Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-38887 State: PUBLISHED Published: 2024-08-02T00:00:00 Last Updated: 2024-08-12T19:55:02.045Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in Horizon Business Services Inc. Caterease 16.0.1.1663 through 24.0.1.2405 and possibly later versions, allows a remote attacker to expand control over the operating system from the database due to the execution of commands with unnecessary privileges. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://caterease.com - http://horizon.com - https://vuldb.com/?id.273371 - https://packetstormsecurity.com/files/179892/Caterease-Software-SQL-Injection-Command-Injection-Bypass.html
CVE ID: CVE-2024-38888 State: PUBLISHED Published: 2024-08-02T00:00:00 Last Updated: 2024-08-08T14:22:19.804Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in Horizon Business Services Inc. Caterease 16.0.1.1663 through 24.0.1.2405 and possibly later versions, allows a local attacker to perform a Password Brute Forcing attack due to improper restriction of excessive authentication attempts. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://caterease.com - http://horizon.com - https://vuldb.com/?id.273372 - https://packetstormsecurity.com/files/179892/Caterease-Software-SQL-Injection-Command-Injection-Bypass.html
CVE ID: CVE-2024-38889 State: PUBLISHED Published: 2024-08-02T00:00:00 Last Updated: 2024-08-08T14:20:28.367Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in Horizon Business Services Inc. Caterease 16.0.1.1663 through 24.0.1.2405 and possibly later versions, allows a remote attacker to perform SQL Injection due to improper neutralization of special elements used in an SQL command. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://caterease.com - http://horizon.com - https://vuldb.com/?id.273373 - https://packetstormsecurity.com/files/179892/Caterease-Software-SQL-Injection-Command-Injection-Bypass.html
CVE ID: CVE-2024-38890 State: PUBLISHED Published: 2024-08-02T00:00:00 Last Updated: 2024-08-07T15:46:13.170312 Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in Horizon Business Services Inc. Caterease Software 16.0.1.1663 through 24.0.1.2405 and possibly later versions allows a local attacker to perform an Authentication Bypass by Capture-replay attack due to insufficient protection against capture-replay attacks. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.273374 - https://packetstormsecurity.com/files/179892/Caterease-Software-SQL-Injection-Command-Injection-Bypass.html
CVE ID: CVE-2024-38891 State: PUBLISHED Published: 2024-08-02T00:00:00 Last Updated: 2024-08-12T19:56:12.566Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in Horizon Business Services Inc. Caterease 16.0.1.1663 through 24.0.1.2405 and possibly later versions, allows a remote attacker to perform a Sniffing Network Traffic attack due to the cleartext transmission of sensitive information. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://caterease.com - http://horizon.com - https://vuldb.com/?id.273375 - https://packetstormsecurity.com/files/179892/Caterease-Software-SQL-Injection-Command-Injection-Bypass.html
CVE ID: CVE-2024-38892 State: PUBLISHED Published: 2024-06-24T00:00:00 Last Updated: 2024-08-02T04:19:20.451Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in Wavlink WN551K1 allows a remote attacker to obtain sensitive information via the ExportAllSettings.sh component. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/s4ndw1ch136/IOT-vuln-reports/blob/main/Wavlink/WN551K1/ExportLogs.sh/README.md
CVE ID: CVE-2024-38894 State: PUBLISHED Published: 2024-06-24T00:00:00 Last Updated: 2024-08-02T04:19:20.415Z Vendors: n/a Products: n/a Problem Types: n/a Description: WAVLINK WN551K1 found a command injection vulnerability through the IP parameter of /cgi-bin/touchlist_sync.cgi. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/s4ndw1ch136/IOT-vuln-reports/blob/main/Wavlink/WN551K1/touchlist_sync.cgi/README.md
CVE ID: CVE-2024-38895 State: PUBLISHED Published: 2024-06-24T00:00:00 Last Updated: 2024-08-02T04:19:20.638Z Vendors: n/a Products: n/a Problem Types: n/a Description: WAVLINK WN551K1'live_mfg.shtml enables attackers to obtain sensitive router information. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/s4ndw1ch136/IOT-vuln-reports/tree/main/Wavlink/WN551K1/live_mfg.shtml
CVE ID: CVE-2024-38896 State: PUBLISHED Published: 2024-06-24T00:00:00 Last Updated: 2024-08-02T04:19:20.416Z Vendors: n/a Products: n/a Problem Types: n/a Description: WAVLINK WN551K1 found a command injection vulnerability through the start_hour parameter of /cgi-bin/nightled.cgi. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/s4ndw1ch136/IOT-vuln-reports/tree/main/Wavlink/WN551K1/nightled.cgi
CVE ID: CVE-2024-38897 State: PUBLISHED Published: 2024-06-24T00:00:00 Last Updated: 2024-08-02T04:19:20.234Z Vendors: n/a Products: n/a Problem Types: n/a Description: WAVLINK WN551K1'live_check.shtml enables attackers to obtain sensitive router information. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/s4ndw1ch136/IOT-vuln-reports/blob/main/Wavlink/WN551K1/live_check.shtml/README.md
CVE ID: CVE-2024-38902 State: PUBLISHED Published: 2024-06-24T00:00:00.000Z Last Updated: 2025-03-13T15:04:36.270Z Vendors: n/a Products: n/a Problem Types: n/a Description: H3C Magic R230 V100R002 was discovered to contain a hardcoded password vulnerability in /etc/shadow, which allows attackers to log in as root. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/s4ndw1ch136/IOT-vuln-reports/blob/main/H3C/Magic%20R230/hardcode/README.md
CVE ID: CVE-2024-38903 State: PUBLISHED Published: 2024-06-24T00:00:00 Last Updated: 2024-08-02T04:19:20.453Z Vendors: n/a Products: n/a Problem Types: n/a Description: H3C Magic R230 V100R002's udpserver opens port 9034, allowing attackers to execute arbitrary commands. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/s4ndw1ch136/IOT-vuln-reports/blob/main/H3C/Magic%20R230/UDPserver_97F/README.md
CVE ID: CVE-2024-38909 State: PUBLISHED Published: 2024-07-30T00:00:00.000Z Last Updated: 2025-03-14T18:13:33.092Z Vendors: n/a Products: n/a Problem Types: n/a Description: Studio 42 elFinder 2.1.64 is vulnerable to Incorrect Access Control. Copying files with an unauthorized extension between server directories allows an arbitrary attacker to expose secrets, perform RCE, etc. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - http://elfinder.com - https://github.com/B0D0B0P0T/CVE/blob/main/CVE-2024-38909
CVE ID: CVE-2024-38910 State: PUBLISHED Published: 2024-12-05T00:00:00 Last Updated: 2024-12-06T19:39:06.251Z Vendors: n/a Products: n/a Problem Types: n/a Description: Open Robotics Robotic Operating System 2 (ROS2) and Nav2 humble version was discovered to contain a use-after-free in the nav2_amcl process. This vulnerability is triggered via sending a request to change dynamic parameters. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/ros-navigation/navigation2/issues/4379 - https://github.com/ros-navigation/navigation2/pull/4397 - https://github.com/GoesM/ROS-CVE-CNVDs
CVE ID: CVE-2024-38920 State: PUBLISHED Published: 2024-12-05T00:00:00 Last Updated: 2024-12-06T19:36:07.460Z Vendors: n/a Products: n/a Problem Types: n/a Description: Open Robotics Robotic Operating System 2 (ROS2) and Nav2 humble versions were discovered to contain a use-after-free via the nav2_amcl process. This vulnerability is triggerd via remotely sending a request for change the value of dynamic-parameter`/amcl max_beams` . Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/ros-navigation/navigation2/issues/4379 - https://github.com/ros-navigation/navigation2/pull/4397 - https://github.com/GoesM/ROS-CVE-CNVDs
CVE ID: CVE-2024-38921 State: PUBLISHED Published: 2024-12-06T00:00:00 Last Updated: 2024-12-11T17:11:39.627Z Vendors: n/a Products: n/a Problem Types: n/a Description: Open Robotics Robotic Operating System 2 (ROS2) and Nav2 humble versions were discovered to contain a use-after-free via the nav2_amcl process. This vulnerability is triggered via remotely sending a request for change the value of dynamic-parameter`/amcl z_rand ` . Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/ros-navigation/navigation2/issues/4379 - https://github.com/ros-navigation/navigation2/pull/4397 - https://github.com/GoesM/ROS-CVE-CNVDs
CVE ID: CVE-2024-38922 State: PUBLISHED Published: 2024-12-06T00:00:00 Last Updated: 2024-12-11T18:55:37.518Z Vendors: n/a Products: n/a Problem Types: n/a Description: Open Robotics Robotic Operating System 2 (ROS2) and Nav2 humble version was discovered to contain a heap overflow in the nav2_amcl process. This vulnerability is triggered via sending a crafted message to the component /initialpose. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/ros-navigation/navigation2/issues/4294 - https://github.com/open-navigation/navigation2/issues/4307 - https://github.com/ros-navigation/navigation2/pull/4301 - https://github.com/GoesM/ROS-CVE-CNVDs
CVE ID: CVE-2024-38923 State: PUBLISHED Published: 2024-12-06T00:00:00 Last Updated: 2024-12-11T17:18:55.593Z Vendors: n/a Products: n/a Problem Types: n/a Description: Open Robotics Robotic Operating System 2 (ROS2) and Nav2 humble versions were discovered to contain a use-after-free via the nav2_amcl process. This vulnerability is triggered via remotely sending a request to change the value of dynamic-parameter`/amcl odom_frame_id` . Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/ros-navigation/navigation2/issues/4379 - https://github.com/ros-navigation/navigation2/pull/4397 - https://github.com/GoesM/ROS-CVE-CNVDs
CVE ID: CVE-2024-38924 State: PUBLISHED Published: 2024-12-06T00:00:00 Last Updated: 2024-12-11T17:17:13.084Z Vendors: n/a Products: n/a Problem Types: n/a Description: Open Robotics Robotic Operating System 2 (ROS2) and Nav2 humble versions were discovered to contain a use-after-free via the nav2_amcl process. This vulnerability is triggered via remotely sending a request to change the value of dynamic-parameter`/amcl laser_model_type` . Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/ros-navigation/navigation2/issues/4379 - https://github.com/ros-navigation/navigation2/pull/4397 - https://github.com/GoesM/ROS-CVE-CNVDs
CVE ID: CVE-2024-38925 State: PUBLISHED Published: 2024-12-06T00:00:00 Last Updated: 2024-12-11T19:42:24.658Z Vendors: n/a Products: n/a Problem Types: n/a Description: Open Robotics Robotic Operating System 2 (ROS2) and Nav2 humble versions were discovered to contain a use-after-free via the nav2_amcl process. This vulnerability is triggered via remotely sending a request for change the value of dynamic-parameter`/amcl z_max` . Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/ros-navigation/navigation2/issues/4379 - https://github.com/ros-navigation/navigation2/pull/4397 - https://github.com/GoesM/ROS-CVE-CNVDs
CVE ID: CVE-2024-38926 State: PUBLISHED Published: 2024-12-06T00:00:00 Last Updated: 2024-12-11T19:43:18.055Z Vendors: n/a Products: n/a Problem Types: n/a Description: Open Robotics Robotic Operating System 2 (ROS2) and Nav2 humble versions were discovered to contain a use-after-free via the nav2_amcl process. This vulnerability is triggered via remotely sending a request for change the value of dynamic-parameter `/amcl z_short`. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/ros-navigation/navigation2/issues/4379 - https://github.com/ros-navigation/navigation2/pull/4397 - https://github.com/GoesM/ROS-CVE-CNVDs
CVE ID: CVE-2024-38927 State: PUBLISHED Published: 2024-12-06T00:00:00 Last Updated: 2024-12-11T19:44:54.545Z Vendors: n/a Products: n/a Problem Types: n/a Description: Open Robotics Robotic Operating System 2 (ROS2) and Nav2 humble versions were discovered to contain a use-after-free via the nav2_amcl process. This vulnerability is triggered via remotely sending a request to change the value of dynamic-parameter `/amcl do_beamskip`. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/ros-navigation/navigation2/issues/4379 - https://github.com/ros-navigation/navigation2/pull/4397 - https://github.com/GoesM/ROS-CVE-CNVDs
CVE ID: CVE-2024-38944 State: PUBLISHED Published: 2024-07-22T00:00:00 Last Updated: 2024-08-02T04:19:20.420Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in Intelight X-1L Traffic controller Maxtime v.1.9.6 allows a remote attacker to execute arbitrary code via the /cgi-bin/generateForm.cgi?formID=142 component. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://gist.github.com/LemonSec/6aaea8320187a38e1a398fa321f12303
CVE ID: CVE-2024-38949 State: PUBLISHED Published: 2024-06-26T00:00:00 Last Updated: 2024-08-02T04:19:20.484Z Vendors: n/a Products: n/a Problem Types: n/a Description: Heap Buffer Overflow vulnerability in Libde265 v1.0.15 allows attackers to crash the application via crafted payload to display444as420 function at sdl.cc Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/strukturag/libde265/issues/460 - https://github.com/zhangteng0526/CVE-information/blob/main/CVE-2024-38949
CVE ID: CVE-2024-38950 State: PUBLISHED Published: 2024-06-26T00:00:00 Last Updated: 2024-08-12T17:53:27.457Z Vendors: n/a Products: n/a Problem Types: n/a Description: Heap Buffer Overflow vulnerability in Libde265 v1.0.15 allows attackers to crash the application via crafted payload to __interceptor_memcpy function. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/strukturag/libde265/issues/460 - https://github.com/zhangteng0526/CVE-information/blob/main/CVE-2024-38950
CVE ID: CVE-2024-38951 State: PUBLISHED Published: 2024-06-25T00:00:00 Last Updated: 2024-10-28T20:40:36.021Z Vendors: n/a Products: n/a Problem Types: n/a Description: A buffer overflow in PX4-Autopilot v1.12.3 allows attackers to cause a Denial of Service (DoS) via a crafted MavLink message. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/PX4/PX4-Autopilot/issues/23251
CVE ID: CVE-2024-38952 State: PUBLISHED Published: 2024-06-25T00:00:00 Last Updated: 2024-08-14T19:28:11.203Z Vendors: n/a Products: n/a Problem Types: n/a Description: PX4-Autopilot v1.14.3 was discovered to contain a buffer overflow via the topic_name parameter at /logger/logged_topics.cpp. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/PX4/PX4-Autopilot/issues/23258 - https://github.com/PX4/PX4-Autopilot/blob/main/src/modules/logger/logged_topics.cpp#L440 - https://github.com/PX4/PX4-Autopilot/blob/main/src/modules/logger/logged_topics.cpp#L561
CVE ID: CVE-2024-38953 State: PUBLISHED Published: 2024-07-01T00:00:00.000Z Last Updated: 2025-03-20T20:49:56.746Z Vendors: n/a Products: n/a Problem Types: n/a Description: phpok 6.4.003 contains a Cross Site Scripting (XSS) vulnerability in the ok_f() method under the framework/api/upload_control.php file. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/qinggan/phpok/issues/17
CVE ID: CVE-2024-38959 State: PUBLISHED Published: 2024-07-09T00:00:00 Last Updated: 2024-08-02T04:19:20.481Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting vulnerability in Creativeitem Academy LMS Learning Management System v.6.8.1 allows a remote attacker to execute arbitrary code and obtain sensitive information via the string parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://medium.com/%40geetmadan22/reflected-cross-site-scripting-on-academy-lms-learning-management-system-product-4ab04ef51022
CVE ID: CVE-2024-38963 State: PUBLISHED Published: 2024-07-09T00:00:00 Last Updated: 2024-08-02T04:19:20.508Z Vendors: n/a Products: n/a Problem Types: n/a Description: Nopcommerce 4.70.1 is vulnerable to Cross Site Scripting (XSS) via the combined "AddProductReview.Title" and "AddProductReview.ReviewText" parameter(s) (Reviews) when creating a new review. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/nopSolutions/nopCommerce/issues/7224 - https://github.com/iamtron01/Vulnerability-Research/tree/main/CVE-2024-38963
CVE ID: CVE-2024-38970 State: PUBLISHED Published: 2024-07-09T00:00:00.000Z Last Updated: 2025-03-20T14:19:14.524Z Vendors: n/a Products: n/a Problem Types: n/a Description: vaeThink 1.0.2 is vulnerable to Information Disclosure via the system backend,access management administrator function. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/tingyuu/vaeThink - https://gist.github.com/fltys/b2c430bca85c97211010bdc602437978
CVE ID: CVE-2024-38971 State: PUBLISHED Published: 2024-07-09T00:00:00.000Z Last Updated: 2025-03-27T15:29:09.354Z Vendors: n/a Products: n/a Problem Types: n/a Description: vaeThink 1.0.2 is vulnerable to stored Cross Site Scripting (XSS) in the system backend. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/tingyuu/vaeThink - https://gist.github.com/fltys/998d96272545d2cf7cd6b182adbfd672
CVE ID: CVE-2024-38972 State: PUBLISHED Published: 2024-07-09T00:00:00 Last Updated: 2024-08-02T04:19:20.512Z Vendors: n/a Products: n/a Problem Types: n/a Description: A cross-site scripting (XSS) vulnerability in netbox v4.0.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name parameter at /dcim/power-ports/add/. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/minhquan202/Vuln-Netbox
CVE ID: CVE-2024-38983 State: PUBLISHED Published: 2024-07-30T00:00:00 Last Updated: 2024-08-02T04:19:20.525Z Vendors: n/a Products: n/a Problem Types: n/a Description: Prototype Pollution in alykoshin mini-deep-assign v0.0.8 allows an attacker to execute arbitrary code or cause a Denial of Service (DoS) and cause other impacts via the _assign() method at (/lib/index.js:91) Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://gist.github.com/mestrtee/f82d0c3a8fe3a125f06425caef5d22ed
CVE ID: CVE-2024-38984 State: PUBLISHED Published: 2024-07-30T00:00:00 Last Updated: 2024-08-02T04:19:20.493Z Vendors: n/a Products: n/a Problem Types: n/a Description: Prototype Pollution in lukebond json-override 0.2.0 allows attackers to to execute arbitrary code or cause a Denial of Service (DoS) via the __proto__ property. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://gist.github.com/mestrtee/97a9a7d73fc8b38fcf01322239dd5fb1
CVE ID: CVE-2024-38985 State: PUBLISHED Published: 2025-03-28T00:00:00.000Z Last Updated: 2025-04-01T18:29:55.929Z Vendors: n/a Products: n/a Problem Types: n/a Description: janryWang products depath v1.0.6 and cool-path v1.1.2 were discovered to contain a prototype pollution via the set() method at setIn (lib/index.js:90). This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gist.github.com/mestrtee/32c0a48023036e51918f6a098f21953d - https://github.com/janryWang/depath/issues/11
CVE ID: CVE-2024-38986 State: PUBLISHED Published: 2024-07-30T00:00:00 Last Updated: 2024-08-02T04:19:20.526Z Vendors: n/a Products: n/a Problem Types: n/a Description: Prototype Pollution in 75lb deep-merge 1.1.1 allows attackers to execute arbitrary code or cause a Denial of Service (DoS) and cause other impacts via merge methods of lodash to merge objects. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://gist.github.com/mestrtee/b20c3aee8bea16e1863933778da6e4cb
CVE ID: CVE-2024-38987 State: PUBLISHED Published: 2024-07-01T00:00:00 Last Updated: 2024-08-02T04:19:20.449Z Vendors: n/a Products: n/a Problem Types: n/a Description: aofl cli-lib v3.14.0 was discovered to contain a prototype pollution via the component defaultsDeep. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://gist.github.com/mestrtee/29636943e6989e67f38251580cbcea73 - https://github.com/AgeOfLearning/aofl/issues/35
CVE ID: CVE-2024-38988 State: PUBLISHED Published: 2025-03-28T00:00:00.000Z Last Updated: 2025-04-01T18:52:26.879Z Vendors: n/a Products: n/a Problem Types: n/a Description: alizeait unflatto <= 1.0.2 was discovered to contain a prototype pollution via the method exports.unflatto at /dist/index.js. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gist.github.com/mestrtee/4c5dfb66bea377889c44dd6c8af28713
CVE ID: CVE-2024-38989 State: PUBLISHED Published: 2024-08-09T00:00:00 Last Updated: 2024-08-13T13:44:57.205Z Vendors: n/a Products: n/a Problem Types: n/a Description: izatop bunt v0.29.19 was discovered to contain a prototype pollution via the component /esm/qs.js. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/izatop/bunt/commit/c55201a8cee03e5282f99874dead988c80d31db7 - https://gist.github.com/mestrtee/5e9830fb180a34d65f04fafb52d2b94b
CVE ID: CVE-2024-38990 State: PUBLISHED Published: 2024-07-01T00:00:00 Last Updated: 2024-08-02T04:19:20.508Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tada5hi sp-common v0.5.4 was discovered to contain a prototype pollution via the function mergeDeep. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://gist.github.com/mestrtee/ae5f6b0d8f5d7de716e6af6d189b2169
CVE ID: CVE-2024-38991 State: PUBLISHED Published: 2024-07-01T00:00:00 Last Updated: 2024-08-02T04:19:20.486Z Vendors: n/a Products: n/a Problem Types: n/a Description: akbr patch-into v1.0.1 was discovered to contain a prototype pollution via the function patchInto. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://gist.github.com/mestrtee/8851413e3b33a96f191f0e9c81706532
CVE ID: CVE-2024-38992 State: PUBLISHED Published: 2024-07-01T00:00:00 Last Updated: 2024-08-02T04:19:20.581Z Vendors: n/a Products: n/a Problem Types: n/a Description: airvertco frappejs v0.0.11 was discovered to contain a prototype pollution via the function registerView. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://gist.github.com/mestrtee/10c88b9069229979ac7e52e0efc98055