Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-35283 State: PUBLISHED Published: 2024-05-29T15:42:46.257Z Last Updated: 2025-02-13T15:54:05.221Z Vendors: n/a Products: n/a Problem Types: n/a Description: A vulnerability in the Ignite component of Mitel MiContact Center Business through 10.0.0.4 could allow an unauthenticated attacker to conduct a stored cross-site scripting (XSS) attack due to insufficient input validation. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-24-0011
CVE ID: CVE-2024-35284 State: PUBLISHED Published: 2024-05-29T15:52:40.256Z Last Updated: 2025-03-13T17:23:25.108Z Vendors: n/a Products: n/a Problem Types: n/a Description: A vulnerability in the legacy chat component of Mitel MiContact Center Business through 10.0.0.4 could allow an unauthenticated attacker to conduct a reflected cross-site scripting (XSS) attack due to insufficient input validation. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-24-0012
CVE ID: CVE-2024-35285 State: PUBLISHED Published: 2024-10-21T00:00:00 Last Updated: 2024-10-22T19:35:11.811Z Vendors: n/a Products: n/a Problem Types: n/a Description: A vulnerability in NuPoint Messenger (NPM) of Mitel MiCollab through 9.8.0.33 allows an unauthenticated attacker to conduct a command injection attack due to insufficient parameter sanitization. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-24-0013
CVE ID: CVE-2024-35286 State: PUBLISHED Published: 2024-10-21T00:00:00 Last Updated: 2024-12-10T04:55:53.023Z Vendors: n/a Products: n/a Problem Types: n/a Description: A vulnerability in NuPoint Messenger (NPM) of Mitel MiCollab through 9.8.0.33 allows an unauthenticated attacker to conduct a SQL injection attack due to insufficient sanitization of user input. A successful exploit could allow an attacker to access sensitive information and execute arbitrary database and management operations. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-24-0014
CVE ID: CVE-2024-35287 State: PUBLISHED Published: 2024-10-21T00:00:00 Last Updated: 2024-10-22T13:29:45.969Z Vendors: n/a Products: n/a Problem Types: n/a Description: A vulnerability in the NuPoint Messenger (NPM) component of Mitel MiCollab through version 9.8 SP1 (9.8.1.5) could allow an authenticated attacker with administrative privilege to conduct a privilege escalation attack due to the execution of a resource with unnecessary privileges. A successful exploit could allow an attacker to execute arbitrary commands with elevated privileges. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-2
CISA ADP Vulnrichment: References: - https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-24-0023
CVE ID: CVE-2024-35288 State: PUBLISHED Published: 2024-10-09T00:00:00.000Z Last Updated: 2025-03-25T16:43:00.153Z Vendors: n/a Products: n/a Problem Types: n/a Description: Nitro PDF Pro before 13.70.8.82 and 14.x before 14.26.1.0 allows Local Privilege Escalation in the MSI Installer because custom actions occur unsafely in repair mode. CertUtil is run in a conhost.exe window, and there is a mechanism allowing CTRL+o to launch cmd.exe as NT AUTHORITY\SYSTEM. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.gonitro.com/support/downloads#securityUpdates - https://seclists.org/fulldisclosure/2024/Sep/59 - https://sec-consult.com/vulnerabili
upport/downloads#securityUpdates - https://seclists.org/fulldisclosure/2024/Sep/59 - https://sec-consult.com/vulnerability-lab/advisory/local-privilege-escalation-via-msi-installer-in-nitro-pdf-pro/
CVE ID: CVE-2024-35291 State: PUBLISHED Published: 2024-05-27T04:39:56.699Z Last Updated: 2024-10-28T19:19:54.905Z Vendors: Chris Younger Products: Splunk Config Explorer Problem Types: Cross-site scripting (XSS) Description: Cross-site scripting vulnerability exists in Splunk Config Explorer versions prior to 1.7.16. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who is using the product. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://splunkbase.splunk.com/app/4353 - https://jvn.jp/en/jp/JVN56781258/
CVE ID: CVE-2024-35292 State: PUBLISHED Published: 2024-06-11T11:15:56.333Z Last Updated: 2024-08-02T03:07:46.880Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H/E:P/RL:T/RC:C) Vendors: Siemens Products: SIMATIC S7-200 SMART CPU CR40, SIMATIC S7-200 SMART CPU CR60, SIMATIC S7-200 SMART CPU SR20, SIMATIC S7-200 SMART CPU SR30, SIMATIC S7-200 SMART CPU SR40, SIMATIC S7-200 SMART CPU SR60, SIMATIC S7-200 SMART CPU ST20, SIMATIC S7-200 SMART CPU ST30, SIMATIC S7-200 SMART CPU ST40, SIMATIC S7-200 SMART CPU ST60 Problem Types: CWE-330 Description: A vulnerability has been identified in SIMATIC S7-200 SMART CPU CR40 (6ES7288-1CR40-0AA0) (All versions), SIMATIC S7-200 SMART C
ability has been identified in SIMATIC S7-200 SMART CPU CR40 (6ES7288-1CR40-0AA0) (All versions), SIMATIC S7-200 SMART CPU CR60 (6ES7288-1CR60-0AA0) (All versions), SIMATIC S7-200 SMART CPU SR20 (6ES7288-1SR20-0AA0) (All versions), SIMATIC S7-200 SMART CPU SR20 (6ES7288-1SR20-0AA1) (All versions), SIMATIC S7-200 SMART CPU SR30 (6ES7288-1SR30-0AA0) (All versions), SIMATIC S7-200 SMART CPU SR30 (6ES7288-1SR30-0AA1) (All versions), SIMATIC S7-200 SMART CPU SR40 (6ES7288-1SR40-0AA0) (All versions), SIMATIC S7-200 SMART CPU SR40 (6ES7288-1SR40-0AA1) (All versions), SIMATIC S7-200 SMART CPU SR60 (6ES7288-1SR60-0AA0) (All versions), SIMATIC S7-200 SMART CPU SR60 (6ES7288-1SR60-0AA1) (All versions),
0 SMART CPU SR60 (6ES7288-1SR60-0AA0) (All versions), SIMATIC S7-200 SMART CPU SR60 (6ES7288-1SR60-0AA1) (All versions), SIMATIC S7-200 SMART CPU ST20 (6ES7288-1ST20-0AA0) (All versions), SIMATIC S7-200 SMART CPU ST20 (6ES7288-1ST20-0AA1) (All versions), SIMATIC S7-200 SMART CPU ST30 (6ES7288-1ST30-0AA0) (All versions), SIMATIC S7-200 SMART CPU ST30 (6ES7288-1ST30-0AA1) (All versions), SIMATIC S7-200 SMART CPU ST40 (6ES7288-1ST40-0AA0) (All versions), SIMATIC S7-200 SMART CPU ST40 (6ES7288-1ST40-0AA1) (All versions), SIMATIC S7-200 SMART CPU ST60 (6ES7288-1ST60-0AA0) (All versions), SIMATIC S7-200 SMART CPU ST60 (6ES7288-1ST60-0AA1) (All versions). Affected devices are using a predictable IP
ersions), SIMATIC S7-200 SMART CPU ST60 (6ES7288-1ST60-0AA1) (All versions). Affected devices are using a predictable IP ID sequence number. This leaves the system susceptible to a family of attacks which rely on the use of predictable IP ID sequence numbers as their base method of attack and eventually could allow an attacker to create a denial of service condition. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/html/ssa-481506.html
CVE ID: CVE-2024-35293 State: PUBLISHED Published: 2024-10-02T09:51:01.799Z Last Updated: 2024-10-02T14:48:19.675Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H) Vendors: Schneider Elektronik Products: Series 700 Problem Types: CWE-306 Description: An unauthenticated remote attacker may use a missing authentication for critical function vulnerability to reboot or erase the affected devices resulting in data loss and/or a DoS. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.schneider-elektronik.de/wp-content/uploads/2024/07/SAR-202405-1.pdf
CVE ID: CVE-2024-35294 State: PUBLISHED Published: 2024-10-02T10:07:28.219Z Last Updated: 2024-10-02T14:45:50.382Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) Vendors: Schneider Elektronik Products: Series 700 Problem Types: CWE-306 Description: An unauthenticated remote attacker may use the devices traffic capture without authentication to grab plaintext administrative credentials. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.schneider-elektronik.de/wp-content/uploads/2024/07/SAR-202405-2.pdf
CVE ID: CVE-2024-35295 State: PUBLISHED Published: 2025-06-11T06:55:31.200Z Last Updated: 2025-06-12T05:13:25.889Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H) Vendors: Innomotics Products: Perfect Harmony GH180 Problem Types: CWE-306 Description: A vulnerability has been identified in Perfect Harmony GH180 (All versions >= V8.0 < V8.3.3 with NXGPro+ controller manufactured between April 2020 to April 2025). The maintenance connection of affected devices fails to protect access to the device's control unit configuration. This could allow an attacker with physical access to the maintenance connection's door port to perform arbitrary configuration changes. Additiona
ker with physical access to the maintenance connection's door port to perform arbitrary configuration changes. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/html/ssa-771113.html - https://www.innomotics.com/hub/en/ISA-771113
CVE ID: CVE-2024-35296 State: PUBLISHED Published: 2024-07-26T09:11:11.221Z Last Updated: 2025-11-03T21:55:00.755Z Vendors: Apache Software Foundation Products: Apache Traffic Server Problem Types: CWE-20 Description: Invalid Accept-Encoding header can cause Apache Traffic Server to fail cache lookup and force forwarding requests. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.10, from 9.0.0 through 9.2.4. Users are recommended to upgrade to version 8.1.11 or 9.2.5, which fixes the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://lists.apache.org/thread/c4mcmpblgl8kkmyt56t23543gp8v56m0
CVE ID: CVE-2024-35297 State: PUBLISHED Published: 2024-05-27T04:40:54.654Z Last Updated: 2024-11-08T16:57:20.465Z Vendors: aviplugins.com Products: WP Booking Problem Types: Cross-site scripting (XSS) Description: Cross-site scripting vulnerability exists in WP Booking versions prior to 2.4.5. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who is accessing the web site using the product. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://wordpress.org/plugins/wp-easy-booking/ - https://plugins.trac.wordpress.org/changeset?new=3084990%40wp-easy-booking%2Ftrunk%2Fview%2Ffrontend%2Fbooking-lo
ing/ - https://plugins.trac.wordpress.org/changeset?new=3084990%40wp-easy-booking%2Ftrunk%2Fview%2Ffrontend%2Fbooking-locations.php&old=2404687%40wp-easy-booking%2Ftrunk%2Fview%2Ffrontend%2Fbooking-locations.php - https://jvn.jp/en/jp/JVN35838128/
CVE ID: CVE-2024-35298 State: PUBLISHED Published: 2024-06-19T05:07:24.711Z Last Updated: 2024-08-02T03:07:46.969Z Vendors: ZOZO, Inc. Products: 'ZOZOTOWN' App for Android Problem Types: Improper authorization in handler for custom URL scheme Description: Improper authorization in handler for custom URL scheme issue in 'ZOZOTOWN' App for Android versions prior to 7.39.6 allows an attacker to lead a user to access an arbitrary website via another application installed on the user's device. As a result, the user may become a victim of a phishing attack. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://jvn.jp/en/jp/JVN37818611/
CVE ID: CVE-2024-35299 State: PUBLISHED Published: 2024-05-16T10:31:58.950Z Last Updated: 2024-08-02T03:07:47.059Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: JetBrains Products: YouTrack Problem Types: CWE-295 Description: In JetBrains YouTrack before 2024.1.29548 the SMTPS protocol communication lacked proper certificate hostname validation Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.jetbrains.com/privacy-security/issues-fixed/
CVE ID: CVE-2024-35300 State: PUBLISHED Published: 2024-05-16T10:31:59.565Z Last Updated: 2024-08-02T03:07:46.896Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N) Vendors: JetBrains Products: TeamCity Problem Types: CWE-79 Description: In JetBrains TeamCity between 2024.03 and 2024.03.1 several stored XSS in the available updates page were possible Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.jetbrains.com/privacy-security/issues-fixed/
CVE ID: CVE-2024-35301 State: PUBLISHED Published: 2024-05-16T10:32:00.362Z Last Updated: 2024-08-02T03:07:46.947Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N) Vendors: JetBrains Products: TeamCity Problem Types: CWE-280 Description: In JetBrains TeamCity before 2024.03.1 commit status publisher didn't check project scope of the GitHub App token Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.jetbrains.com/privacy-security/issues-fixed/
CVE ID: CVE-2024-35302 State: PUBLISHED Published: 2024-05-16T10:32:01.010Z Last Updated: 2024-08-02T03:07:46.843Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N) Vendors: JetBrains Products: TeamCity Problem Types: CWE-79 Description: In JetBrains TeamCity before 2023.11 stored XSS during restore from backup was possible Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.jetbrains.com/privacy-security/issues-fixed/
CVE ID: CVE-2024-35303 State: PUBLISHED Published: 2024-06-11T11:15:57.792Z Last Updated: 2024-08-02T03:07:46.899Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Siemens Products: Tecnomatix Plant Simulation V2302, Tecnomatix Plant Simulation V2404 Problem Types: CWE-704 Description: A vulnerability has been identified in Tecnomatix Plant Simulation V2302 (All versions < V2302.0012), Tecnomatix Plant Simulation V2404 (All versions < V2404.0001). The affected applications contain a type confusion vulnerability while parsing specially crafted MODEL files. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-22958) Additio
MODEL files. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-22958) Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/html/ssa-900277.html
CVE ID: CVE-2024-35304 State: PUBLISHED Published: 2024-06-10T14:21:10.487Z Last Updated: 2024-08-02T03:07:46.949Z Vendors: Pandora FMS Products: Pandora FMS Problem Types: CWE-78 Description: System command injection through Netflow function due to improper input validation, allowing attackers to execute arbitrary system commands. This issue affects Pandora FMS: from 700 through <777. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://pandorafms.com/en/security/common-vulnerabilities-and-exposures/
CVE ID: CVE-2024-35305 State: PUBLISHED Published: 2024-06-10T14:28:18.393Z Last Updated: 2024-08-02T03:07:46.945Z Vendors: Pandora FMS Products: Pandora FMS Problem Types: CWE-89 Description: Unauth Time-Based SQL Injection in API allows to exploit HTTP request Authorization header. This issue affects Pandora FMS: from 700 through <777. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://pandorafms.com/en/security/common-vulnerabilities-and-exposures/
CVE ID: CVE-2024-35306 State: PUBLISHED Published: 2024-06-10T14:30:36.784Z Last Updated: 2024-08-02T03:07:46.944Z Vendors: Pandora FMS Products: Pandora FMS Problem Types: CWE-78 Description: OS Command injection in Ajax PHP files via HTTP Request, allows to execute system commands by exploiting variables. This issue affects Pandora FMS: from 700 through <777. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://pandorafms.com/en/security/common-vulnerabilities-and-exposures/
CVE ID: CVE-2024-35307 State: PUBLISHED Published: 2024-06-10T14:33:29.127Z Last Updated: 2024-08-02T03:07:46.936Z Vendors: Pandora FMS Products: Pandora FMS Problem Types: CWE-88 Description: Argument Injection Leading to Remote Code Execution in Realtime Graph Extension, allowing unauthenticated attackers to execute arbitrary code on the server. This issue affects Pandora FMS: from 700 through <777. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://pandorafms.com/en/security/common-vulnerabilities-and-exposures/
CVE ID: CVE-2024-35308 State: PUBLISHED Published: 2024-10-22T09:03:15.776Z Last Updated: 2024-10-22T13:11:36.744Z Vendors: Pandora FMS Products: Pandora FMS Problem Types: CWE-22 Description: A post-authentication arbitrary file read vulnerability within the server plugins section in plugin edition feature. This issue affects Pandora FMS: from 700 through <777.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://pandorafms.com/en/security/common-vulnerabilities-and-exposures/
CVE ID: CVE-2024-35311 State: PUBLISHED Published: 2024-05-29T15:55:05.390Z Last Updated: 2025-02-13T15:54:06.616Z Vendors: n/a Products: n/a Problem Types: n/a Description: Yubico YubiKey 5 Series before 5.7.0, Security Key Series before 5.7.0, YubiKey Bio Series before 5.6.4, and YubiKey 5 FIPS before 5.7.2 have Incorrect Access Control. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.yubico.com/support/security-advisories/ysa-2024-02/
CVE ID: CVE-2024-35312 State: PUBLISHED Published: 2024-05-17T21:29:25.481Z Last Updated: 2025-02-13T15:54:07.142Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Tor Arti before 1.2.3, STUB circuits incorrectly have a length of 2 (with lite vanguards), aka TROVE-2024-003. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://gitlab.torproject.org/tpo/core/arti/-/issues/1409
CVE ID: CVE-2024-35313 State: PUBLISHED Published: 2024-05-17T21:29:58.041Z Last Updated: 2025-03-27T14:31:51.015Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Tor Arti before 1.2.3, circuits sometimes incorrectly have a length of 3 (with full vanguards), aka TROVE-2024-004. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gitlab.torproject.org/tpo/core/arti/-/issues/1400
CVE ID: CVE-2024-35314 State: PUBLISHED Published: 2024-10-21T00:00:00.000Z Last Updated: 2025-03-25T14:14:25.141Z Vendors: n/a Products: n/a Problem Types: n/a Description: A vulnerability in the Desktop Client of Mitel MiCollab through 9.7.1.110, and MiVoice Business Solution Virtual Instance (MiVB SVI) 1.0.0.25, could allow an unauthenticated attacker to conduct a command injection attack due to insufficient parameter sanitization. A successful exploit requires user interaction and could allow an attacker to execute arbitrary scripts. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-24-0015 -
Vulnrichment: References: - https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-24-0015 - https://www.mitel.com/-/media/mitel/file/pdf/support/security-advisories/security-bulletin_24-0015-001-v3.pdf
CVE ID: CVE-2024-35315 State: PUBLISHED Published: 2024-10-21T00:00:00 Last Updated: 2024-10-23T20:43:02.347Z Vendors: n/a Products: n/a Problem Types: n/a Description: A vulnerability in the Desktop Client of Mitel MiCollab through 9.7.1.110, and MiVoice Business Solution Virtual Instance (MiVB SVI) 1.0.0.25, could allow an authenticated attacker to conduct a privilege escalation attack due to improper file validation. A successful exploit could allow an attacker to run arbitrary code with elevated privileges. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-24-0016
CVE ID: CVE-2024-35324 State: PUBLISHED Published: 2024-05-28T15:25:04.254Z Last Updated: 2025-02-13T15:54:08.277Z Vendors: n/a Products: n/a Problem Types: n/a Description: Douchat 4.0.5 suffers from an arbitrary file upload vulnerability via Public/Plugins/webuploader/server/preview.php. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/w0x68y/cve-lists/blob/main/CMS/Douchat/Douchat%204.0.5%20arbitrary%20file%20upload%20vulnerability.md
CVE ID: CVE-2024-35325 State: REJECTED Published: 2024-06-13T00:00:00 Last Updated: 2024-08-28T15:36:54.609579 Description: No description available.
CVE ID: CVE-2024-35326 State: REJECTED Published: 2024-06-13T00:00:00 Last Updated: 2024-08-28T15:38:17.799524 Description: No description available.
CVE ID: CVE-2024-35328 State: REJECTED Published: 2024-06-13T00:00:00 Last Updated: 2024-08-28T15:40:05.988808 Description: No description available.
CVE ID: CVE-2024-35329 State: REJECTED Published: 2024-06-11T00:00:00 Last Updated: 2024-08-28T15:41:24.084659 Description: No description available.
CVE ID: CVE-2024-35333 State: PUBLISHED Published: 2024-05-29T15:12:09.563Z Last Updated: 2025-02-13T15:54:08.863Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stack-buffer-overflow vulnerability exists in the read_charset_decl function of html2xhtml 1.3. This vulnerability occurs due to improper bounds checking when copying data into a fixed-size stack buffer. An attacker can exploit this vulnerability by providing a specially crafted input to the vulnerable function, causing a buffer overflow and potentially leading to arbitrary code execution, denial of service, or data corruption. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - ht
ervice, or data corruption. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/momo1239/CVE-2024-35333
CVE ID: CVE-2024-35338 State: PUBLISHED Published: 2024-07-16T00:00:00 Last Updated: 2024-08-02T03:07:47.024Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda i29V1.0 V1.0.0.5 was discovered to contain a hardcoded password for root. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://palm-vertebra-fe9.notion.site/hardcode_i29-e1ed38dde00145d9a6be1ad2b4581259
CVE ID: CVE-2024-35339 State: PUBLISHED Published: 2024-05-24T14:49:47.452Z Last Updated: 2025-02-13T15:54:09.367Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda FH1206 V1.2.0.8(8155) was discovered to contain a command injection vulnerability via the mac parameter at ip/goform/WriteFacMac. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://palm-vertebra-fe9.notion.site/formWriteFacMac_RCE-d70cf636739e4a769b1f919ffed4a2a0
CVE ID: CVE-2024-35340 State: PUBLISHED Published: 2024-05-24T14:50:56.175Z Last Updated: 2025-02-13T15:54:10.004Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda FH1206 V1.2.0.8(8155) was discovered to contain a command injection vulnerability via the cmdinput parameter at ip/goform/formexeCommand. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://palm-vertebra-fe9.notion.site/formexeCommand_RCE-91a5f12ae23a42b4a25f5d1d4de308da