Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-55073 State: PUBLISHED Published: 2025-03-27T00:00:00.000Z Last Updated: 2025-03-27T19:56:39.882Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Broken Object Level Authorization vulnerability in the component /api/users/{user-id} of hay-kot mealie v2.2.0 allows users to edit their own profile in order to give themselves more permissions or to change their household. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/mealie-recipes/mealie/issues/4593 - https://m10x.de/posts/2025/03/all-your-recipe-are-belong-to-us-part-3/3-broken-access-controls-leading-to-privilege-escalation-and-more-in-mealie/
CVE ID: CVE-2024-55074 State: PUBLISHED Published: 2025-01-06T00:00:00 Last Updated: 2025-01-06T20:50:19.099Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Grocy project Products: Grocy Problem Types: CWE-79 Description: The edit profile function of Grocy through 4.3.0 allows stored XSS and resultant privilege escalation by uploading a crafted HTML or SVG file, a different issue than CVE-2024-8370. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://m10x.de/posts/2024/11/all-your-recipe-are-belong-to-us-part-1/3-stored-xss-csrf-and-broken-access-control-vulnerabilities-in-grocy/
CVE ID: CVE-2024-55075 State: PUBLISHED Published: 2025-01-06T00:00:00 Last Updated: 2025-01-06T21:13:15.565Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: Grocy project Products: Grocy Problem Types: CWE-425 Description: Grocy through 4.3.0 allows remote attackers to obtain sensitive information via direct requests to pages that are not shown in the UI, such as calendar and recipes. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://m10x.de/posts/2024/11/all-your-recipe-are-belong-to-us-part-1/3-stored-xss-csrf-and-broken-access-control-vulnerabilities-in-grocy/
CVE ID: CVE-2024-55076 State: PUBLISHED Published: 2025-01-06T00:00:00 Last Updated: 2025-01-06T20:48:54.451Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Grocy project Products: Grocy Problem Types: CWE-352 Description: Grocy through 4.3.0 has no CSRF protection, as demonstrated by changing the Administrator's password. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://m10x.de/posts/2024/11/all-your-recipe-are-belong-to-us-part-1/3-stored-xss-csrf-and-broken-access-control-vulnerabilities-in-grocy/
CVE ID: CVE-2024-55078 State: PUBLISHED Published: 2025-01-03T00:00:00 Last Updated: 2025-01-03T19:12:42.377Z Vendors: n/a Products: n/a Problem Types: n/a Description: An arbitrary file upload vulnerability in the component /adminUser/updateImg of WukongCRM-11.0-JAVA v11.3.3 allows attackers to execute arbitrary code via uploading a crafted file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/summerxxoo/VulnPoc/blob/main/WukongCRM-11.0-JAVA%20-File%20upload%20across%20directories.md - https://gist.github.com/summerxxoo/8a0c9905feda6e192c10b860888afd26
CVE ID: CVE-2024-55081 State: PUBLISHED Published: 2024-12-19T00:00:00 Last Updated: 2025-01-02T19:24:50.253Z Vendors: n/a Products: n/a Problem Types: n/a Description: An XML External Entity (XXE) injection vulnerability in the component /datagrip/upload of Chat2DB v0.3.5 allows attackers to execute arbitrary code via supplying a crafted XML input. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/summerxxoo/VulnPoc/blob/main/chat2DB_XXE.md - https://gist.github.com/summerxxoo/18b3ccc91aacd606aa4d48a02029e9e7
CVE ID: CVE-2024-55082 State: PUBLISHED Published: 2024-12-19T00:00:00 Last Updated: 2025-01-02T19:23:07.821Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Server-Side Request Forgery (SSRF) in the endpoint http://{your-server}/url-to-pdf of Stirling-PDF 0.35.1 allows attackers to access sensitive information via a crafted request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/summerxxoo/VulnPoc/blob/main/Stirling-PDF-%20Server-Side%20Request%20Forgery%28SSRF%29%20vulnerability.md - https://gist.github.com/summerxxoo/f98033dbf1ab81a045c1196c3a1ab3ef
CVE ID: CVE-2024-55085 State: PUBLISHED Published: 2024-12-16T00:00:00 Last Updated: 2024-12-17T14:41:00.899Z Vendors: n/a Products: n/a Problem Types: n/a Description: GetSimple CMS CE 3.3.19 suffers from arbitrary code execution in the template editing function in the background management system, which can be used by an attacker to implement RCE. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://getsimple-ce.ovh/ - https://tasteful-stamp-da4.notion.site/CVE-2024-55085-15b1e0f227cb80a5aee6faeb820bf7e6
CVE ID: CVE-2024-55086 State: PUBLISHED Published: 2024-12-18T00:00:00 Last Updated: 2024-12-18T18:56:33.217Z Vendors: n/a Products: n/a Problem Types: n/a Description: In the GetSimple CMS CE 3.3.19 management page, Server-Side Request Forgery (SSRF) can be achieved in the plug-in download address in the backend management system. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://getsimple-ce.ovh/ - https://tasteful-stamp-da4.notion.site/CVE-2024-55086-15b1e0f227cb80e4bf4ed76aac53f795
CVE ID: CVE-2024-55088 State: PUBLISHED Published: 2024-12-18T00:00:00 Last Updated: 2024-12-20T23:32:18.687Z Vendors: n/a Products: n/a Problem Types: n/a Description: GetSimple CMS CE 3.3.19 is vulnerable to Server-Side Request Forgery (SSRF) in the backend plugin module. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://getsimple-ce.ovh/ - https://tasteful-stamp-da4.notion.site/CVE-2024-55088-15b1e0f227cb8064a1a8ed684607fee9?pvs=73
CVE ID: CVE-2024-55089 State: PUBLISHED Published: 2024-12-18T00:00:00.000Z Last Updated: 2025-03-17T21:36:21.325Z Vendors: n/a Products: n/a Problem Types: n/a Description: Rhymix 2.1.19 is vulnerable to Server-Side Request Forgery (SSRF) in the background import data function. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://tasteful-stamp-da4.notion.site/CVE-2024-55089-15b1e0f227cb8064a563c697709b7530?pvs=73
CVE ID: CVE-2024-55093 State: PUBLISHED Published: 2025-03-31T00:00:00.000Z Last Updated: 2025-03-31T13:41:23.227Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N) Vendors: phpIPAM Products: phpIPAM Problem Types: CWE-79 Description: phpIPAM through 1.7.3 has a reflected Cross-Site Scripting (XSS) vulnerability in the install scripts. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/phpipam/phpipam/commit/d0caaeba885364fd0521f094511c5d7b11f9da8f
CVE ID: CVE-2024-55099 State: PUBLISHED Published: 2024-12-12T00:00:00 Last Updated: 2024-12-16T20:27:53.346424Z Vendors: n/a Products: n/a Problem Types: n/a Description: A SQL Injection vulnerability was found in /admin/index.php in phpgurukul Online Nurse Hiring System v1.0, which allows remote attackers to execute arbitrary SQL commands to get unauthorized database access via the username parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/achchhelalchauhan/phpgurukul/blob/main/SQL%20injection%20ONHP-username.pdf - https://github.com/kuzgunaka/CVE-2024-55099-Online-Nurse-Hiring-System-v1.0-SQL-Injection-Vulnerability-
CVE ID: CVE-2024-55100 State: PUBLISHED Published: 2024-12-16T00:00:00 Last Updated: 2024-12-17T17:00:41.043Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stored cross-site scripting (XSS) vulnerability in the component /admin/profile.php of Online Nurse Hiring System v1.0 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the fullname parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://phpgurukul.com/online-nurse-hiring-system-using-php-and-mysql/ - https://github.com/kuzgunaka/test1/blob/main/CVE-2024-55100-Online-Nurse-Hiring-System-v1.0-Stored-Cross-Site-Scripting-Vulnerability.md
CVE ID: CVE-2024-55103 State: PUBLISHED Published: 2024-12-16T00:00:00 Last Updated: 2024-12-17T17:24:27.899Z Vendors: n/a Products: n/a Problem Types: n/a Description: Online Nurse Hiring System v1.0 was discovered to contain a SQL injection vulnerability in the component /admin/profile.php via the fullname parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://phpgurukul.com/online-nurse-hiring-system-using-php-and-mysql/ - https://github.com/kuzgunaka/test1/blob/main/CVE-2024-55103-Online-Nurse-Hiring-System-v1.0-SQL-Injection-Vulnerability.md
CVE ID: CVE-2024-55104 State: PUBLISHED Published: 2024-12-16T00:00:00 Last Updated: 2024-12-17T17:25:23.956Z Vendors: n/a Products: n/a Problem Types: n/a Description: Online Nurse Hiring System v1.0 was discovered to contain multiple SQL injection vulnerabilities in the component /admin/add-nurse.php via the gender and emailid parameters. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://phpgurukul.com/online-nurse-hiring-system-using-php-and-mysql/ - https://github.com/kuzgunaka/test1/blob/main/CVE-2024-55104-Online-Nurse-Hiring-System-v1.0-SQL-Injection-Vulnerability.md
CVE ID: CVE-2024-55156 State: PUBLISHED Published: 2025-02-21T00:00:00.000Z Last Updated: 2025-03-17T18:35:58.472Z Vendors: n/a Products: n/a Problem Types: n/a Description: An XML External Entity (XXE) vulnerability in the deserializeArgs() method of Java SDK for CloudEvents v4.0.1 allows attackers to access sensitive information via supplying a crafted XML-formatted event message. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/aixiao0621/CVE/blob/main/CVE-2024-55156/README.md
CVE ID: CVE-2024-55159 State: PUBLISHED Published: 2025-02-21T00:00:00.000Z Last Updated: 2025-03-12T18:55:24.961Z Vendors: n/a Products: n/a Problem Types: n/a Description: GFast between v2 to v3.2 was discovered to contain a SQL injection vulnerability via the SortName parameter at /system/loginLog/list. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/tiger1103/gfast/blob/os-v3.2/internal/app/system/logic/sysLoginLog/sys_login_log.go#L75 - https://github.com/SuperDu1/CVE/issues/1
CVE ID: CVE-2024-55160 State: PUBLISHED Published: 2025-02-27T00:00:00.000Z Last Updated: 2025-03-03T15:40:03.737Z Vendors: n/a Products: n/a Problem Types: n/a Description: GFast between v2 to v3.2 was discovered to contain a SQL injection vulnerability via the OrderBy parameter at /system/operLog/list. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://gfast.com - https://github.com/tiger1103/gfast/tree/os-v3.2 - https://github.com/tiger1103/gfast/blob/os-v3.2/api/v1/system/sys_oper_log.go#L35 - https://github.com/tiger1103/gfast/blob/os-v3.2/internal/app/system/logic/sysOperLog/sys_oper_log.go#L121 - https://github.com/SuperDu1/CVE/issues/2
CVE ID: CVE-2024-55186 State: PUBLISHED Published: 2024-12-20T00:00:00 Last Updated: 2024-12-20T20:49:14.926Z Vendors: n/a Products: n/a Problem Types: n/a Description: An IDOR (Insecure Direct Object Reference) vulnerability exists in oqtane Framework 6.0.0, allowing a logged-in user to access inbox messages of other users by manipulating the notification ID in the request URL. By changing the notification ID, an attacker can view sensitive mail details belonging to other users. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/oqtane/oqtane.framework/pull/4876/files - https://gist.github.com/SmitShah1518/00de9ecc46c1a8e2b189185c9d92afb0
CVE ID: CVE-2024-55192 State: PUBLISHED Published: 2025-01-23T00:00:00.000Z Last Updated: 2025-02-05T14:32:46.735Z Vendors: n/a Products: n/a Problem Types: n/a Description: OpenImageIO v3.1.0.0dev was discovered to contain a heap overflow via the component OpenImageIO_v3_1_0::farmhash::inlined::Fetch64(char const*). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/AcademySoftwareFoundation/OpenImageIO/issues/4550
CVE ID: CVE-2024-55193 State: PUBLISHED Published: 2025-01-23T00:00:00.000Z Last Updated: 2025-01-24T21:11:10.432Z Vendors: n/a Products: n/a Problem Types: n/a Description: OpenImageIO v3.1.0.0dev was discovered to contain a segmentation violation via the component /OpenImageIO/string_view.h. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/AcademySoftwareFoundation/OpenImageIO/issues/4551
CVE ID: CVE-2024-55194 State: PUBLISHED Published: 2025-01-23T00:00:00.000Z Last Updated: 2025-01-28T15:47:01.574Z Vendors: n/a Products: n/a Problem Types: n/a Description: OpenImageIO v3.1.0.0dev was discovered to contain a heap overflow via the component /OpenImageIO/fmath.h. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/AcademySoftwareFoundation/OpenImageIO/issues/4552
CVE ID: CVE-2024-55195 State: PUBLISHED Published: 2025-01-23T00:00:00.000Z Last Updated: 2025-01-28T14:20:49.838Z Vendors: n/a Products: n/a Problem Types: n/a Description: An allocation-size-too-big bug in the component /imagebuf.cpp of OpenImageIO v3.1.0.0dev may cause a Denial of Service (DoS) when the program to requests to allocate too much space. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/AcademySoftwareFoundation/OpenImageIO/issues/4553
CVE ID: CVE-2024-55196 State: PUBLISHED Published: 2024-12-19T00:00:00 Last Updated: 2025-01-02T19:26:48.250Z Vendors: n/a Products: n/a Problem Types: n/a Description: Insufficiently Protected Credentials in the Mail Server Configuration in GoPhish v0.12.1 allows an attacker to access cleartext passwords for the configured IMAP and SMTP servers. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/hexkaster/SecurityResearch/blob/main/CVE-2024-55196.md
CVE ID: CVE-2024-55198 State: PUBLISHED Published: 2025-03-13T00:00:00.000Z Last Updated: 2025-03-19T18:38:15.554Z Vendors: n/a Products: n/a Problem Types: n/a Description: User Enumeration via Discrepancies in Error Messages in the Celk Sistemas Celk Saude v.3.1.252.1 password recovery functionality which allows a remote attacker to enumerate users through discrepancies in the responses. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cheatsheetseries.owasp.org/cheatsheets/Authentication_Cheat_Sheet.html - https://github.com/gabriel-bri/vulnerability-research/tree/main/CVE-2024-55198
CVE ID: CVE-2024-55199 State: PUBLISHED Published: 2025-03-10T00:00:00.000Z Last Updated: 2025-03-10T18:02:08.891Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Stored Cross Site Scripting (XSS) vulnerability in Celk Sistemas Celk Saude v.3.1.252.1 allows a remote attacker to store JavaScript code inside a PDF file through the file upload feature. When the file is rendered, the injected code is executed on the user's browser. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://portswigger.net/web-security/cross-site-scripting/stored - https://github.com/gabriel-bri/vulnerability-research/tree/main/CVE-2024-55199
CVE ID: CVE-2024-55210 State: PUBLISHED Published: 2025-04-09T00:00:00.000Z Last Updated: 2025-04-10T18:50:27.388Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in TOTVS Framework (Linha Protheus) 12.1.2310 allows attackers to bypass multi-factor authentication (MFA) via a crafted websocket message. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/c4cnm/CVE-2024-55210/
CVE ID: CVE-2024-55211 State: PUBLISHED Published: 2025-04-17T00:00:00.000Z Last Updated: 2025-04-17T18:10:12.553Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in Think Router Tk-Rt-Wr135G V3.0.2-X000 allows attackers to bypass authentication via a crafted cookie. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/micaelmaciel/CVE-2024-55211
CVE ID: CVE-2024-55212 State: PUBLISHED Published: 2025-02-11T00:00:00.000Z Last Updated: 2025-02-12T21:46:49.185Z Vendors: n/a Products: n/a Problem Types: n/a Description: DNNGo xBlog v6.5.0 was discovered to contain a SQL injection vulnerability via the Categorys parameter at /DNNGo_xBlog/Resource_Service.aspx. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.invokesec.com/2025/01/13/a-real-world-example-of-blind-sqli/
CVE ID: CVE-2024-55213 State: PUBLISHED Published: 2025-02-07T00:00:00.000Z Last Updated: 2025-02-11T15:18:46.948Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory Traversal vulnerability in dhtmlxFileExplorer v.8.4.6 allows a remote attacker to obtain sensitive information via the File Listing function. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://dhtmlx.com/docs/products/demoApps/dhtmlxFileExplorerDemo/ - https://packetstorm.news/files/id/189020
CVE ID: CVE-2024-55214 State: PUBLISHED Published: 2025-02-07T00:00:00.000Z Last Updated: 2025-02-11T15:19:59.674Z Vendors: n/a Products: n/a Problem Types: n/a Description: Local File Inclusion vulnerability in dhtmlxFileExplorer v.8.4.6 allows a remote attacker to obtain sensitive information via the file download functionality. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://dhtmlx.com - https://packetstorm.news/files/id/189018
CVE ID: CVE-2024-55215 State: PUBLISHED Published: 2025-02-07T00:00:00.000Z Last Updated: 2025-03-19T18:21:06.336Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in trojan v.2.0.0 through v.2.15.3 allows a remote attacker to escalate privileges via the initialization interface /auth/register. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/ainrm/Jrohy-trojan-unauth-poc/blob/main/README.en.md
CVE ID: CVE-2024-55218 State: PUBLISHED Published: 2025-01-07T00:00:00 Last Updated: 2025-01-08T14:14:47.600Z Vendors: n/a Products: n/a Problem Types: n/a Description: IceWarp Server 10.2.1 is vulnerable to Cross Site Scripting (XSS) via the meta parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.icewarp.com/ - https://resources.s4e.io/blog/icewarp-server-10-2-1-reflected-xss-vulnerability-cve-2024-55218/
CVE ID: CVE-2024-55224 State: PUBLISHED Published: 2025-01-09T00:00:00 Last Updated: 2025-01-10T17:27:58.980Z Vendors: n/a Products: n/a Problem Types: n/a Description: An HTML injection vulnerability in Vaultwarden prior to v1.32.5 allows attackers to execute arbitrary code via injecting a crafted payload into the username field of an e-mail message. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://insinuator.net/2024/11/vulnerability-disclosure-authentication-bypass-in-vaultwarden-versions-1-32-5/ - https://github.com/dani-garcia/vaultwarden/releases/tag/1.32.5 - https://github.com/dani-garcia/vaultwarden/releases/tag/1.32.4
CVE ID: CVE-2024-55225 State: PUBLISHED Published: 2025-01-09T00:00:00 Last Updated: 2025-01-10T17:25:40.893Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in the component src/api/identity.rs of Vaultwarden prior to v1.32.5 allows attackers to impersonate users, including Administrators, via a crafted authorization request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://insinuator.net/2024/11/vulnerability-disclosure-authentication-bypass-in-vaultwarden-versions-1-32-5/ - https://github.com/dani-garcia/vaultwarden/releases/tag/1.32.5 - https://github.com/dani-garcia/vaultwarden/releases/tag/1.32.4
CVE ID: CVE-2024-55226 State: PUBLISHED Published: 2025-01-09T00:00:00 Last Updated: 2025-01-10T17:04:29.723Z Vendors: n/a Products: n/a Problem Types: n/a Description: Vaultwarden v1.32.5 was discovered to contain an authenticated reflected cross-site scripting (XSS) vulnerability via the component /api/core/mod.rs. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://insinuator.net/2024/11/vulnerability-disclosure-authentication-bypass-in-vaultwarden-versions-1-32-5/ - https://github.com/dani-garcia/vaultwarden/releases/tag/1.32.5 - https://github.com/dani-garcia/vaultwarden/releases/tag/1.32.4
CVE ID: CVE-2024-55227 State: PUBLISHED Published: 2025-01-27T00:00:00.000Z Last Updated: 2025-02-19T20:03:48.861Z Vendors: n/a Products: n/a Problem Types: n/a Description: A cross-site scripting (XSS) vulnerability in the Events/Agenda module of Dolibarr v21.0.0-beta allows attackers to execute arbitrary web scripts or HTMl via a crafted payload injected into the Title parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Dolibarr/dolibarr/security/policy - https://gist.github.com/Dqtdqt/9762466cd6ec541ea265ba33b09489ff - https://github.com/Dolibarr/dolibarr/commit/56710ce9b79a97df093f586c90bdaf6cce6a5808 - https://github.com/Dolibarr/dolibarr/commi
ithub.com/Dolibarr/dolibarr/commit/56710ce9b79a97df093f586c90bdaf6cce6a5808 - https://github.com/Dolibarr/dolibarr/commit/c0250e4c9106b5c889e512a4771f0205d4f99b99 - https://github.com/Dolibarr/dolibarr/commit/9aa24d9d9aeab36358c725dae3fe20c9631082e7
CVE ID: CVE-2024-55228 State: PUBLISHED Published: 2025-01-27T00:00:00.000Z Last Updated: 2025-02-19T19:35:56.105Z Vendors: n/a Products: n/a Problem Types: n/a Description: A cross-site scripting (XSS) vulnerability in the Product module of Dolibarr v21.0.0-beta allows attackers to execute arbitrary web scripts or HTMl via a crafted payload injected into the Title parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Dolibarr/dolibarr/security/policy - https://github.com/Dolibarr/dolibarr/commit/56710ce9b79a97df093f586c90bdaf6cce6a5808 - https://github.com/Dolibarr/dolibarr/commit/c0250e4c9106b5c889e512a4771f0205d4f99b99 - https://github.com/Dolibarr
808 - https://github.com/Dolibarr/dolibarr/commit/c0250e4c9106b5c889e512a4771f0205d4f99b99 - https://github.com/Dolibarr/dolibarr/commit/9aa24d9d9aeab36358c725dae3fe20c9631082e7 - https://gist.github.com/Dqtdqt/a942bbce9a5fc851dce366902411c768
CVE ID: CVE-2024-55231 State: PUBLISHED Published: 2024-12-18T00:00:00 Last Updated: 2024-12-26T19:16:43.670Z Vendors: n/a Products: n/a Problem Types: n/a Description: An IDOR vulnerability in the edit-notes.php module of PHPGurukul Online Notes Sharing Management System v1.0 allows unauthorized users to modify notes belonging to other accounts due to missing authorization checks. This flaw exposes sensitive data and enables attackers to alter another user's information. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/CV1523/CVEs/blob/main/CVE-2024-55231.md
CVE ID: CVE-2024-55232 State: PUBLISHED Published: 2024-12-18T00:00:00 Last Updated: 2024-12-26T19:29:48.210Z Vendors: n/a Products: n/a Problem Types: n/a Description: An IDOR vulnerability in the manage-notes.php module in PHPGurukul Online Notes Sharing Management System v1.0 allows unauthorized users to delete notes belonging to other accounts due to missing authorization checks. This flaw enables attackers to delete another user's information. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/CV1523/CVEs/blob/main/CVE-2024-55232.md
CVE ID: CVE-2024-55238 State: PUBLISHED Published: 2025-04-17T00:00:00.000Z Last Updated: 2025-04-17T19:15:12.171Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AC:L/AV:N/A:N/C:H/I:L/PR:L/S:U/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: OpenMetadata <=1.4.1 is vulnerable to SQL Injection. An attacker can extract information from the database in function listCount in the WorkflowDAO interface. The workflowtype and status parameters can be used to build a SQL query. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/open-metadata/OpenMetadata/blob/98945cb2db87ebb325d3a72131f049abffcba345/openmetadata-service/src/main/java/org/openmetadata/service/jdbi3/
etadata/blob/98945cb2db87ebb325d3a72131f049abffcba345/openmetadata-service/src/main/java/org/openmetadata/service/jdbi3/CollectionDAO.java#L4243 - https://github.com/open-metadata/OpenMetadata/blob/98945cb2db87ebb325d3a72131f049abffcba345/openmetadata-service/src/main/java/org/openmetadata/service/jdbi3/CollectionDAO.java#L4247 - https://gist.github.com/javadk/68c597cdb94768dab31a3219c2ad9904