Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-41317 State: PUBLISHED Published: 2024-07-22T00:00:00 Last Updated: 2024-08-02T04:46:52.598Z Vendors: n/a Products: n/a Problem Types: n/a Description: TOTOLINK A6000R V1.0.1-B20201211.2000 was discovered to contain a command injection vulnerability via the ifname parameter in the apcli_do_enr_pbc_wps function. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/yanggao017/vuln/blob/main/TOTOLINK/A6000R/CI_3_apcli_do_enr_pbc_wps/README.md - https://gist.github.com/yanggao017/8b7a567996f1986ac9fb3ab427c59227
CVE ID: CVE-2024-41318 State: PUBLISHED Published: 2024-07-22T00:00:00 Last Updated: 2024-08-02T04:46:52.324Z Vendors: n/a Products: n/a Problem Types: n/a Description: TOTOLINK A6000R V1.0.1-B20201211.2000 was discovered to contain a command injection vulnerability via the ifname parameter in the apcli_wps_gen_pincode function. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/yanggao017/vuln/blob/main/TOTOLINK/A6000R/CI_5_apcli_wps_gen_pincode/README.md - https://gist.github.com/yanggao017/dc88fb2e29291503addf1e7aa3775578
CVE ID: CVE-2024-41319 State: PUBLISHED Published: 2024-07-23T00:00:00 Last Updated: 2024-08-02T04:46:51.644Z Vendors: n/a Products: n/a Problem Types: n/a Description: TOTOLINK A6000R V1.0.1-B20201211.2000 was discovered to contain a command injection vulnerability via the cmd parameter in the webcmd function. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/yanggao017/vuln/blob/main/TOTOLINK/A6000R/CI_7_webcmd/README.md - https://gist.github.com/yanggao017/40efb889800ae2691c38086ebf80c037
CVE ID: CVE-2024-41320 State: PUBLISHED Published: 2024-07-22T00:00:00 Last Updated: 2024-08-02T04:46:52.261Z Vendors: n/a Products: n/a Problem Types: n/a Description: TOTOLINK A6000R V1.0.1-B20201211.2000 was discovered to contain a command injection vulnerability via the ifname parameter in the get_apcli_conn_info function. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/yanggao017/vuln/blob/main/TOTOLINK/A6000R/CI_6_get_apcli_conn_info/README.md - https://gist.github.com/yanggao017/081d8638c117e708a4d36783b9230ce5
CVE ID: CVE-2024-41332 State: PUBLISHED Published: 2024-08-09T00:00:00 Last Updated: 2024-08-09T20:25:26.483Z Vendors: n/a Products: n/a Problem Types: n/a Description: Incorrect access control in the delete_category function of Sourcecodester Computer Laboratory Management System v1.0 allows authenticated attackers with low-level privileges to arbitrarily delete categories. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.linkedin.com/in/sampath-kumar-kadajari-4b18891a7 - https://packetstormsecurity.com/files/179890/Computer-Laboratory-Management-System-1.0-Privilege-Escalation.html
CVE ID: CVE-2024-41333 State: PUBLISHED Published: 2024-08-06T00:00:00.000Z Last Updated: 2025-03-13T18:34:11.733Z Vendors: n/a Products: n/a Problem Types: n/a Description: A reflected cross-site scripting (XSS) vulnerability in Phpgurukul Tourism Management System v2.0 allows attackers to execute arbitrary code in the context of a user's browser via injecting a crafted payload into the uname parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.linkedin.com/in/sampath-kumar-kadajari-4b18891a7 - https://packetstormsecurity.com/files/179891/Tourism-Management-System-2.0-Cross-Site-Scripting.html
CVE ID: CVE-2024-41334 State: PUBLISHED Published: 2025-02-27T00:00:00.000Z Last Updated: 2025-05-06T18:05:50.033Z Vendors: n/a Products: n/a Problem Types: n/a Description: Draytek devices Vigor 165/166 prior to v4.2.6 , Vigor 2620/LTE200 prior to v3.9.8.8, Vigor 2860/2925 prior to v3.9.7, Vigor 2862/2926 prior to v3.9.9.4, Vigor 2133/2762/2832 prior to v3.9.8, Vigor 2135/2765/2766 prior to v4.4.5.1, Vigor 2865/2866/2927 prior to v4.4.5.3, Vigor 2962/3910 prior to v4.3.2.7, Vigor 3912 prior to v4.3.5.2, and Vigor 2925 up to v3.9.6 were discovered to not utilize certificate verification, allowing attackers to upload crafted APPE modules from non-official servers, leading to arbitrary code ex
verification, allowing attackers to upload crafted APPE modules from non-official servers, leading to arbitrary code execution. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://draytek.com - https://medium.com/faraday/advisory-multiple-vulnerabilities-affecting-draytek-routers-78a6cb8b3946
CVE ID: CVE-2024-41335 State: PUBLISHED Published: 2025-02-27T00:00:00.000Z Last Updated: 2025-02-28T21:56:56.765Z Vendors: n/a Products: n/a Problem Types: n/a Description: Draytek devices Vigor 165/166 prior to v4.2.6 , Vigor 2620/LTE200 prior to v3.9.8.8, Vigor 2860/2925 prior to v3.9.7, Vigor 2862/2926 prior to v3.9.9.4, Vigor 2133/2762/2832 prior to v3.9.8, Vigor 2135/2765/2766 prior to v4.4.5.1, Vigor 2865/2866/2927 prior to v4.4.5.3, Vigor 2962/3910 prior to v4.3.2.7, Vigor 3912 prior to v4.3.5.2, and Vigor 2925 up to v3.9.6 were discovered to utilize insecure versions of the functions strcmp and memcmp, allowing attackers to possibly obtain sensitive information via timing attacks. A
ns of the functions strcmp and memcmp, allowing attackers to possibly obtain sensitive information via timing attacks. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://draytek.com - https://medium.com/faraday/advisory-multiple-vulnerabilities-affecting-draytek-routers-78a6cb8b3946
CVE ID: CVE-2024-41336 State: PUBLISHED Published: 2025-02-27T00:00:00.000Z Last Updated: 2025-02-28T16:45:01.686Z Vendors: n/a Products: n/a Problem Types: n/a Description: Draytek devices Vigor 165/166 prior to v4.2.6 , Vigor 2620/LTE200 prior to v3.9.8.8, Vigor 2860/2925 prior to v3.9.7, Vigor 2862/2926 prior to v3.9.9.4, Vigor 2133/2762/2832 prior to v3.9.8, Vigor 2135/2765/2766 prior to v4.4.5.1, Vigor 2865/2866/2927 prior to v4.4.5.3, Vigor 2962/3910 prior to v4.3.2.7, Vigor 3912 prior to v4.3.5.2, and Vigor 2925 up to v3.9.6 were discovered to store passwords in plaintext. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://draytek.com - https://medium.com/faraday/
ntext. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://draytek.com - https://medium.com/faraday/advisory-multiple-vulnerabilities-affecting-draytek-routers-78a6cb8b3946
CVE ID: CVE-2024-41338 State: PUBLISHED Published: 2025-02-27T00:00:00.000Z Last Updated: 2025-02-28T14:32:28.132Z Vendors: n/a Products: n/a Problem Types: n/a Description: A NULL pointer dereference in Draytek devices Vigor 165/166 prior to v4.2.6 , Vigor 2620/LTE200 prior to v3.9.8.8, Vigor 2860/2925 prior to v3.9.7, Vigor 2862/2926 prior to v3.9.9.4, Vigor 2133/2762/2832 prior to v3.9.8, Vigor 2135/2765/2766 prior to v4.4.5.1, Vigor 2865/2866/2927 prior to v4.4.5.3, Vigor 2962/3910 prior to v4.3.2.7, Vigor 3912 prior to v4.3.5.2, and Vigor 2925 up to v3.9.6 allows attackers to cause a Denial of Service (DoS) via a crafted DHCP request. Additional Analyst Notes: - CISA ADP Vulnrichment: R
kers to cause a Denial of Service (DoS) via a crafted DHCP request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://draytek.com - https://medium.com/faraday/advisory-multiple-vulnerabilities-affecting-draytek-routers-78a6cb8b3946
CVE ID: CVE-2024-41339 State: PUBLISHED Published: 2025-02-27T00:00:00.000Z Last Updated: 2025-05-06T18:07:42.843Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in the CGI endpoint used to upload configurations in Draytek devices Vigor 165/166 prior to v4.2.6 , Vigor 2620/LTE200 prior to v3.9.8.8, Vigor 2860/2925 prior to v3.9.7, Vigor 2862/2926 prior to v3.9.9.4, Vigor 2133/2762/2832 prior to v3.9.8, Vigor 2135/2765/2766 prior to v4.4.5.1, Vigor 2865/2866/2927 prior to v4.4.5.3, Vigor 2962/3910 prior to v4.3.2.7, Vigor 3912 prior to v4.3.5.2, and Vigor 2925 up to v3.9.6 allows attackers to upload a crafted kernel module, allowing for arbitrary code execution. Additiona
r 2925 up to v3.9.6 allows attackers to upload a crafted kernel module, allowing for arbitrary code execution. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://draytek.com - https://medium.com/faraday/advisory-multiple-vulnerabilities-affecting-draytek-routers-78a6cb8b3946
CVE ID: CVE-2024-41340 State: PUBLISHED Published: 2025-02-27T00:00:00.000Z Last Updated: 2025-02-28T21:44:05.694Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in Draytek devices Vigor 165/166 prior to v4.2.6 , Vigor 2620/LTE200 prior to v3.9.8.8, Vigor 2860/2925 prior to v3.9.7, Vigor 2862/2926 prior to v3.9.9.4, Vigor 2133/2762/2832 prior to v3.9.8, Vigor 2135/2765/2766 prior to v4.4.5.1, Vigor 2865/2866/2927 prior to v4.4.5.3, Vigor 2962/3910 prior to v4.3.2.7, Vigor 3912 prior to v4.3.5.2, and Vigor 2925 up to v3.9.6 allows attackers to upload crafted APP Enforcement modules, leading to arbitrary code execution. Additional Analyst Notes: - CISA ADP Vulnrichment: Re
fted APP Enforcement modules, leading to arbitrary code execution. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://draytek.com - https://medium.com/faraday/advisory-multiple-vulnerabilities-affecting-draytek-routers-78a6cb8b3946
CVE ID: CVE-2024-41344 State: PUBLISHED Published: 2024-10-15T00:00:00 Last Updated: 2024-10-15T19:25:10.969Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Cross-Site Request Forgery (CSRF) in Codeigniter 3.1.13 allows attackers to arbitrarily change the Administrator password and escalate privileges. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/kirilkirkov/Ecommerce-CodeIgniter-Bootstrap/issues/264
CVE ID: CVE-2024-41345 State: PUBLISHED Published: 2024-08-29T00:00:00 Last Updated: 2024-08-29T20:49:52.679Z Vendors: n/a Products: n/a Problem Types: n/a Description: openflights commit 5234b5b is vulnerable to Cross-Site Scripting (XSS) via php/trip.php Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/jpatokal/openflights/issues/1480
CVE ID: CVE-2024-41346 State: PUBLISHED Published: 2024-08-29T00:00:00 Last Updated: 2024-08-30T13:59:16.596Z Vendors: n/a Products: n/a Problem Types: n/a Description: openflights commit 5234b5b is vulnerable to Cross-Site Scripting (XSS) via php/submit.php Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/jpatokal/openflights/issues/1479
CVE ID: CVE-2024-41347 State: PUBLISHED Published: 2024-08-29T00:00:00 Last Updated: 2024-08-30T13:59:48.146Z Vendors: n/a Products: n/a Problem Types: n/a Description: openflights commit 5234b5b is vulnerable to Cross-Site Scripting (XSS) via php/settings.php Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/jpatokal/openflights/issues/1477
CVE ID: CVE-2024-41348 State: PUBLISHED Published: 2024-08-29T00:00:00 Last Updated: 2024-08-30T13:56:58.349Z Vendors: n/a Products: n/a Problem Types: n/a Description: openflights commit 5234b5b is vulnerable to Cross-Site Scripting (XSS) via php/alsearch.php Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/jpatokal/openflights/issues/1478
CVE ID: CVE-2024-41349 State: PUBLISHED Published: 2024-08-29T00:00:00.000Z Last Updated: 2025-03-13T18:31:23.259Z Vendors: n/a Products: n/a Problem Types: n/a Description: unmark 1.9.2 is vulnerable to Cross Site Scripting (XSS) via application/views/marks/add_by_url.php. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/cdevroe/unmark/issues/290
CVE ID: CVE-2024-41350 State: PUBLISHED Published: 2024-08-29T00:00:00 Last Updated: 2024-08-29T20:45:32.756Z Vendors: n/a Products: n/a Problem Types: n/a Description: bjyadmin commit a560fd5 is vulnerable to Cross Site Scripting (XSS) via Public/statics/umeditor1_2_3/php/imageUp.php Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/baijunyao/thinkphp-bjyadmin - https://github.com/xjzzzxx/vulFound/blob/main/bjyadmin/xss2.md
CVE ID: CVE-2024-41351 State: PUBLISHED Published: 2024-08-29T00:00:00 Last Updated: 2024-08-29T20:51:09.436Z Vendors: n/a Products: n/a Problem Types: n/a Description: bjyadmin commit a560fd5 is vulnerable to Cross Site Scripting (XSS) via Public/statics/umeditor1_2_3/php/getContent.php Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/baijunyao/thinkphp-bjyadmin - https://github.com/xjzzzxx/vulFound/blob/main/bjyadmin/xss1.md
CVE ID: CVE-2024-41353 State: PUBLISHED Published: 2024-07-26T00:00:00 Last Updated: 2024-08-02T04:46:51.601Z Vendors: n/a Products: n/a Problem Types: n/a Description: phpipam 1.6 is vulnerable to Cross Site Scripting (XSS) via app\admin\groups\edit-group.php Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/phpipam/phpipam/issues/4147
CVE ID: CVE-2024-41354 State: PUBLISHED Published: 2024-07-26T00:00:00 Last Updated: 2024-08-02T04:46:52.397Z Vendors: n/a Products: n/a Problem Types: n/a Description: phpipam 1.6 is vulnerable to Cross Site Scripting (XSS) via /app/admin/widgets/edit.php Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/phpipam/phpipam/issues/4150
CVE ID: CVE-2024-41355 State: PUBLISHED Published: 2024-07-26T00:00:00 Last Updated: 2024-08-02T04:46:52.655Z Vendors: n/a Products: n/a Problem Types: n/a Description: phpipam 1.6 is vulnerable to Cross Site Scripting (XSS) via /app/tools/request-ip/index.php. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/phpipam/phpipam/issues/4151
CVE ID: CVE-2024-41356 State: PUBLISHED Published: 2024-07-26T00:00:00 Last Updated: 2024-08-02T04:46:51.579Z Vendors: n/a Products: n/a Problem Types: n/a Description: phpipam 1.6 is vulnerable to Cross Site Scripting (XSS) via app\admin\firewall-zones\zones-edit-network.php. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/phpipam/phpipam/issues/4146
CVE ID: CVE-2024-41357 State: PUBLISHED Published: 2024-07-26T00:00:00.000Z Last Updated: 2025-04-16T14:05:43.853Z Vendors: n/a Products: n/a Problem Types: n/a Description: phpipam 1.6 is vulnerable to Cross Site Scripting (XSS) via /app/admin/powerDNS/record-edit.php. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/phpipam/phpipam/issues/4149 - https://github.com/MarkLee131/awesome-web-pocs/blob/main/CVE-2024-41357.md
CVE ID: CVE-2024-41358 State: PUBLISHED Published: 2024-08-29T00:00:00.000Z Last Updated: 2025-04-16T13:57:40.598Z Vendors: n/a Products: n/a Problem Types: n/a Description: phpipam 1.6 is vulnerable to Cross Site Scripting (XSS) via app\admin\import-export\import-load-data.php. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/phpipam/phpipam/issues/4148 - https://github.com/MarkLee131/awesome-web-pocs/blob/main/CVE-2024-41358.md
CVE ID: CVE-2024-41361 State: PUBLISHED Published: 2024-08-29T00:00:00 Last Updated: 2024-08-30T14:26:38.407Z Vendors: n/a Products: n/a Problem Types: n/a Description: RPi-Jukebox-RFID v2.7.0 was discovered to contain a remote code execution (RCE) vulnerability via htdocs\manageFilesFolders.php Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/MiczFlor/RPi-Jukebox-RFID/issues/2398
CVE ID: CVE-2024-41364 State: PUBLISHED Published: 2024-08-29T00:00:00 Last Updated: 2024-08-30T14:29:36.958Z Vendors: n/a Products: n/a Problem Types: n/a Description: RPi-Jukebox-RFID v2.7.0 was discovered to contain a remote code execution (RCE) vulnerability via htdocs\trackEdit.php Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/MiczFlor/RPi-Jukebox-RFID/issues/2400
CVE ID: CVE-2024-41366 State: PUBLISHED Published: 2024-08-29T00:00:00 Last Updated: 2024-08-30T14:32:23.948Z Vendors: n/a Products: n/a Problem Types: n/a Description: RPi-Jukebox-RFID v2.7.0 was discovered to contain a remote code execution (RCE) vulnerability via htdocs\userScripts.php Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/MiczFlor/RPi-Jukebox-RFID/issues/2399
CVE ID: CVE-2024-41367 State: PUBLISHED Published: 2024-08-29T00:00:00 Last Updated: 2024-08-30T14:31:30.856Z Vendors: n/a Products: n/a Problem Types: n/a Description: RPi-Jukebox-RFID v2.7.0 was discovered to contain a remote code execution (RCE) vulnerability via htdocs\api\playlist\appendFileToPlaylist.php Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/MiczFlor/RPi-Jukebox-RFID/issues/2397
CVE ID: CVE-2024-41368 State: PUBLISHED Published: 2024-08-29T00:00:00 Last Updated: 2024-08-30T14:27:43.213Z Vendors: n/a Products: n/a Problem Types: n/a Description: RPi-Jukebox-RFID v2.7.0 was discovered to contain a remote code execution (RCE) vulnerability via htdocs\inc.setWlanIpMail.php Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/MiczFlor/RPi-Jukebox-RFID/issues/2396
CVE ID: CVE-2024-41369 State: PUBLISHED Published: 2024-08-29T00:00:00 Last Updated: 2024-08-30T14:28:45.460Z Vendors: n/a Products: n/a Problem Types: n/a Description: RPi-Jukebox-RFID v2.7.0 was discovered to contain a remote code execution (RCE) vulnerability via htdocs\inc.setWifi.php Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/MiczFlor/RPi-Jukebox-RFID/issues/2401
CVE ID: CVE-2024-41370 State: PUBLISHED Published: 2024-08-29T00:00:00 Last Updated: 2024-08-30T13:41:11.851Z Vendors: n/a Products: n/a Problem Types: n/a Description: Organizr v1.90 was discovered to contain a SQL injection vulnerability via chat/setlike.php. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/causefx/Organizr - https://github.com/causefx/Organizr/issues/1998
CVE ID: CVE-2024-41371 State: PUBLISHED Published: 2024-08-29T00:00:00 Last Updated: 2024-08-30T14:34:49.336Z Vendors: n/a Products: n/a Problem Types: n/a Description: Organizr v1.90 is vulnerable to Cross Site Scripting (XSS) via api.php. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/causefx/Organizr - https://github.com/causefx/Organizr/issues/1997
CVE ID: CVE-2024-41372 State: PUBLISHED Published: 2024-08-29T00:00:00 Last Updated: 2024-08-30T13:40:08.796Z Vendors: n/a Products: n/a Problem Types: n/a Description: Organizr v1.90 was discovered to contain a SQL injection vulnerability via chat/settyping.php. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/causefx/Organizr - https://github.com/causefx/Organizr/issues/1999
CVE ID: CVE-2024-41373 State: PUBLISHED Published: 2024-07-26T00:00:00 Last Updated: 2024-08-02T04:46:52.377Z Vendors: n/a Products: n/a Problem Types: n/a Description: ICEcoder 8.1 contains a Path Traversal vulnerability via lib/backup-versions-preview-loader.php. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/xjzzzxx/vulFound/blob/main/icecoder/icecoder8.1_PT.md
CVE ID: CVE-2024-41374 State: PUBLISHED Published: 2024-07-26T00:00:00 Last Updated: 2024-08-02T04:46:52.479Z Vendors: n/a Products: n/a Problem Types: n/a Description: ICEcoder 8.1 is vulnerable to Cross Site Scripting (XSS) via lib/settings-screen.php Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/xjzzzxx/vulFound/blob/main/icecoder/icecoder8.1_xss2.md
CVE ID: CVE-2024-41375 State: PUBLISHED Published: 2024-07-26T00:00:00 Last Updated: 2024-08-02T04:46:52.407Z Vendors: n/a Products: n/a Problem Types: n/a Description: ICEcoder 8.1 is vulnerable to Cross Site Scripting (XSS) via lib/terminal-xhr.php Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/xjzzzxx/vulFound/blob/main/icecoder/icecoder8.1_xss1.md
CVE ID: CVE-2024-41376 State: PUBLISHED Published: 2024-08-05T00:00:00 Last Updated: 2024-08-05T17:40:28.470Z Vendors: n/a Products: n/a Problem Types: n/a Description: dzzoffice 2.02.1 is vulnerable to Directory Traversal via user/space/about.php. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/zyx0814/dzzoffice/issues/252
CVE ID: CVE-2024-41380 State: PUBLISHED Published: 2024-08-05T00:00:00 Last Updated: 2024-08-07T18:46:42.935Z Vendors: n/a Products: n/a Problem Types: n/a Description: microweber 2.0.16 was discovered to contain a Cross Site Scripting (XSS) vulnerability via userfiles\modules\tags\add_tagging_tagged.php. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/microweber/microweber/issues/1111
CVE ID: CVE-2024-41381 State: PUBLISHED Published: 2024-08-05T00:00:00 Last Updated: 2024-08-07T19:10:44.811Z Vendors: n/a Products: n/a Problem Types: n/a Description: microweber 2.0.16 was discovered to contain a Cross Site Scripting (XSS) vulnerability via userfiles\modules\settings\admin.php. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/microweber/microweber/issues/1110
CVE ID: CVE-2024-41432 State: PUBLISHED Published: 2024-08-07T00:00:00 Last Updated: 2024-08-07T17:31:22.277Z Vendors: n/a Products: n/a Problem Types: n/a Description: An IP Spoofing vulnerability has been discovered in Likeshop up to 2.5.7.20210811. This issue allows an attacker to replace their real IP address with any arbitrary IP address, specifically by adding a forged 'X-Forwarded' or 'Client-IP' header to requests. Exploiting IP spoofing, attackers can bypass account lockout mechanisms during attempts to log into admin accounts, spoof IP addresses in requests sent to the server, and impersonate IP addresses that have logged into user accounts, etc. Additional Analyst Notes: - CISA AD
o the server, and impersonate IP addresses that have logged into user accounts, etc. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitlab.com/c2at3/cve-2024-41432/-/blob/main/README.md
CVE ID: CVE-2024-41433 State: PUBLISHED Published: 2024-09-03T00:00:00 Last Updated: 2024-10-01T20:26:40.576Z Vendors: n/a Products: n/a Problem Types: n/a Description: PingCAP TiDB v8.1.0 was discovered to contain a buffer overflow via the component expression.ExplainExpressionList. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input. NOTE: PingCAP maintains that the actual reproduction of this issue did not cause the security impact of service interruption to other users. They argue that this is a complex query bug and not a DoS vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/pingcap/tidb/issues/53796
erability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/pingcap/tidb/issues/53796 - https://gist.github.com/ycybfhb/eec3a1eefe4c85eb22f1bca6114359a1
CVE ID: CVE-2024-41434 State: PUBLISHED Published: 2024-09-03T00:00:00 Last Updated: 2024-09-25T21:04:05.076467 Vendors: n/a Products: n/a Problem Types: n/a Description: PingCAP TiDB v8.1.0 was discovered to contain a buffer overflow via the component (*Column).GetDecimal. This allows attackers to cause a Denial of Service (DoS) via a crafted input to the 'RemoveUnnecessaryFirstRow', it will check the expression between 'Agg' and 'GroupBy', but does not check the return type. NOTE: PingCAP disputes this, arguing that reproduction did not cause the security impact of service interruption to other users. They maintain it is a complex query bug in the product but not a DoS. Additional Analyst
e interruption to other users. They maintain it is a complex query bug in the product but not a DoS. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/pingcap/tidb/issues/53733 - https://gist.github.com/ycybfhb/4aa6809695b9e8a1cd1429e597c17517