Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-57676 State: PUBLISHED Published: 2025-01-16T00:00:00.000Z Last Updated: 2025-02-03T19:27:13.918Z Vendors: n/a Products: n/a Problem Types: n/a Description: An access control issue in the component form2WlanBasicSetup.cgi of D-Link 816A2_FWv1.10CNB05_R1B011D88210 allows unauthenticated attackers to set the 2.4G and 5G wlan service of the device via a crafted POST request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.dlink.com/en/security-bulletin/ - https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Unauthorized_Vulnerability/D-Link/DIR-816/form2WlanBasicSetup.md
CVE ID: CVE-2024-57677 State: PUBLISHED Published: 2025-01-16T00:00:00.000Z Last Updated: 2025-02-03T19:31:50.312Z Vendors: n/a Products: n/a Problem Types: n/a Description: An access control issue in the component form2Wan.cgi of D-Link 816A2_FWv1.10CNB05_R1B011D88210 allows unauthenticated attackers to set the wan service of the device via a crafted POST request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.dlink.com/en/security-bulletin/ - https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Unauthorized_Vulnerability/D-Link/DIR-816/form2Wan.md
CVE ID: CVE-2024-57678 State: PUBLISHED Published: 2025-01-16T00:00:00.000Z Last Updated: 2025-02-03T19:32:41.435Z Vendors: n/a Products: n/a Problem Types: n/a Description: An access control issue in the component form2WlAc.cgi of D-Link 816A2_FWv1.10CNB05_R1B011D88210 allows unauthenticated attackers to set the 2.4G and 5G mac access control list of the device via a crafted POST request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.dlink.com/en/security-bulletin/ - https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Unauthorized_Vulnerability/D-Link/DIR-816/form2WlAc.md
CVE ID: CVE-2024-57679 State: PUBLISHED Published: 2025-01-16T00:00:00.000Z Last Updated: 2025-02-03T19:44:44.041Z Vendors: n/a Products: n/a Problem Types: n/a Description: An access control issue in the component form2RepeaterSetup.cgi of D-Link 816A2_FWv1.10CNB05_R1B011D88210 allows unauthenticated attackers to set the 2.4G and 5G repeater service of the device via a crafted POST request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.dlink.com/en/security-bulletin/ - https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Unauthorized_Vulnerability/D-Link/DIR-816/form2RepeaterSetup.md
CVE ID: CVE-2024-57680 State: PUBLISHED Published: 2025-01-16T00:00:00.000Z Last Updated: 2025-02-03T19:47:12.170Z Vendors: n/a Products: n/a Problem Types: n/a Description: An access control issue in the component form2PortriggerRule.cgi of D-Link 816A2_FWv1.10CNB05_R1B011D88210 allows unauthenticated attackers to set the port trigger of the device via a crafted POST request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.dlink.com/en/security-bulletin/ - https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Unauthorized_Vulnerability/D-Link/DIR-816/form2PortriggerRule.md
CVE ID: CVE-2024-57681 State: PUBLISHED Published: 2025-01-16T00:00:00.000Z Last Updated: 2025-02-03T19:48:58.633Z Vendors: n/a Products: n/a Problem Types: n/a Description: An access control issue in the component form2alg.cgi of D-Link 816A2_FWv1.10CNB05_R1B011D88210 allows unauthenticated attackers to set the agl service of the device via a crafted POST request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.dlink.com/en/security-bulletin/ - https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Unauthorized_Vulnerability/D-Link/DIR-816/form2alg.md
CVE ID: CVE-2024-57682 State: PUBLISHED Published: 2025-01-16T00:00:00.000Z Last Updated: 2025-02-03T19:50:25.089Z Vendors: n/a Products: n/a Problem Types: n/a Description: An information disclosure vulnerability in the component d_status.asp of D-Link 816A2_FWv1.10CNB05_R1B011D88210 allows unauthenticated attackers to access sensitive information via a crafted POST request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.dlink.com/en/security-bulletin/ - https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Unauthorized_Vulnerability/D-Link/DIR-816/d_status.md
CVE ID: CVE-2024-57683 State: PUBLISHED Published: 2025-01-16T00:00:00.000Z Last Updated: 2025-02-03T19:50:57.355Z Vendors: n/a Products: n/a Problem Types: n/a Description: An access control issue in the component websURLFilterAddDel of D-Link 816A2_FWv1.10CNB05_R1B011D88210 allows unauthenticated attackers to set the filter settings of the device via a crafted POST request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.dlink.com/en/security-bulletin/ - https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Unauthorized_Vulnerability/D-Link/DIR-816/websURLFilterAddDel.md
CVE ID: CVE-2024-57684 State: PUBLISHED Published: 2025-01-16T00:00:00 Last Updated: 2025-01-16T19:38:17.843Z Vendors: n/a Products: n/a Problem Types: n/a Description: An access control issue in the component formDMZ.cgi of D-Link 816A2_FWv1.10CNB05_R1B011D88210 allows unauthenticated attackers to set the DMZ service of the device via a crafted POST request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.dlink.com/en/security-bulletin/ - https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Unauthorized_Vulnerability/D-Link/DIR-816/formDMZ.md
CVE ID: CVE-2024-57685 State: PUBLISHED Published: 2025-02-24T00:00:00.000Z Last Updated: 2025-02-25T20:33:34.139Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in sparkshop v.1.1.7 and before allows a remote attacker to execute arbitrary code via a crafted phar file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/lhRaMk7/notebook/blob/main/phar_rce
CVE ID: CVE-2024-57686 State: PUBLISHED Published: 2025-01-10T00:00:00.000Z Last Updated: 2025-02-11T21:45:38.800Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Cross Site Scripting (XSS) vulnerability was found in /landrecordsys/admin/contactus.php in PHPGurukul Land Record System v1.0, which allows remote attackers to execute arbitrary code via the "pagetitle" parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/lhRaMk7/notebook/blob/main/phar_rce - https://github.com/Santoshcyber1/CVE-wirteup/blob/main/Phpgurukul/Land%20record/Reflected%20Cross%20Site%20Scripting.pdf
CVE ID: CVE-2024-57687 State: PUBLISHED Published: 2025-01-10T00:00:00 Last Updated: 2025-01-10T16:12:22.994Z Vendors: n/a Products: n/a Problem Types: n/a Description: An OS Command Injection vulnerability was found in /landrecordsys/admin/dashboard.php in PHPGurukul Land Record System v1.0, which allows remote attackers to execute arbitrary code via the "Cookie" GET request parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Santoshcyber1/CVE-wirteup/blob/main/Phpgurukul/Land%20record/Command%20Injection.pdf
CVE ID: CVE-2024-57695 State: PUBLISHED Published: 2025-11-11T00:00:00.000Z Last Updated: 2025-11-12T20:22:58.401Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in Agnitum Outpost Security Suite 7.5.3 (3942.608.1810) and 7.6 (3984.693.1842) allows a local attacker to execute arbitrary code via the lock function. The manufacturer fixed the vulnerability in version 8.0 (4164.652.1856) from December 17, 2012. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.youtube.com/watch?v=fvgD884wCX8 - https://habr.com/en/articles/161393/
CVE ID: CVE-2024-57698 State: PUBLISHED Published: 2025-04-29T00:00:00.000Z Last Updated: 2025-04-30T14:36:45.291Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in modernwms v.1.0 allows an attacker view the MD5 hash of the administrator password and other attributes without authentication, even after initial configuration and password change. This happens due to excessive exposure of information and the lack of adequate access control on the /user/list?culture=en-us endpoint. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/rodolfomarianocy/xpl-ModernWMS
CVE ID: CVE-2024-57699 State: PUBLISHED Published: 2025-02-05T00:00:00.000Z Last Updated: 2025-02-06T15:15:17.536Z Vendors: n/a Products: n/a Problem Types: n/a Description: A security issue was found in Netplex Json-smart 2.5.0 through 2.5.1. When loading a specially crafted JSON input, containing a large number of ’{’, a stack exhaustion can be trigger, which could allow an attacker to cause a Denial of Service (DoS). This issue exists because of an incomplete fix for CVE-2023-1370. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://nvd.nist.gov/vuln/detail/cve-2023-1370 - https://github.com/TurtleLiu/Vul_PoC/tree/main/CVE-2024-57699
CVE ID: CVE-2024-57703 State: PUBLISHED Published: 2025-01-16T00:00:00.000Z Last Updated: 2025-02-04T14:46:07.370Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda AC8v4 V16.03.34.06 has a stack overflow vulnerability. Affected by this vulnerability is the function setSchedWifi of the file /goform/openSchedWifi. The manipulation of the argument schedEndTime leads to stack-based buffer overflow. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Pr0b1em/IoT/blob/master/Tenda%20AC8v4%20V16.03.34.06.md
CVE ID: CVE-2024-57704 State: PUBLISHED Published: 2025-01-16T00:00:00.000Z Last Updated: 2025-02-03T20:34:12.035Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda AC8v4 V16.03.34.06 has a stack overflow vulnerability. Affected by this vulnerability is the function setSchedWifi of the file /goform/openSchedWifi. The manipulation of the argument schedStartTime leads to stack-based buffer overflow. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Pr0b1em/IoT/blob/master/Tenda%20AC8v4%20V16.03.34.06.md
CVE ID: CVE-2024-57707 State: PUBLISHED Published: 2025-02-07T00:00:00.000Z Last Updated: 2025-02-10T16:52:29.149Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in DataEase v1 allows an attacker to execute arbitrary code via the user account and password components. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/shigophilo/CVE/blob/main/DataEase-v1-code-execute.md
CVE ID: CVE-2024-57708 State: PUBLISHED Published: 2025-06-25T00:00:00.000Z Last Updated: 2025-07-25T20:32:40.823Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in OneTrust SDK v.6.33.0 allows a local attacker to cause a denial of service via the Object.setPrototypeOf, __proto__, and Object.assign components. NOTE: this is disputed by the Supplier who does not agree it is a prototype pollution vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://discord.com/assets/oneTrust/v4/scripttemplates/6.33.0/otBannerSdk.js - https://github.com/brotheralameen1/Discordforschool/security/advisories/GHSA-63xr-98vc-whx5 - https://packetstorm.news/fil
tps://github.com/brotheralameen1/Discordforschool/security/advisories/GHSA-63xr-98vc-whx5 - https://packetstorm.news/files/id/201222/
CVE ID: CVE-2024-57716 State: PUBLISHED Published: 2025-02-20T00:00:00.000Z Last Updated: 2025-02-21T15:12:59.058Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in trenoncourt AutoQueryable v.1.7.0 allows a remote attacker to obtain sensitive information via the Unselectable function. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/trenoncourt/AutoQueryable - https://github.com/pentesttoolscom/vulnerability-research/tree/master/CVE-2024-57716
CVE ID: CVE-2024-57719 State: PUBLISHED Published: 2025-01-23T00:00:00.000Z Last Updated: 2025-03-22T14:16:15.073Z Vendors: n/a Products: n/a Problem Types: n/a Description: lunasvg v3.0.0 was discovered to contain a segmentation violation via the component blend_transformed_tiled_argb.isra.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/keepinggg/poc/blob/main/poc_of_lunasvg_3.1.0 - https://github.com/sammycage/lunasvg/issues/209
CVE ID: CVE-2024-57720 State: PUBLISHED Published: 2025-01-23T00:00:00.000Z Last Updated: 2025-03-14T15:51:33.955Z Vendors: n/a Products: n/a Problem Types: n/a Description: lunasvg v3.0.0 was discovered to contain a segmentation violation via the component plutovg_blend. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/keepinggg/poc/blob/main/poc_of_lunasvg_3.1.0 - https://github.com/sammycage/lunasvg/issues/209
CVE ID: CVE-2024-57721 State: PUBLISHED Published: 2025-01-23T00:00:00.000Z Last Updated: 2025-03-18T19:32:37.882Z Vendors: n/a Products: n/a Problem Types: n/a Description: lunasvg v3.0.0 was discovered to contain a segmentation violation via the component plutovg_path_add_path. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/keepinggg/poc/blob/main/poc_of_lunasvg_3.1.0 - https://github.com/sammycage/lunasvg/issues/209
CVE ID: CVE-2024-57722 State: PUBLISHED Published: 2025-01-23T00:00:00.000Z Last Updated: 2025-03-14T17:18:07.967Z Vendors: n/a Products: n/a Problem Types: n/a Description: lunasvg v3.0.0 was discovered to contain a allocation-size-too-big bug via the component plutovg_surface_create. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/keepinggg/poc/blob/main/poc_of_lunasvg_3.1.0 - https://github.com/sammycage/lunasvg/issues/209
CVE ID: CVE-2024-57723 State: PUBLISHED Published: 2025-01-23T00:00:00.000Z Last Updated: 2025-03-18T20:27:11.788Z Vendors: n/a Products: n/a Problem Types: n/a Description: lunasvg v3.0.0 was discovered to contain a segmentation violation via the component composition_source_over. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/keepinggg/poc/blob/main/poc_of_lunasvg_3.1.0 - https://github.com/sammycage/lunasvg/issues/209
CVE ID: CVE-2024-57724 State: PUBLISHED Published: 2025-01-23T00:00:00.000Z Last Updated: 2025-03-19T14:03:26.613Z Vendors: n/a Products: n/a Problem Types: n/a Description: lunasvg v3.0.0 was discovered to contain a segmentation violation via the component gray_record_cell. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/keepinggg/poc/blob/main/poc_of_lunasvg_3.1.0 - https://github.com/sammycage/lunasvg/issues/209
CVE ID: CVE-2024-57725 State: PUBLISHED Published: 2025-02-14T00:00:00.000Z Last Updated: 2025-02-18T14:09:39.403Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in the Arcadyan Livebox Fibra PRV3399B_B_LT allows a remote or local attacker to modify the GPON link value without authentication, causing an internet service disruption via the /firstconnection.cgi endpoint. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/pointedsec/CVE-2024-57725
CVE ID: CVE-2024-57726 State: PUBLISHED Published: 2025-01-15T00:00:00.000Z Last Updated: 2025-01-31T20:18:33.957Z Vendors: n/a Products: n/a Problem Types: n/a Description: SimpleHelp remote support software v5.5.7 and before has a vulnerability that allows low-privileges technicians to create API keys with excessive permissions. These API keys can be used to escalate privileges to the server admin role. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.horizon3.ai/attack-research/disclosures/critical-vulnerabilities-in-simplehelp-remote-support-software/ - https://simple-help.com/kb---security-vulnerabilities-01-2025#security-vulnerabilities-in-simplehelp-5-5-7-a
software/ - https://simple-help.com/kb---security-vulnerabilities-01-2025#security-vulnerabilities-in-simplehelp-5-5-7-and-earlier
CVE ID: CVE-2024-57727 State: PUBLISHED Published: 2025-01-15T00:00:00.000Z Last Updated: 2025-10-21T22:55:31.634Z Vendors: n/a Products: n/a Problem Types: n/a Description: SimpleHelp remote support software v5.5.7 and before is vulnerable to multiple path traversal vulnerabilities that enable unauthenticated remote attackers to download arbitrary files from the SimpleHelp host via crafted HTTP requests. These files include server configuration files containing various secrets and hashed user passwords. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.horizon3.ai/attack-research/disclosures/critical-vulnerabilities-in-simplehelp-remote-support-software/ - https:/
://www.horizon3.ai/attack-research/disclosures/critical-vulnerabilities-in-simplehelp-remote-support-software/ - https://simple-help.com/kb---security-vulnerabilities-01-2025#security-vulnerabilities-in-simplehelp-5-5-7-and-earlier
CVE ID: CVE-2024-57728 State: PUBLISHED Published: 2025-01-15T00:00:00.000Z Last Updated: 2025-01-31T20:21:30.977Z Vendors: n/a Products: n/a Problem Types: n/a Description: SimpleHelp remote support software v5.5.7 and before allows admin users to upload arbitrary files anywhere on the file system by uploading a crafted zip file (i.e. zip slip). This can be exploited to execute arbitrary code on the host in the context of the SimpleHelp server user. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.horizon3.ai/attack-research/disclosures/critical-vulnerabilities-in-simplehelp-remote-support-software/ - https://simple-help.com/kb---security-vulnerabilities-01-2025#
-vulnerabilities-in-simplehelp-remote-support-software/ - https://simple-help.com/kb---security-vulnerabilities-01-2025#security-vulnerabilities-in-simplehelp-5-5-7-and-earlier
CVE ID: CVE-2024-57757 State: PUBLISHED Published: 2025-01-14T00:00:00.000Z Last Updated: 2025-02-03T15:59:51.284Z Vendors: n/a Products: n/a Problem Types: n/a Description: JeeWMS before v2025.01.01 was discovered to contain a permission bypass in the component /interceptors/AuthInterceptor.cava. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitee.com/erzhongxmu/JEEWMS/issues/IBFKBM
CVE ID: CVE-2024-57760 State: PUBLISHED Published: 2025-01-14T00:00:00.000Z Last Updated: 2025-02-03T16:06:49.808Z Vendors: n/a Products: n/a Problem Types: n/a Description: JeeWMS before v2025.01.01 was discovered to contain a SQL injection vulnerability via the ReportId parameter at /core/CGReportDao.java. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitee.com/erzhongxmu/JEEWMS/issues/IBFTVK
CVE ID: CVE-2024-57761 State: PUBLISHED Published: 2025-01-14T00:00:00.000Z Last Updated: 2025-02-03T16:10:42.116Z Vendors: n/a Products: n/a Problem Types: n/a Description: An arbitrary file upload vulnerability in the parserXML() method of JeeWMS before v2025.01.01 allows attackers to execute arbitrary code via uploading a crafted file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitee.com/erzhongxmu/JEEWMS/issues/IBFTZ7
CVE ID: CVE-2024-57762 State: PUBLISHED Published: 2025-01-14T00:00:00.000Z Last Updated: 2025-02-03T16:24:57.276Z Vendors: n/a Products: n/a Problem Types: n/a Description: MSFM before v2025.01.01 was discovered to contain a deserialization vulnerability via the pom.xml configuration file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitee.com/wanglingxiao/mysiteforme/issues/IBFVAT
CVE ID: CVE-2024-57763 State: PUBLISHED Published: 2025-01-14T00:00:00.000Z Last Updated: 2025-02-03T16:34:40.820Z Vendors: n/a Products: n/a Problem Types: n/a Description: MSFM before 2025.01.01 was discovered to contain a fastjson deserialization vulnerability via the component system/table/addField. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitee.com/wanglingxiao/mysiteforme/issues/IBFVFD
CVE ID: CVE-2024-57764 State: PUBLISHED Published: 2025-01-14T00:00:00.000Z Last Updated: 2025-02-03T16:45:46.744Z Vendors: n/a Products: n/a Problem Types: n/a Description: MSFM before 2025.01.01 was discovered to contain a fastjson deserialization vulnerability via the component system/table/add. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitee.com/wanglingxiao/mysiteforme/issues/IBFVCZ
CVE ID: CVE-2024-57765 State: PUBLISHED Published: 2025-01-14T00:00:00.000Z Last Updated: 2025-02-03T16:50:20.989Z Vendors: n/a Products: n/a Problem Types: n/a Description: MSFM before 2025.01.01 was discovered to contain a SQL injection vulnerability via the s_name parameter at table/list. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitee.com/wanglingxiao/mysiteforme/issues/IBFVK9
CVE ID: CVE-2024-57766 State: PUBLISHED Published: 2025-01-14T00:00:00.000Z Last Updated: 2025-02-03T16:54:46.436Z Vendors: n/a Products: n/a Problem Types: n/a Description: MSFM before 2025.01.01 was discovered to contain a fastjson deserialization vulnerability via the component system/table/editField. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitee.com/wanglingxiao/mysiteforme/issues/IBFVHR
CVE ID: CVE-2024-57767 State: PUBLISHED Published: 2025-01-14T00:00:00.000Z Last Updated: 2025-01-31T18:21:48.635Z Vendors: n/a Products: n/a Problem Types: n/a Description: MSFM before v2025.01.01 was discovered to contain a Server-Side Request Forgery (SSRF) via the component /file/download. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitee.com/wanglingxiao/mysiteforme/issues/IBFVM9
CVE ID: CVE-2024-57768 State: PUBLISHED Published: 2025-01-16T00:00:00.000Z Last Updated: 2025-03-18T20:46:34.529Z Vendors: n/a Products: n/a Problem Types: n/a Description: JFinalOA before v2025.01.01 was discovered to contain a SQL injection vulnerability via the component validRoleKey?sysRole.key. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitee.com/r1bbit/JFinalOA/issues/IBHUMT
CVE ID: CVE-2024-57769 State: PUBLISHED Published: 2025-01-16T00:00:00.000Z Last Updated: 2025-01-23T16:21:59.323Z Vendors: n/a Products: n/a Problem Types: n/a Description: JFinalOA before v2025.01.01 was discovered to contain a SQL injection vulnerability via the component borrowmoney/listData?applyUser. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitee.com/r1bbit/JFinalOA/issues/IBHUNR
CVE ID: CVE-2024-57770 State: PUBLISHED Published: 2025-01-16T00:00:00.000Z Last Updated: 2025-01-23T16:24:03.544Z Vendors: n/a Products: n/a Problem Types: n/a Description: JFinalOA before v2025.01.01 was discovered to contain a SQL injection vulnerability via the component apply/save#oaContractApply.id. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitee.com/r1bbit/JFinalOA/issues/IBHUP1
CVE ID: CVE-2024-57771 State: PUBLISHED Published: 2025-01-16T00:00:00 Last Updated: 2025-01-21T16:44:13.435Z Vendors: n/a Products: n/a Problem Types: n/a Description: A cross-site scripting (XSS) vulnerability in the common/getEditPage?view interface of JFinalOA before v2025.01.01 allows attackers to execute arbitrary web scripts or HTML via a crafted payload. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitee.com/r1bbit/JFinalOA/issues/IBHUPO
CVE ID: CVE-2024-57772 State: PUBLISHED Published: 2025-01-16T00:00:00 Last Updated: 2025-01-21T16:42:41.098Z Vendors: n/a Products: n/a Problem Types: n/a Description: A cross-site scripting (XSS) vulnerability in the /bumph/getDraftListPage?type interface of JFinalOA before v2025.01.01 allows attackers to execute arbitrary web scripts or HTML via a crafted payload. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitee.com/r1bbit/JFinalOA/issues/IBHUQ1
CVE ID: CVE-2024-57773 State: PUBLISHED Published: 2025-01-16T00:00:00 Last Updated: 2025-01-21T16:43:11.421Z Vendors: n/a Products: n/a Problem Types: n/a Description: A cross-site scripting (XSS) vulnerability in the openSelectManyUserPage?orgid interface of JFinalOA before v2025.01.01 allows attackers to execute arbitrary web scripts or HTML via a crafted payload. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitee.com/r1bbit/JFinalOA/issues/IBHUQ9