Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
nt input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/00b60b53-77bf-4640-bf2b-84e011014623?source=cve - https://plugins.trac.wordpress.org/browser/ultimate-blocks/trunk/src/blocks/advanced-heading/block.php - https://plugins.trac.wordpress.org/browser/ultimate-blocks/trunk/src/blocks/styled-box/block.php - https://plugins.trac.wordpress.o
gins.trac.wordpress.org/browser/ultimate-blocks/trunk/src/blocks/styled-box/block.php - https://plugins.trac.wordpress.org/browser/ultimate-blocks/trunk/src/blocks/how-to/block.php - https://plugins.trac.wordpress.org/browser/ultimate-blocks/trunk/src/blocks/image-slider/block.php - https://plugins.trac.wordpress.org/browser/ultimate-blocks/trunk/src/blocks/testimonial/block.php - https://gist.github.com/webber-naut/0a8a4f810da286392a43c4614d31712e - https://www.dropbox.com/scl/fi/zh7t1qsvxkxk2dfhwd7nn/Ultimate-Blocks-Stored-XSS_POC_4.20.24.mov?rlkey=ws16dcu7f6mjd3h9emsqev7jm&e=2&st=fdr7q9h7&dl=0 - https://plugins.trac.wordpress.org/changeset/3075315/ultimate-blocks - https://plugins.trac.wo
jm&e=2&st=fdr7q9h7&dl=0 - https://plugins.trac.wordpress.org/changeset/3075315/ultimate-blocks - https://plugins.trac.wordpress.org/browser/ultimate-blocks/trunk/src/extensions/custom-css/class-custom-css.php?rev=3102541#L173 - https://plugins.trac.wordpress.org/changeset/3108401/ - https://wordpress.org/plugins/ultimate-blocks/#developers
CVE ID: CVE-2024-4269 State: PUBLISHED Published: 2024-07-13T06:00:05.955Z Last Updated: 2024-08-01T20:33:53.069Z Vendors: Unknown Products: SVG Block Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The SVG Block WordPress plugin before 1.1.20 does not sanitize SVG file contents, which enables users with at least the author role to SVG with malicious JavaScript to conduct Stored XSS attacks. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://wpscan.com/vulnerability/8aae7aa1-6170-45d8-903f-8520913276da/
CVE ID: CVE-2024-4270 State: PUBLISHED Published: 2024-06-14T06:00:04.481Z Last Updated: 2025-03-24T16:08:11.879Z Vendors: Unknown Products: SVGMagic Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The SVGMagic WordPress plugin through 1.1 does not sanitize SVG file contents, which enables users with at least the author role to SVG with malicious JavaScript to conduct Stored XSS attacks. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://wpscan.com/vulnerability/7a3b89cc-7a81-448a-94fc-36a7033609d5/
CVE ID: CVE-2024-4271 State: PUBLISHED Published: 2024-06-14T06:00:04.687Z Last Updated: 2024-08-01T20:33:53.183Z Vendors: Unknown Products: SVGator Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The SVGator WordPress plugin through 1.2.6 does not sanitize SVG file contents, which enables users with at least the author role to SVG with malicious JavaScript to conduct Stored XSS attacks. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://wpscan.com/vulnerability/c1fe0bc7-a340-428e-a549-1e37291bea1c/
CVE ID: CVE-2024-4272 State: PUBLISHED Published: 2024-07-13T06:00:06.185Z Last Updated: 2024-08-01T20:33:53.006Z Vendors: Unknown Products: Support SVG Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Support SVG WordPress plugin before 1.1.0 does not sanitize SVG file contents, which enables users with at least the author role to SVG with malicious JavaScript to conduct Stored XSS attacks. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://wpscan.com/vulnerability/ed1b1540-a0e2-434e-8769-9532c3ed5e31/
CVE ID: CVE-2024-4273 State: PUBLISHED Published: 2024-06-04T05:32:16.657Z Last Updated: 2024-08-01T20:33:53.181Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: g5theme Products: Essential Real Estate Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Essential Real Estate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'ere_property_map' shortcode in all versions up to, and including, 4.4.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level
output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/c62ec31a-55e9-4404-b860-fa9a51ba3d3f?source=cve - https://wordpress.org/plugins/essential-real-estate/
CVE ID: CVE-2024-4274 State: PUBLISHED Published: 2024-06-04T05:32:15.727Z Last Updated: 2024-08-01T20:33:53.031Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: g5theme Products: Essential Real Estate Problem Types: CWE-639 Authorization Bypass Through User-Controlled Key Description: The Essential Real Estate plugin for WordPress is vulnerable to unauthorized loss of data due to insufficient validation on the remove_property_attachment_ajax() function in all versions up to, and including, 4.4.2. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary attachments. Additional Analyst Notes: - CISA ADP V
tackers, with subscriber-level access and above, to delete arbitrary attachments. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/7dc41eb7-5c9a-4a67-902d-9a855840668b?source=cve - https://plugins.trac.wordpress.org/browser/essential-real-estate/trunk/public/partials/property/class-ere-property.php#L28
CVE ID: CVE-2024-4275 State: PUBLISHED Published: 2024-05-10T07:33:38.841Z Last Updated: 2024-08-01T20:33:53.190Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: wpdevteam Products: Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Interactive Circle widget in all versions up to, and including, 5.9.19 due to insuffi
ss-Site Scripting via the plugin's Interactive Circle widget in all versions up to, and including, 5.9.19 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/91f50b65-f001-4c73-bfe3-1aed3fc10d26?source=cve - https://plugins.trac.wordpress.org/changeset/3083162/essential-addons-for-elementor-lite/tags/5.9.20/includes/Ele
=cve - https://plugins.trac.wordpress.org/changeset/3083162/essential-addons-for-elementor-lite/tags/5.9.20/includes/Elements/Interactive_Circle.php
CVE ID: CVE-2024-4276 State: REJECTED Published: N/A Last Updated: 2025-02-11T01:05:00.543Z Description: No description available.
CVE ID: CVE-2024-4277 State: PUBLISHED Published: 2024-05-10T09:32:08.904Z Last Updated: 2024-08-01T20:33:53.185Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: thimpress Products: LearnPress – WordPress LMS Plugin Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘layout_html’ parameter in all versions up to, and including, 4.2.6.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and ab
nitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/46693edf-bcc6-4af8-9f26-5ede865f4694?source=cve - https://plugins.trac.wordpress.org/browser/learnpress/tags/4.2.6.5/inc/ExternalPlugin/Elementor/Widgets/Instructor/ListInstructorsElementor.php?order=date#L96
CVE ID: CVE-2024-4278 State: PUBLISHED Published: 2024-09-26T06:30:59.796Z Last Updated: 2024-09-26T17:26:34.539Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N) Vendors: GitLab Products: GitLab Problem Types: CWE-821 Description: An information disclosure issue has been discovered in GitLab EE affecting all versions starting from 16.5 prior to 17.2.8, from 17.3 prior to 17.3.4, and from 17.4 prior to 17.4.1. A maintainer could obtain a Dependency Proxy password by editing a certain Dependency Proxy setting. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/458484 - https://hackerone.com/reports/2466205
CVE ID: CVE-2024-4279 State: PUBLISHED Published: 2024-05-16T05:33:25.813Z Last Updated: 2024-08-01T20:33:53.164Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: themeum Products: Tutor LMS – eLearning and online course solution Problem Types: CWE-639 Authorization Bypass Through User-Controlled Key Description: The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object Reference to Arbitrary Course Deletion in versions up to, and including, 2.7.0 via the 'tutor_course_delete' function due to missing validation on a user controlled key. This can allow authenticated attackers, with Instructor-level permis
due to missing validation on a user controlled key. This can allow authenticated attackers, with Instructor-level permissions and above, to delete any course. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/45d04643-e43a-4732-91bf-e4af7b622e33?source=cve - https://plugins.trac.wordpress.org/browser/tutor/trunk/classes/Course_List.php#L357 - https://plugins.trac.wordpress.org/changeset/3086489/
CVE ID: CVE-2024-4280 State: PUBLISHED Published: 2024-05-10T05:34:53.844Z Last Updated: 2024-08-01T20:33:53.282Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: videousermanuals Products: White Label CMS Problem Types: CWE-862 Missing Authorization Description: The White Label CMS plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the reset_plugin function in all versions up to, and including, 2.7.3. This makes it possible for unauthenticated attackers to reset plugin settings. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-i
tional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/13a206ea-0890-4535-9da7-54a7a45f0452?source=cve - https://plugins.trac.wordpress.org/changeset/3082887/white-label-cms
CVE ID: CVE-2024-4281 State: PUBLISHED Published: 2024-05-08T09:31:34.751Z Last Updated: 2024-08-21T21:04:11.994Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: jackdewey Products: Link Library Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Link Library plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'link-library' shortcode in all versions up to, and including, 7.6.11 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above,
user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/30c9c4b9-6905-4d8a-bc55-5cd6f6201d25?source=cve - https://plugins.trac.wordpress.org/changeset/3081532/link-library
CVE ID: CVE-2024-4282 State: PUBLISHED Published: 2025-02-14T23:33:06.196Z Last Updated: 2025-02-18T16:27:47.563Z Vendors: Brocade Products: Brocade SANnav Problem Types: CWE-327 Description: Brocade SANnav OVA before SANnav 2.3.1b enables SHA1 deprecated setting for SSH for port 22. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.broadcom.com/external/content/SecurityAdvisories/0/25400
CVE ID: CVE-2024-4283 State: PUBLISHED Published: 2024-09-16T21:34:08.579Z Last Updated: 2024-09-18T13:07:40.681Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N) Vendors: GitLab Products: GitLab Problem Types: CWE-601 Description: An issue has been discovered in GitLab EE affecting all versions starting from 11.1 before 17.1.7, 17.2 before 17.2.5, and 17.3 before 17.3.2. Under certain conditions an open redirect vulnerability could allow for an account takeover by breaking the OAuth flow. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/458502 - https://hackerone.com/reports/2474286
CVE ID: CVE-2024-4284 State: PUBLISHED Published: 2024-05-19T22:23:48.278Z Last Updated: 2024-08-01T20:33:53.194Z Severity: MEDIUM (CVSS 4.9 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H) Vendors: mintplex-labs Products: mintplex-labs/anything-llm Problem Types: CWE-400 Description: A vulnerability in mintplex-labs/anything-llm allows for a denial of service (DoS) condition through the modification of a user's `id` attribute to a value of 0. This issue affects the current version of the software, with the latest commit id `57984fa85c31988b2eff429adfc654c46e0c342a`. By exploiting this vulnerability, an attacker, with manager or admin privileges, can render a chosen account completely inaccessi
ting this vulnerability, an attacker, with manager or admin privileges, can render a chosen account completely inaccessible. The application's mechanism for suspending accounts does not provide a means to reverse this condition through the UI, leading to uncontrolled resource consumption. The vulnerability is introduced due to the lack of input validation and sanitization in the user modification endpoint and the middleware's token validation logic. This issue has been addressed in version 1.0.0 of the software. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://huntr.com/bounties/a5f45596-0aef-49e0-9f7d-63f1955a1552 - https://github.com/mintple
am Container: References: - https://huntr.com/bounties/a5f45596-0aef-49e0-9f7d-63f1955a1552 - https://github.com/mintplex-labs/anything-llm/commit/1b35bcbeab10b77e6dbd263cceecf1b965a40789
CVE ID: CVE-2024-4285 State: REJECTED Published: N/A Last Updated: 2025-02-11T01:05:26.319Z Description: No description available.
CVE ID: CVE-2024-4286 State: PUBLISHED Published: 2024-05-26T22:25:12.285Z Last Updated: 2024-08-01T20:33:53.068Z Severity: MEDIUM (CVSS 4.9 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N) Vendors: mintplex-labs Products: mintplex-labs/anything-llm Problem Types: CWE-917 Description: Mintplex-Labs' anything-llm application is vulnerable to improper neutralization of special elements used in an expression language statement, identified in the commit id `57984fa85c31988b2eff429adfc654c46e0c342a`. The vulnerability arises from the application's handling of user modifications by managers or admins, allowing for the modification of all existing attributes of the `user` database entity without prope
managers or admins, allowing for the modification of all existing attributes of the `user` database entity without proper checks or sanitization. This flaw can be exploited to delete user threads, denying users access to their previously submitted data, or to inject fake threads and/or chat history for social engineering attacks. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://huntr.com/bounties/a72d2923-297c-455f-af90-715e83b3da2b - https://github.com/mintplex-labs/anything-llm/commit/1b35bcbeab10b77e6dbd263cceecf1b965a40789
CVE ID: CVE-2024-4287 State: PUBLISHED Published: 2024-05-20T12:24:51.682Z Last Updated: 2024-08-01T20:33:53.198Z Severity: HIGH (CVSS 8.1 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) Vendors: mintplex-labs Products: mintplex-labs/anything-llm Problem Types: CWE-20 Description: In mintplex-labs/anything-llm, a vulnerability exists due to improper input validation in the workspace update process. Specifically, the application fails to validate or format JSON data sent in an HTTP POST request to `/api/workspace/:workspace-slug/update`, allowing it to be executed as part of a database query without restrictions. This flaw enables users with a manager role to craft a request that includes neste
database query without restrictions. This flaw enables users with a manager role to craft a request that includes nested write operations, effectively allowing them to create new Administrator accounts. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://huntr.com/bounties/34491fb7-5133-4e80-8782-74124350bbdb - https://github.com/mintplex-labs/anything-llm/commit/94b58249a37a21b1c08deaa2d1edfdecbb6deb18
CVE ID: CVE-2024-4288 State: PUBLISHED Published: 2024-05-16T11:05:28.662Z Last Updated: 2024-08-01T20:33:53.168Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: croixhaug Products: Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘link’ parameter in versions up to, and including, 1.6.7.14 due to insufficient input sanitization and output escaping. This makes it po
in versions up to, and including, 1.6.7.14 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/84262b4a-a662-4aaf-9eae-f5cca8f6cd06?source=cve - https://plugins.trac.wordpress.org/browser/simply-schedule-appointments/trunk/includes/class-shortcodes.php#L677 - https://plugins.trac.wordpress.org/changeset/3087297/
CVE ID: CVE-2024-4289 State: PUBLISHED Published: 2024-05-21T06:00:02.214Z Last Updated: 2025-03-19T13:46:14.307Z Vendors: Unknown Products: Sailthru Triggermail Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Sailthru Triggermail WordPress plugin through 1.1 does not sanitise and escape various parameters before outputting them back in pages and attributes, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://wpscan.com/vulnerability/072785de-0ce5-42a4-a3fd-4eb1d1a2f1be/
CVE ID: CVE-2024-4290 State: PUBLISHED Published: 2024-05-21T06:00:02.415Z Last Updated: 2024-08-01T20:33:53.097Z Vendors: Unknown Products: Sailthru Triggermail Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Sailthru Triggermail WordPress plugin through 1.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://wpscan.com/vulnerability/a9a10d0f-d8f2-4f3e-92bf-94fc08416d87/
CVE ID: CVE-2024-4291 State: PUBLISHED Published: 2024-04-27T20:00:07.538Z Last Updated: 2025-08-27T21:26:06.856Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C) Vendors: Tenda Products: A301 Problem Types: CWE-121 Description: A vulnerability was found in Tenda A301 15.13.08.12_multi_TDE01. It has been rated as critical. This issue affects the function formAddMacfilterRule of the file /goform/setBlackRule. The manipulation of the argument deviceList leads to stack-based buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-262223. NOTE: The vendor was contacted early about
d may be used. The associated identifier of this vulnerability is VDB-262223. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.262223 - https://vuldb.com/?ctiid.262223 - https://vuldb.com/?submit.320672 - https://github.com/L1ziang/Vulnerability/blob/main/formAddMacfilterRule.md
CVE ID: CVE-2024-4292 State: PUBLISHED Published: 2024-04-27T20:31:05.009Z Last Updated: 2024-08-01T20:33:53.083Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Contemporary Controls Products: BASrouter BACnet BASRT-B Problem Types: CWE-404 Description: A vulnerability classified as critical has been found in Contemporary Controls BASrouter BACnet BASRT-B 2.7.2. Affected is an unknown function of the component Device-Communication-Control Service. The manipulation with the input 55ff0500370015f30104025506110afb7519035d0841e4bece257b6acfc71f leads to denial of service. The exploit has been disclosed to the public and may be used. The identifier of this vulne
f leads to denial of service. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-262224. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.262224 - https://vuldb.com/?ctiid.262224 - https://vuldb.com/?submit.320749 - https://github.com/isZzzz/BASRT-B_BACnet_Router_Document/blob/main/BASRT_CVE_apply.pdf - https://github.com/isZzzz/BASRT-B_BACnet_Router_Document/blob/main/BASER-B_backdoor.pcapng
CVE ID: CVE-2024-4293 State: PUBLISHED Published: 2024-04-27T21:31:04.135Z Last Updated: 2024-08-01T20:33:53.191Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: PHPGurukul Products: Doctor Appointment Management System Problem Types: CWE-79 Description: A vulnerability classified as problematic was found in PHPGurukul Doctor Appointment Management System 1.0. Affected by this vulnerability is an unknown functionality of the file appointment-bwdates-reports-details.php. The manipulation of the argument fromdate/todate leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-262225 was assig