbitrary code with SYSTEM privileges by placing a malicious .dll file in the respective location. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cirosec.de/sa/sa-2024-004
CVE ID: CVE-2024-7835 State: PUBLISHED Published: 2024-09-23T11:31:32.456Z Last Updated: 2024-09-23T17:34:24.049Z Vendors: Exnet Informatics Software Products: Ferry Reservation System Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Exnet Informatics Software Ferry Reservation System allows Reflected XSS.This issue affects Ferry Reservation System: before 240805-002. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.usom.gov.tr/bildirim/tr-24-1518
CVE ID: CVE-2024-7836 State: PUBLISHED Published: 2024-08-22T02:02:03.277Z Last Updated: 2024-08-22T14:28:06.284Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: themifyme Products: Themify Builder Problem Types: CWE-863 Description: The Themify Builder plugin for WordPress is vulnerable to unauthorized post duplication due to missing checks on the duplicate_page_ajaxify function in all versions up to, and including, 7.6.1. This makes it possible for authenticated attackers, with Contributor-level access and above, to duplicate and view private or draft posts created by other users that otherwise shouldn't be accessible to them. Additional Analyst Notes: - C
vate or draft posts created by other users that otherwise shouldn't be accessible to them. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/31dfc46c-a673-41f1-b701-aa832f004ebc?source=cve - https://plugins.trac.wordpress.org/browser/themify-builder/tags/7.6.1/classes/class-builder-duplicate-page.php#L41
CVE ID: CVE-2024-7837 State: PUBLISHED Published: 2024-11-22T08:12:52.767Z Last Updated: 2024-11-25T18:18:08.079Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N) Vendors: Firmanet Software Products: ERP Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Firmanet Software ERP allows SQL Injection.This issue affects ERP: through 22.11.2024. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.usom.gov.tr/bildirim/tr-24-1868
CVE ID: CVE-2024-7838 State: PUBLISHED Published: 2024-08-15T20:00:05.101Z Last Updated: 2024-08-15T20:27:22.615Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: itsourcecode Products: Online Food Ordering System Problem Types: CWE-89 Description: A vulnerability was found in itsourcecode Online Food Ordering System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /addcategory.php. The manipulation of the argument cname leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.2
to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.274742 - https://vuldb.com/?ctiid.274742 - https://vuldb.com/?submit.391525 - https://github.com/ppp-src/a/issues/1
CVE ID: CVE-2024-7839 State: PUBLISHED Published: 2024-08-15T21:00:05.485Z Last Updated: 2024-08-16T16:04:33.921Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: itsourcecode Products: Billing System Problem Types: CWE-89 Description: A vulnerability classified as critical has been found in itsourcecode Billing System 1.0. This affects an unknown part of the file addbill.php. The manipulation of the argument owners_id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.274743 - https://vuldb.com/?ctiid.274743 - h
Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.274743 - https://vuldb.com/?ctiid.274743 - https://vuldb.com/?submit.391531 - https://github.com/ppp-src/a/issues/2
CVE ID: CVE-2024-7840 State: PUBLISHED Published: 2024-10-09T14:41:40.048Z Last Updated: 2025-11-03T19:34:43.663Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Progress Software Products: Telerik Reporting Problem Types: CWE-77 Description: In Progress Telerik Reporting versions prior to 2024 Q3 (18.2.24.924), a command injection attack is possible through improper neutralization of hyperlink elements. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://docs.telerik.com/reporting/knowledge-base/command-injection-cve-2024-7840
CVE ID: CVE-2024-7841 State: PUBLISHED Published: 2024-08-15T21:31:03.801Z Last Updated: 2024-08-16T14:07:55.289Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: SourceCodester Products: Clinics Patient Management System Problem Types: CWE-89 Description: A vulnerability classified as critical was found in SourceCodester Clinics Patient Management System 1.0. This vulnerability affects unknown code of the file /pms/ajax/check_user_name.php. The manipulation of the argument user_name leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vu
een disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.274744 - https://vuldb.com/?ctiid.274744 - https://vuldb.com/?submit.391540 - https://github.com/qqlove555/cve/blob/main/sql.md
CVE ID: CVE-2024-7842 State: PUBLISHED Published: 2024-08-15T21:31:05.261Z Last Updated: 2024-08-16T17:04:19.257Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: SourceCodester Products: Online Graduate Tracer System Problem Types: CWE-200 Description: A vulnerability, which was classified as problematic, has been found in SourceCodester Online Graduate Tracer System 1.0. This issue affects some unknown processing of the file /tracking/admin/export_it.php. The manipulation leads to information disclosure. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: Refe
y. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.274745 - https://vuldb.com/?ctiid.274745 - https://vuldb.com/?submit.391562 - https://github.com/Wsstiger/cve/blob/main/Tracer_info.md
CVE ID: CVE-2024-7843 State: PUBLISHED Published: 2024-08-15T22:31:03.936Z Last Updated: 2024-08-20T16:07:57.564Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: SourceCodester Products: Online Graduate Tracer System Problem Types: CWE-200 Description: A vulnerability, which was classified as problematic, was found in SourceCodester Online Graduate Tracer System 1.0. Affected is an unknown function of the file /tracking/admin/exportcs.php. The manipulation leads to information disclosure. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: -
ploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.274746 - https://vuldb.com/?ctiid.274746 - https://vuldb.com/?submit.391563 - https://github.com/Wsstiger/cve/blob/main/Tracer_info2.md
CVE ID: CVE-2024-7844 State: PUBLISHED Published: 2024-08-15T23:00:05.210Z Last Updated: 2024-08-16T15:58:49.928Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: SourceCodester Products: Online Graduate Tracer System Problem Types: CWE-79 Description: A vulnerability has been found in SourceCodester Online Graduate Tracer System 1.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /tracking/admin/add_acc.php. The manipulation of the argument name/user/position leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vuln
unched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.274747 - https://vuldb.com/?ctiid.274747 - https://vuldb.com/?submit.391566 - https://github.com/Wsstiger/cve/blob/main/Tracer_XSS.md
CVE ID: CVE-2024-7845 State: PUBLISHED Published: 2024-08-15T23:31:04.000Z Last Updated: 2024-08-16T16:48:18.796Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: SourceCodester Products: Online Graduate Tracer System Problem Types: CWE-89 Description: A vulnerability was found in SourceCodester Online Graduate Tracer System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /tracking/admin/fetch_it.php. The manipulation of the argument request leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https
has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.274748 - https://vuldb.com/?ctiid.274748 - https://vuldb.com/?submit.391606 - https://github.com/Wsstiger/cve/blob/main/Tracer_sql2.md
CVE ID: CVE-2024-7846 State: PUBLISHED Published: 2024-09-23T06:00:01.607Z Last Updated: 2024-09-23T15:27:52.329Z Vendors: Unknown Products: YITH WooCommerce Ajax Search Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: YITH WooCommerce Ajax Search is vulnerable to a XSS vulnerability due to insufficient sanitization of user supplied block attributes. This makes it possible for Contributors+ attackers to inject arbitrary scripts. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/86f7a136-d09b-4637-97ae-2cdaaff172a3/
CVE ID: CVE-2024-7847 State: PUBLISHED Published: 2024-10-14T13:47:14.540Z Last Updated: 2024-10-15T14:05:45.670Z Severity: HIGH (CVSS 7.7 CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H) Vendors: Rockwell Automation Products: RSLogix 500®, RSLogix™ Micro Developer and Starter, RSLogix™ 5 Problem Types: CWE-345 Description: VULNERABILITY DETAILS Rockwell Automation used the latest versions of the CVSS scoring system to assess the following vulnerabilities. The following vulnerabilities were reported to us by Sharon Brizinov of Claroty Research - Team82. A feature in the affected products enables users to prepare a project file with an embedded VBA script and can be configured to run once the pr
ed products enables users to prepare a project file with an embedded VBA script and can be configured to run once the project file has been opened without user intervention. This feature can be abused to trick a legitimate user into executing malicious code upon opening an infected RSP/RSS project file. If exploited, a threat actor may be able to perform a remote code execution. Connected devices may also be impacted by exploitation of this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1701.html
CVE ID: CVE-2024-7848 State: PUBLISHED Published: 2024-08-22T10:58:41.183Z Last Updated: 2024-08-22T13:11:38.449Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: deepakkite Products: User Private Files – WordPress File Sharing Plugin Problem Types: CWE-639 Description: The User Private Files – WordPress File Sharing Plugin plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.1.0 via the 'dpk_upvf_update_doc' due to missing validation on the 'docid' user controlled key. This makes it possible for authenticated attackers, with subscriber-level access and above, to gain access to other user's private fil
possible for authenticated attackers, with subscriber-level access and above, to gain access to other user's private files. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/0fb06de8-97d6-46c3-83ef-93a209540259?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3136913%40user-private-files&new=3136913%40user-private-files&sfp_email=&sfph_mail=
CVE ID: CVE-2024-7849 State: PUBLISHED Published: 2024-08-15T23:31:06.300Z Last Updated: 2024-08-16T17:21:43.257Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C) Vendors: D-Link Products: DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05, DNS-1550-04 Problem Types: CWE-120 Description: ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability, which was classified as critical, was found in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100
-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20240814. This affects the function cgi_create_album of the file /cgi-bin/photocenter_mgr.cgi. The manipulation of the argument current_path leads to buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: Vendor was contacted early and confirmed that the product is end-of-life. It should be retired and replaced. Additional Analyst Notes: - CISA ADP Vulnrichment: Refe
t the product is end-of-life. It should be retired and replaced. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.274755 - https://vuldb.com/?ctiid.274755 - https://vuldb.com/?submit.390113 - https://github.com/BuaaIOTTeam/Iot_Dlink_NAS/blob/main/DNS_cgi_create_album.md - https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10383
CVE ID: CVE-2024-7850 State: PUBLISHED Published: 2024-08-20T02:03:10.389Z Last Updated: 2024-08-20T13:47:01.127Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: dontdream Products: BP Profile Search Problem Types: CWE-352 Description: The BP Profile Search plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 5.7.5. This is due to missing or incorrect nonce validation on the bps_ajax_field_selector(), bps_ajax_template_options(), and bps_ajax_field_row() functions. This makes it possible for unauthenticated attackers to inject malicious web scripts via a forged request granted they can trick a site administra