Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-54930 State: PUBLISHED Published: 2024-12-09T00:00:00 Last Updated: 2024-12-12T17:31:05.525Z Vendors: n/a Products: n/a Problem Types: n/a Description: Kashipara E-learning Management System v1.0 is vulnerable to SQL Injection in /admin/delete_student.php. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/m14r41/Writeups/blob/main/CVE/Kashipara/E-learning%20Management%20System%20project/SQL%20Injection%20-%20delete%20student.pdf
CVE ID: CVE-2024-54931 State: PUBLISHED Published: 2024-12-09T00:00:00 Last Updated: 2024-12-11T15:49:11.310Z Vendors: n/a Products: n/a Problem Types: n/a Description: A SQL Injection was found in /admin/delete_event.php in kashipara E-learning Management System v1.0, which allows remote attackers to execute arbitrary SQL commands to get unauthorized database access via the id parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/m14r41/Writeups/blob/main/CVE/Kashipara/E-learning%20Management%20System%20project/SQL%20Injection%20-%20delete%20event.pdf
CVE ID: CVE-2024-54932 State: PUBLISHED Published: 2024-12-09T00:00:00 Last Updated: 2024-12-12T17:30:38.170Z Vendors: n/a Products: n/a Problem Types: n/a Description: Kashipara E-learning Management System v1.0 is vulnerable to SQL Injection in /admin/delete_department.php. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/m14r41/Writeups/blob/main/CVE/Kashipara/E-learning%20Management%20System%20project/SQL%20Injection%20-%20delete%20department.pdf
CVE ID: CVE-2024-54933 State: PUBLISHED Published: 2024-12-09T00:00:00 Last Updated: 2024-12-12T17:30:55.109Z Vendors: n/a Products: n/a Problem Types: n/a Description: Kashipara E-learning Management System v1.0 is vulnerable to SQL Injection in /admin/delete_content.php. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/m14r41/Writeups/blob/main/CVE/Kashipara/E-learning%20Management%20System%20project/SQL%20Injection%20-%20delete%20content.pdf
CVE ID: CVE-2024-54934 State: PUBLISHED Published: 2024-12-09T00:00:00 Last Updated: 2024-12-12T17:30:28.625Z Vendors: n/a Products: n/a Problem Types: n/a Description: Kashipara E-learning Management System v1.0 is vulnerable to SQL Injection in /admin/delete_class.php. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/m14r41/Writeups/blob/main/CVE/Kashipara/E-learning%20Management%20System%20project/SQL%20Injection%20-%20delete%20class.pdf
CVE ID: CVE-2024-54935 State: PUBLISHED Published: 2024-12-09T00:00:00 Last Updated: 2024-12-10T17:10:01.461Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Stored Cross-Site Scripting (XSS) vulnerability was found in /send_message_teacher_to_student.php of kashipara E-learning Management System v1.0. This vulnerability allows remote attackers to execute arbitrary scripts via the my_message parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/m14r41/Writeups/blob/main/CVE/Kashipara/E-learning%20Management%20System%20project/Stored%20XSS%20-%20student%20message.pdf
CVE ID: CVE-2024-54936 State: PUBLISHED Published: 2024-12-09T00:00:00 Last Updated: 2024-12-10T17:11:07.535Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Stored Cross-Site Scripting (XSS) vulnerability was found in /send_message.php of Kashipara E-learning Management System v1.0. This vulnerability allows remote attackers to execute arbitrary scripts via the my_message parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/m14r41/Writeups/blob/main/CVE/Kashipara/E-learning%20Management%20System%20project/Stored%20XSS%20-%20teacher%20message.pdf
CVE ID: CVE-2024-54937 State: PUBLISHED Published: 2024-12-09T00:00:00.000Z Last Updated: 2025-03-20T20:32:03.569Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Directory Listing issue was found in Kashipara E-Learning Management System v1.0, which allows remote attackers to access sensitive files and directories via /admin/assets. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/m14r41/Writeups/blob/main/CVE/Kashipara/E-learning%20Management%20System%20project/Directory%20listing%20-%20admin-assets.pdf
CVE ID: CVE-2024-54938 State: PUBLISHED Published: 2024-12-09T00:00:00 Last Updated: 2024-12-11T15:32:49.058Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Directory Listing issue was found in Kashipara E-Learning Management System v1.0, which allows remote attackers to access sensitive files and directories via /admin/uploads. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/m14r41/Writeups/blob/main/CVE/Kashipara/E-learning%20Management%20System%20project/Directory%20listing%20-%20admin-uploads.pdf
CVE ID: CVE-2024-54951 State: PUBLISHED Published: 2025-02-13T00:00:00.000Z Last Updated: 2025-02-14T15:53:41.951Z Vendors: n/a Products: n/a Problem Types: n/a Description: Monica 4.1.2 is vulnerable to Cross Site Scripting (XSS). A malicious user can create a malformed contact and use that contact in the "HOW YOU MET" customization options to trigger the XSS. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Allevon412/Monica-Stored-XSS-Vulnerability
CVE ID: CVE-2024-54952 State: PUBLISHED Published: 2025-05-29T00:00:00.000Z Last Updated: 2025-05-29T20:40:25.786Z Vendors: n/a Products: n/a Problem Types: n/a Description: MikroTik RouterOS 6.40.5, the SMB service contains a memory corruption vulnerability. Remote, unauthenticated attackers can exploit this issue by sending specially crafted packets, triggering a null pointer dereference. This leads to a Remote Denial of Service (DoS), rendering the SMB service unavailable. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/noobone123/RouterOS-issues/blob/main/README.md
CVE ID: CVE-2024-54954 State: PUBLISHED Published: 2025-02-10T00:00:00.000Z Last Updated: 2025-02-26T18:33:58.706Z Vendors: n/a Products: n/a Problem Types: n/a Description: OneBlog v2.3.6 was discovered to contain a template injection vulnerability via the template management department. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitee.com/yadong.zhang/DBlog/issues/IB6552 - https://gist.github.com/kaoniniang2/03658cc78e789b992b378f4951bedfb7
CVE ID: CVE-2024-54957 State: PUBLISHED Published: 2025-02-27T00:00:00.000Z Last Updated: 2025-03-03T15:54:08.820Z Vendors: n/a Products: n/a Problem Types: n/a Description: Nagios XI 2024R1.2.2 is vulnerable to an open redirect flaw on the Tools page, exploitable by users with read-only permissions. This vulnerability allows an attacker to craft a malicious link that redirects users to an arbitrary external URL without their consent. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.nagios.com/products/security/ - https://github.com/Sharpe-nl/CVEs/tree/main/CVE-2024-54957
CVE ID: CVE-2024-54958 State: PUBLISHED Published: 2025-02-20T00:00:00.000Z Last Updated: 2025-02-21T21:29:49.390Z Vendors: n/a Products: n/a Problem Types: n/a Description: Nagios XI 2024R1.2.2 is susceptible to a stored Cross-Site Scripting (XSS) vulnerability in the Tools page. This flaw allows an attacker to inject malicious scripts into the Tools interface, which are then stored and executed in the context of other users accessing the page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Sharpe-nl/CVEs/tree/main/CVE-2024-54958
CVE ID: CVE-2024-54959 State: PUBLISHED Published: 2025-02-20T00:00:00.000Z Last Updated: 2025-02-21T21:29:56.876Z Vendors: n/a Products: n/a Problem Types: n/a Description: Nagios XI 2024R1.2.2 is vulnerable to a Cross-Site Request Forgery (CSRF) attack through the Favorites component, enabling POST-based Cross-Site Scripting (XSS). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Sharpe-nl/CVEs/tree/main/CVE-2024-54959
CVE ID: CVE-2024-54960 State: PUBLISHED Published: 2025-02-20T00:00:00.000Z Last Updated: 2025-02-20T19:29:06.630Z Vendors: n/a Products: n/a Problem Types: n/a Description: A SQL Injection vulnerability in Nagios XI 2024R1.2.2 allows a remote attacker to execute SQL injection via a crafted payload in the History Tab component. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Sharpe-nl/CVEs/tree/main/CVE-2024-54960
CVE ID: CVE-2024-54961 State: PUBLISHED Published: 2025-02-20T00:00:00.000Z Last Updated: 2025-02-21T16:46:21.121Z Vendors: n/a Products: n/a Problem Types: n/a Description: Nagios XI 2024R1.2.2 has an Information Disclosure vulnerability, which allows unauthenticated users to access multiple pages displaying the usernames and email addresses of all current users. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Sharpe-nl/CVEs/tree/main/CVE-2024-54961
CVE ID: CVE-2024-54982 State: PUBLISHED Published: 2024-12-19T00:00:00 Last Updated: 2025-01-16T20:35:23.219Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in Quectel BC25 with firmware version BC25PAR01A06 allows attackers to bypass authentication via a crafted NAS message. NOTE: Quectel disputes this because the issue is in the chipset supply chain and is not localized to one or more Quectel products. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/haroldfeng/nbiot-va/blob/master/Quectel_BC25_Subscriber_Auth_Bypass.md
CVE ID: CVE-2024-54983 State: PUBLISHED Published: 2024-12-19T00:00:00 Last Updated: 2024-12-31T19:10:45.368Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in Quectel BC95-CNV V100R001C00SPC051 allows attackers to bypass authentication via a crafted NAS message. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/haroldfeng/nbiot-va/blob/master/Quecctel_BC95-CNV_Message_Auth_Bypass.md
CVE ID: CVE-2024-54984 State: PUBLISHED Published: 2024-12-19T00:00:00 Last Updated: 2025-01-09T16:28:30.316Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in Quectel BG96 BG96MAR02A08M1G allows attackers to bypass authentication via a crafted NAS message. NOTE: this is disputed by the supplier. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/haroldfeng/nbiot-va/blob/master/Quecctel_BG96_Message_Auth_Bypass.md
CVE ID: CVE-2024-54994 State: PUBLISHED Published: 2025-01-10T00:00:00 Last Updated: 2025-01-14T16:30:44.855Z Vendors: n/a Products: n/a Problem Types: n/a Description: MonicaHQ v4.1.2 was discovered to contain multiple Client-Side Injection vulnerabilities via the first_name and last_name parameters in the Add a new relationship feature. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://monicahq.com - https://github.com/p314dO/CVEs/tree/main/CVE-2024-54994
CVE ID: CVE-2024-54996 State: PUBLISHED Published: 2025-01-10T00:00:00 Last Updated: 2025-01-13T15:16:59.306Z Vendors: n/a Products: n/a Problem Types: n/a Description: MonicaHQ v4.1.2 was discovered to contain multiple authenticated Client-Side Injection vulnerabilities via the title and description parameters at /people/ID/reminders/create. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://monicahq.com - https://github.com/p314dO/CVEs/tree/main/CVE-2024-54996
CVE ID: CVE-2024-54997 State: PUBLISHED Published: 2025-01-10T00:00:00 Last Updated: 2025-01-13T21:35:22.355Z Vendors: n/a Products: n/a Problem Types: n/a Description: MonicaHQ v4.1.1 was discovered to contain an authenticated Client-Side Injection vulnerability via the entry text field at /journal/entries/ID/edit. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://monicahq.com - https://github.com/p314dO/CVEs/tree/main/CVE-2024-54997
CVE ID: CVE-2024-54998 State: PUBLISHED Published: 2025-01-10T00:00:00 Last Updated: 2025-01-14T16:34:44.083Z Vendors: n/a Products: n/a Problem Types: n/a Description: MonicaHQ v4.1.2 was discovered to contain an authenticated Client-Side Injection vulnerability via the Reason parameter at /people/h:[id]/debts/create. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://monicahq.com - https://github.com/p314dO/CVEs/tree/main/CVE-2024-54998
CVE ID: CVE-2024-54999 State: PUBLISHED Published: 2025-01-13T00:00:00 Last Updated: 2025-01-13T20:21:48.499Z Vendors: n/a Products: n/a Problem Types: n/a Description: MonicaHQ v4.1.2 was discovered to contain a Client-Side Injection vulnerability via the last_name parameter the General Information module. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://monicahq.com - https://github.com/p314dO/CVEs/tree/main/CVE-2024-54999
CVE ID: CVE-2024-55000 State: PUBLISHED Published: 2025-01-14T00:00:00 Last Updated: 2025-01-14T16:18:43.964Z Vendors: n/a Products: n/a Problem Types: n/a Description: Sourcecodester House Rental Management system v1.0 is vulnerable to Cross Site Scripting (XSS) in rental/manage_categories.php. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/tang-0717/VUL/blob/main/House%20Rental%20Management%20system%20-%20Storage%20XSS%20on%20%28rentalmanage_categories.php%29.md
CVE ID: CVE-2024-55008 State: PUBLISHED Published: 2025-01-07T00:00:00 Last Updated: 2025-01-08T19:59:55.429Z Vendors: n/a Products: n/a Problem Types: n/a Description: JATOS 3.9.4 contains a denial-of-service (DoS) vulnerability in the authentication system, where an attacker can prevent legitimate users from accessing their accounts by repeatedly sending multiple failed login attempts. Specifically, by submitting 3 incorrect login attempts every minute, the attacker can trigger the account lockout mechanism on the account level, effectively locking the user out indefinitely. Since the lockout is applied to the user account and not based on the IP address, any attacker can trigger the locko
ly. Since the lockout is applied to the user account and not based on the IP address, any attacker can trigger the lockout on any user account, regardless of their privileges. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://jatos.com - https://hacking-notes.medium.com/cve-2024-51379-jatos-v3-9-4-account-lockout-denial-of-service-cc970f4ca58f
CVE ID: CVE-2024-55009 State: PUBLISHED Published: 2025-03-19T00:00:00.000Z Last Updated: 2025-03-24T13:32:17.116Z Vendors: n/a Products: n/a Problem Types: n/a Description: A reflected cross-site scripting (XSS) vulnerability in AutoBib - Bibliographic collection management system 3.1.140 and earlier allows attackers to execute arbitrary Javascript in the context of a victim's browser via injecting a crafted payload into the WCE=topFrame&WCU= parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://youtu.be/1mSgChs-a8Q - https://youtu.be/SHk3mdsd2mI - https://medium.com/@r3dd1t/poc-cve-0b3ad0535631
CVE ID: CVE-2024-55016 State: PUBLISHED Published: 2025-11-14T00:00:00.000Z Last Updated: 2025-11-14T17:02:33.403Z Vendors: n/a Products: n/a Problem Types: n/a Description: PHPGurukul Student Record Management System 3.20 is vulnerable to SQL Injection via the id and password parameters in login.php. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://phpgurukul.com/student-record-system-php - https://github.com/leexsoyoung/CVEs/blob/main/CVE-2024-55016.md
CVE ID: CVE-2024-55017 State: PUBLISHED Published: 2025-09-30T00:00:00.000Z Last Updated: 2025-09-30T19:27:55.072Z Vendors: n/a Products: n/a Problem Types: n/a Description: Account Takeover in Corezoid 6.6.0 in the OAuth2 implementation via an open redirect in the redirect_uri parameter allows attackers to intercept authorization codes and gain unauthorized access to victim accounts. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/corezoid/helm - https://medium.com/@elmiraibrahimlii/corezoid-cve-2024-55017-account-takeover-via-oauth2-redirect-uri-open-redirect-9dd78bc337a3
CVE ID: CVE-2024-55028 State: PUBLISHED Published: 2025-03-25T00:00:00.000Z Last Updated: 2025-03-26T14:46:34.058Z Vendors: n/a Products: n/a Problem Types: n/a Description: A template injection vulnerability in the Dashboard of NASA Fprime v3.4.3 allows attackers to execute arbitrary code via uploading a crafted Vue file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://visionspace.com/remote-code-execution-and-critical-vulnerabilities-in-nasa-fprime-v3-4-3/
CVE ID: CVE-2024-55029 State: PUBLISHED Published: 2025-03-25T00:00:00.000Z Last Updated: 2025-03-27T15:16:21.739Z Vendors: n/a Products: n/a Problem Types: n/a Description: NASA Fprime v3.4.3 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://visionspace.com/remote-code-execution-and-critical-vulnerabilities-in-nasa-fprime-v3-4-3/
CVE ID: CVE-2024-55030 State: PUBLISHED Published: 2025-03-25T00:00:00.000Z Last Updated: 2025-03-26T14:44:34.023Z Vendors: n/a Products: n/a Problem Types: n/a Description: A command injection vulnerability in the Command Dispatcher Service of NASA Fprime v3.4.3 allows attackers to execute arbitrary commands. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://visionspace.com/remote-code-execution-and-critical-vulnerabilities-in-nasa-fprime-v3-4-3/
CVE ID: CVE-2024-55040 State: PUBLISHED Published: 2025-07-21T00:00:00.000Z Last Updated: 2025-07-22T15:46:27.739Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting vulnerability in Sensaphone WEB600 Monitoring System v.1.6.5.H and before allows a remote attacker to execute arbitrary code via a crafted GET requests to /@.xml, placing payloads in the g7200, g7300, g4601, and g1F02 parameters. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/tcbutler320/Sensaphone-WEB600-XSS - https://sensaphone.com/products/sensaphone-web600-monitoring-system - https://vulmon.com/vulnerabilitydetails?qid=CVE-2024-55040
CVE ID: CVE-2024-55056 State: PUBLISHED Published: 2024-12-17T00:00:00 Last Updated: 2024-12-17T21:36:40.335Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stored cross-site scripting (XSS) vulnerability was identified in Phpgurukul Online Birth Certificate System 1.0 in /user/certificate-form.php via the full name field. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/SCR-athif/CVE/tree/main/CVE-2024-55056
CVE ID: CVE-2024-55057 State: PUBLISHED Published: 2024-12-17T00:00:00 Last Updated: 2024-12-17T21:21:53.695Z Vendors: n/a Products: n/a Problem Types: n/a Description: Phpgurukul Online Birth Certificate System 1.0 suffers from insufficient password requirements which can lead to unauthorized access to user accounts. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/SCR-athif/CVE/tree/main/CVE-2024-55057
CVE ID: CVE-2024-55058 State: PUBLISHED Published: 2024-12-17T00:00:00 Last Updated: 2024-12-18T15:31:10.430Z Vendors: n/a Products: n/a Problem Types: n/a Description: An insecure direct object reference (IDOR) vulnerability was discovered in PHPGurukul Online Birth Certificate System v1.0. This vulnerability resides in the viewid parameter of /user/view-application-detail.php. Authenticated users can exploit this flaw by manipulating the viewid parameter in the URL to access sensitive birth certificate details of other users without proper authorization checks. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/SCR-athif/CVE/tree/main/CVE-2024-55058
CVE ID: CVE-2024-55059 State: PUBLISHED Published: 2024-12-17T00:00:00 Last Updated: 2024-12-18T15:54:30.551Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stored HTML Injection vulnerability was identified in PHPGurukul Online Birth Certificate System v1.0 in /user/certificate-form.php. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/SCR-athif/CVE/tree/main/CVE-2024-55059
CVE ID: CVE-2024-55060 State: PUBLISHED Published: 2025-03-13T00:00:00.000Z Last Updated: 2025-03-19T18:31:27.593Z Vendors: n/a Products: n/a Problem Types: n/a Description: A cross-site scripting (XSS) vulnerability in the component index.php of Rafed CMS Website v1.44 allows attackers to execute arbitrary web scripts or HTML via a crafted payload. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.rafed-system.org/ - https://github.com/bigzooooz/CVE-2024-55060
CVE ID: CVE-2024-55062 State: PUBLISHED Published: 2025-01-31T00:00:00.000Z Last Updated: 2025-02-11T21:42:13.300Z Vendors: n/a Products: n/a Problem Types: n/a Description: Code Injection vulnerability in EasyVirt DCScope <= 8.6.0 and CO2Scope <= 1.3.0 allows remote unauthenticated attackers to execute arbitrary code to /api/license/sendlicense/. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Elymaro/CVE/blob/main/EasyVirt/CVE-2024-55062.md
CVE ID: CVE-2024-55063 State: PUBLISHED Published: 2025-05-19T00:00:00.000Z Last Updated: 2025-05-19T15:47:50.712Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple Code Injection vulnerabilities in EasyVirt DC NetScope <= 8.7.0 allows remote authenticated attackers to execute arbitrary code via the (1) lang parameter to /international/keyboard/options; the (2) keyboard_layout or (3) keyboard_variant parameter to /international/settings/keyboard; the (4) timezone parameter to /international/settings/timezone. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Elymaro/CVE/blob/main/EasyVirt/CVE-2024-55063.md
CVE ID: CVE-2024-55064 State: PUBLISHED Published: 2025-03-03T00:00:00.000Z Last Updated: 2025-03-04T16:46:32.743Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in EasyVirt DC NetScope <= 8.6.4 allow remote attackers to inject arbitrary JavaScript or HTML code via the (1) smtp_server, (2) smtp_account, (3) smtp_password, or (4) email_recipients parameter to /smtp/update; the (5) ntp or (6) dns parameter to /proxy/ntp/change; the (7) newVcenterAddress parameter to /process_new_vcenter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Elymaro/CVE/blob/main/EasyVirt/CVE-2024-55064.md
CVE ID: CVE-2024-55069 State: PUBLISHED Published: 2025-05-02T00:00:00.000Z Last Updated: 2025-05-12T14:08:54.678Z Vendors: n/a Products: n/a Problem Types: n/a Description: ffmpeg 7.1 is vulnerable to Null Pointer Dereference in function iamf_read_header in /libavformat/iamfdec.c. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://trac.ffmpeg.org/ticket/11326 - https://git.ffmpeg.org/gitweb/ffmpeg.git/commit/4cc1495aca45445181a107a682c32cfe31459929
CVE ID: CVE-2024-55070 State: PUBLISHED Published: 2025-03-27T00:00:00.000Z Last Updated: 2025-03-27T20:09:47.169Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Broken Object Level Authorization vulnerability in the component /households/permissions of hay-kot mealie v2.2.0 allows group managers to edit their own permissions. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/mealie-recipes/mealie/issues/4593 - https://m10x.de/posts/2025/03/all-your-recipe-are-belong-to-us-part-3/3-broken-access-controls-leading-to-privilege-escalation-and-more-in-mealie/
CVE ID: CVE-2024-55072 State: PUBLISHED Published: 2025-03-27T00:00:00.000Z Last Updated: 2025-03-27T19:56:11.179Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Broken Object Level Authorization vulnerability in the component /api/users/{user-id} of hay-kot mealie v2.2.0 allows users to edit their own profile in order to give themselves more permissions or to change their household. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/mealie-recipes/mealie/issues/4593 - https://m10x.de/posts/2025/03/all-your-recipe-are-belong-to-us-part-3/3-broken-access-controls-leading-to-privilege-escalation-and-more-in-mealie/