Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-51058 State: PUBLISHED Published: 2024-11-26T00:00:00.000Z Last Updated: 2025-11-03T19:31:56.630Z Vendors: n/a Products: n/a Problem Types: n/a Description: Local File Inclusion (LFI) vulnerability has been discovered in TCPDF 6.7.5. This vulnerability enables a user to read arbitrary files from the server's file system through <img> src tag, potentially exposing sensitive information. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/tecnickcom/TCPDF - https://github.com/tecnickcom/TCPDF/commit/bfa7d2b6d455ebf72ebe3d48fbd487ee5a1f6f3b - https://github.com/saravana-hackz/vulnerability-research/tree/main/CVE-2024-5105
7d2b6d455ebf72ebe3d48fbd487ee5a1f6f3b - https://github.com/saravana-hackz/vulnerability-research/tree/main/CVE-2024-51058
CVE ID: CVE-2024-51060 State: PUBLISHED Published: 2024-10-31T00:00:00 Last Updated: 2024-11-01T16:24:02.325Z Vendors: n/a Products: n/a Problem Types: n/a Description: Projectworlds Online Admission System v1 is vulnerable to SQL Injection in index.php via the 'a_id' parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://projectworld.com - https://github.com/0x1c1ph3r/CVEs/tree/main/CVE-2024-51060
CVE ID: CVE-2024-51063 State: PUBLISHED Published: 2024-10-31T00:00:00 Last Updated: 2024-11-01T16:22:09.224Z Vendors: n/a Products: n/a Problem Types: n/a Description: Phpgurukul Teachers Record Management System v2.1 is vulnerable to SQL Injection in add-teacher.php via the mobile number or email parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://phpgurukul.com - https://github.com/0x1c1ph3r/CVEs/tree/main/CVE-2024-51063
CVE ID: CVE-2024-51064 State: PUBLISHED Published: 2024-10-31T00:00:00 Last Updated: 2024-11-01T15:53:09.820Z Vendors: n/a Products: n/a Problem Types: n/a Description: Phpgurukul Teachers Record Management System v2.1 is vulnerable to SQL Injection via the tid parameter to admin/queries.php. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://phpgurukul.com - https://github.com/0x1c1ph3r/CVEs/tree/main/CVE-2024-51064
CVE ID: CVE-2024-51065 State: PUBLISHED Published: 2024-10-31T00:00:00 Last Updated: 2024-11-01T15:51:31.322Z Vendors: n/a Products: n/a Problem Types: n/a Description: Phpgurukul Beauty Parlour Management System v1.1 is vulnerable to SQL Injection in admin/index.php via the the username parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://phpgurukul.com - https://github.com/0x1c1ph3r/CVEs/tree/main/CVE-2024-51065
CVE ID: CVE-2024-51066 State: PUBLISHED Published: 2024-10-31T00:00:00 Last Updated: 2024-11-01T20:50:57.574Z Vendors: n/a Products: n/a Problem Types: n/a Description: An Insecure Direct Object Reference (IDOR) vulnerability in appointment-detail.php in Phpgurukul's Beauty Parlour Management System v1.1 allows unauthorized access to the Personally Identifiable Information (PII) of other customers. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://phpgurukul.com - https://github.com/0x1c1ph3r/CVEs/tree/main/CVE-2024-51066
CVE ID: CVE-2024-51072 State: PUBLISHED Published: 2024-11-22T00:00:00 Last Updated: 2025-01-10T14:21:13.205282Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in KIA Seltos vehicle instrument cluster with software and hardware v1.0 allows attackers to cause a Denial of Service (DoS) via ECU reset UDS service. NOTE: this is disputed by the Supplier because the findings came from a potentially unrealistic test environment (an isolated ECU part that was not in a vehicle), and because the ECUReset specification does not allow a manufacturer to require SecurityAccess and Authentication. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.iso.org/stan
rityAccess and Authentication. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.iso.org/standard/77323.html - https://udsoncan.readthedocs.io/en/latest/udsoncan/services.html - https://github.com/nitinronge91/KIA-SELTOS-Cluster-Vulnerabilities/blob/628b1550f0093f79380929074b6a5e6ca6f2d04b/CVE/Denial%20of%20Service%20via%20ECU%20Reset%20Service%20For%20KIA%20SELTOS%20CVE-2024-51072.md
CVE ID: CVE-2024-51073 State: PUBLISHED Published: 2024-11-22T00:00:00 Last Updated: 2025-01-13T14:48:29.631831Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in KIA Seltos vehicle instrument cluster with software and hardware v1.0 allows attackers to control or disrupt CAN communication between the instrument cluster and CAN bus. NOTE: this is disputed by the Supplier because the findings came from a potentially unrealistic test environment (an isolated ECU part that was not in a vehicle), and because the observed behavior follows the UDS (Unified Diagnostic Services) specification. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.iso.org/st
gnostic Services) specification. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.iso.org/standard/77323.html - https://udsoncan.readthedocs.io/en/latest/udsoncan/services.html - https://github.com/nitinronge91/KIA-SELTOS-Cluster-Vulnerabilities/blob/3755e3f692dce5b1ab06de2d04a2433c907ab21c/CVE/Control%20CAN%20communication%20for%20KIA%20SELTOS%20Cluster%20CVE-2024-51073.md
CVE ID: CVE-2024-51074 State: PUBLISHED Published: 2024-11-22T00:00:00 Last Updated: 2025-01-13T14:45:45.797823Z Vendors: n/a Products: n/a Problem Types: n/a Description: Incorrect access control in KIA Seltos vehicle instrument cluster with software and hardware v1.0 allows attackers to arbitrarily change odometer readings in the vehicle by targeting the instrument cluster through the unsecured CAN network. NOTE: this is disputed by the supplier because the CAN bus is not externally exposed, and because the packets can only increase the odometer reading (which typically has no value to an adversary). Also, this is disputed by the Supplier because the findings came from a potentially unreal
as no value to an adversary). Also, this is disputed by the Supplier because the findings came from a potentially unrealistic test environment (an isolated ECU part that was not in a vehicle), and because the observed behavior follows the UDS (Unified Diagnostic Services) specification. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://en.wikipedia.org/wiki/CAN_bus - https://github.com/nitinronge91/KIA-SELTOS-Cluster-Vulnerabilities/blob/0446f6fe6299eb39310e996c73d5513e70d76353/CVE/Odometer%20Manipulation%28Increase%29%20for%20KIA%20SELTOS%20Cluster%20CVE-2024-51074.md
CVE ID: CVE-2024-51075 State: PUBLISHED Published: 2024-10-29T00:00:00 Last Updated: 2024-10-29T20:05:00.496Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Reflected Cross Site Scripting (XSS) vulnerability was found in /odms/admin/user-search.php in PHPGurukul Online DJ Booking Management System v1.0, which allows remote attackers to execute arbitrary code via the searchdata parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Santoshcyber1/CVE-wirteup/blob/main/Phpgurukul/Online%20DJ%20Booking/DJ%20online%20Cross%20Site%20Scripting%20%20u.pdf
CVE ID: CVE-2024-51076 State: PUBLISHED Published: 2024-10-29T00:00:00 Last Updated: 2024-10-29T20:06:07.849Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Reflected Cross Site Scripting (XSS) vulnerability was found in /odms/admin/booking-search.php in PHPGurukul Online DJ Booking Management System 1.0, which allows remote attackers to execute arbitrary code via the "searchdata" parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Santoshcyber1/CVE-wirteup/blob/main/Phpgurukul/Online%20DJ%20Booking/Reflected%20Cross%20Site%20Scripting%20b.pdf
CVE ID: CVE-2024-51091 State: PUBLISHED Published: 2025-03-03T00:00:00.000Z Last Updated: 2025-03-04T16:21:12.563Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting vulnerability in seajs v.2.2.3 allows a remote attacker to execute arbitrary code via the seajs package Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gist.github.com/jackfromeast/176413c3bd73f825f7aeeb05e80e02a6
CVE ID: CVE-2024-51093 State: PUBLISHED Published: 2024-11-12T00:00:00 Last Updated: 2024-11-21T18:10:21.900Z Vendors: n/a Products: n/a Problem Types: n/a Description: Stored Cross-Site Scripting (XSS) vulnerability in Snipe-IT - v7.0.13 allows an attacker to upload a malicious XML file containing JavaScript code. This can lead to privilege escalation when the payload is executed, granting the attacker super admin permissions within the Snipe-IT system. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gist.githubusercontent.com/Tommywarren/ca70f1c43f4ec34dc19cd13459535780/raw/d13192ae50bc7c024b922412dfa3f530faa8d5db/CVE-2024-51093
CVE ID: CVE-2024-51094 State: PUBLISHED Published: 2024-11-12T00:00:00 Last Updated: 2024-11-19T16:48:56.392Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in Snipe-IT v.7.0.13 build 15514 allows a low-privileged attacker to modify their profile name and inject a malicious payload into the "Name" field. When an administrator later accesses the People Management page, exports the data as a CSV file, and opens it, the injected payload will be executed, allowing the attacker to exfiltrate internal system data from the CSV file to a remote server. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gist.githubusercontent.com/Tommywarren/b3a6c6ae5a93dd67
al Analyst Notes: - CISA ADP Vulnrichment: References: - https://gist.githubusercontent.com/Tommywarren/b3a6c6ae5a93dd67c863313f71f53a76/raw/ddff8cbbab5179f680ba3f5e94fc080575ad8913/CVE-2024-51094
CVE ID: CVE-2024-51099 State: PUBLISHED Published: 2025-05-23T00:00:00.000Z Last Updated: 2025-05-29T15:10:26.366Z Vendors: n/a Products: n/a Problem Types: n/a Description: A reflected cross-site scripting (XSS) vulnerability in the component mcgs/download-medical-cards.php of PHPGURUKUL Medical Card Generation System using PHP and MySQL v1.0 allows attackers to execute arbitrary code in the context of a user's browser via injecting a crafted payload into the searchdata parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/0xBhushan/Writeups/blob/main/CVE/phpGurukul/Medical%20Card%20Generation%20System/Reflected%20Cross-Site%20Scripting%20%28XSS%29-m
/Writeups/blob/main/CVE/phpGurukul/Medical%20Card%20Generation%20System/Reflected%20Cross-Site%20Scripting%20%28XSS%29-medical%20card%20details%20search.pdf
CVE ID: CVE-2024-51101 State: PUBLISHED Published: 2025-05-23T00:00:00.000Z Last Updated: 2025-05-29T15:14:56.393Z Vendors: n/a Products: n/a Problem Types: n/a Description: PHPGURUKUL Restaurant Table Booking System using PHP and MySQL v1.0 was discovered to contain a SQL injection vulnerability via the searchdata parameter at /rtbs/check-status.php. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/0xBhushan/Writeups/blob/main/CVE/phpGurukul/Restaurant%20Table%20Booking%20System%20using%20PHP%20and%20MySQL/SQL%20Injection-Search.pdf
CVE ID: CVE-2024-51102 State: PUBLISHED Published: 2025-05-23T00:00:00.000Z Last Updated: 2025-05-23T18:43:44.845Z Vendors: n/a Products: n/a Problem Types: n/a Description: PHPGURUKUL Student Management System using PHP and MySQL v1 was discovered to contain multiple SQL injection vulnerabilities at /studentrecordms/login.php via the username and password parameters. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/0xBhushan/Writeups/blob/main/CVE/phpGurukul/Student%20Management%20System/SQL%20Injection%20-%20admin%20login.pdf
CVE ID: CVE-2024-51103 State: PUBLISHED Published: 2025-05-23T00:00:00.000Z Last Updated: 2025-05-23T15:47:17.575Z Vendors: n/a Products: n/a Problem Types: n/a Description: PHPGURUKUL Student Management System using PHP and MySQL v1 was discovered to contain multiple SQL injection vulnerabilities at /studentrecordms/password-recovery.php via the emailid and id parameters. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/0xBhushan/Writeups/blob/main/CVE/phpGurukul/Student%20Management%20System/SQL%20Injection-Password-Recovery.pdf
CVE ID: CVE-2024-51106 State: PUBLISHED Published: 2025-05-19T00:00:00.000Z Last Updated: 2025-05-19T15:57:18.641Z Vendors: n/a Products: n/a Problem Types: n/a Description: A cross-site scripting (XSS) vulnerability in the component mcgs/admin/aboutus.php of PHPGURUKUL Medical Card Generation System using PHP and MySQL v1.0 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the pagetitle parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/0xBhushan/Writeups/blob/main/CVE/phpGurukul/Medical%20Card%20Generation%20System/Stored%20XSS-About%20Us.pdf
CVE ID: CVE-2024-51107 State: PUBLISHED Published: 2025-05-23T00:00:00.000Z Last Updated: 2025-05-29T15:18:18.172Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple stored cross-site scripting (XSS) vulnerabilities in the component /mcgs/admin/contactus.php of PHPGURUKUL Medical Card Generation System using PHP and MySQL v1.0 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the pagetitle, pagedes, and email parameters. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/0xBhushan/Writeups/blob/main/CVE/phpGurukul/Medical%20Card%20Generation%20System/Stored%20XSS-Contact%20Us.pdf
CVE ID: CVE-2024-51108 State: PUBLISHED Published: 2025-05-23T00:00:00.000Z Last Updated: 2025-05-29T15:17:21.136Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple stored cross-site scripting (XSS) vulnerabilities in the component /admin/card-bwdates-report.php of PHPGURUKUL Medical Card Generation System using PHP and MySQL v1.0 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the fromdate and todate parameters. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/0xBhushan/Writeups/blob/main/CVE/phpGurukul/Medical%20Card%20Generation%20System/Stored%20XSS-Between%20Dates%20Reports.pdf
CVE ID: CVE-2024-51111 State: PUBLISHED Published: 2025-01-06T00:00:00 Last Updated: 2025-01-06T17:20:01.235Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-Site Scripting (XSS) vulnerability in Pnetlab 5.3.11 allows an attacker to inject malicious scripts into a web page, which are executed in the context of the victim's browser. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://pnetlab.com - https://github.com/Zehraakmanlar/Bortecine-s_CVEs/blob/main/README.md
CVE ID: CVE-2024-51112 State: PUBLISHED Published: 2025-01-06T00:00:00 Last Updated: 2025-01-07T14:15:36.710Z Vendors: n/a Products: n/a Problem Types: n/a Description: Open Redirect vulnerability in Pnetlab 5.3.11 allows an attacker to manipulate URLs to redirect users to arbitrary external websites via a crafted script Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://pnetlab.com - https://github.com/Zehraakmanlar/Bortecine-s_CVEs/blob/main/README.md
CVE ID: CVE-2024-51114 State: PUBLISHED Published: 2024-12-03T00:00:00 Last Updated: 2024-12-05T19:54:49.072Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in Beijing Digital China Yunke Information Technology Co.Ltd v.7.2.6.120 allows a remote attacker to execute arbitrary code via the code/function/dpi/web_auth/customizable.php file Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/ZackSecurity/VulnerReport/blob/cve/DCN/2.md
CVE ID: CVE-2024-51115 State: PUBLISHED Published: 2024-11-05T00:00:00 Last Updated: 2024-11-06T16:23:30.282Z Vendors: n/a Products: n/a Problem Types: n/a Description: DCME-320 v7.4.12.90 was discovered to contain a command injection vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/CLan-nad/CVE/blob/main/dcn/ip_inter/1.md
CVE ID: CVE-2024-51116 State: PUBLISHED Published: 2024-11-05T00:00:00 Last Updated: 2024-11-06T16:42:23.910Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda AC6 v2.0 V15.03.06.50 was discovered to contain a buffer overflow in the function 'formSetPPTPServer'. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/CLan-nad/CVE/blob/main/tenda/formSetPPTPServer/readme.md
CVE ID: CVE-2024-51122 State: PUBLISHED Published: 2025-02-12T00:00:00.000Z Last Updated: 2025-03-18T20:39:51.611Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting vulnerability in Zertificon Z1 SecureMail Z1 CertServer v.3.16.4-2516-debian12 alllows a remote attacker to execute arbitrary code via the ST, L, O, OU, CN parameters. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/MVRC-ITSEC/CVEs/blob/main/CVE-2024-51122
CVE ID: CVE-2024-51123 State: PUBLISHED Published: 2025-02-12T00:00:00.000Z Last Updated: 2025-03-22T13:48:03.253Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in Zertificon Z1 SecureMail Z1 SecureMail Gateway 4.44.2-7240-debian12 allows a remote attacker to obtain sensitive information via the /compose-pdf.xhtml?convid=[id] component. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/MVRC-ITSEC/CVEs/blob/main/CVE-2024-51123
CVE ID: CVE-2024-51127 State: PUBLISHED Published: 2024-11-04T00:00:00 Last Updated: 2024-11-06T16:11:29.503Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in the createTempFile method of hornetq v2.4.9 allows attackers to arbitrarily overwrite files or access sensitive information. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://hornetq.com - https://github.com/JAckLosingHeart/CWE-378/blob/main/CVE-2024-51127.md
CVE ID: CVE-2024-51132 State: PUBLISHED Published: 2024-11-05T00:00:00 Last Updated: 2024-11-06T19:23:22.420Z Vendors: n/a Products: n/a Problem Types: n/a Description: An XML External Entity (XXE) vulnerability in HAPI FHIR before v6.4.0 allows attackers to access sensitive information or execute arbitrary code via supplying a crafted request containing malicious XML entities. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/hapifhir/org.hl7.fhir.core - https://github.com/JAckLosingHeart/CVE-2024-51132-POC
CVE ID: CVE-2024-51135 State: PUBLISHED Published: 2024-11-11T00:00:00 Last Updated: 2024-11-12T17:04:08.026Z Vendors: n/a Products: n/a Problem Types: n/a Description: An XML External Entity (XXE) vulnerability in the component DocumentBuilderFactory of powertac-server v1.9.0 allows attackers to access sensitive information or execute arbitrary code via supplying a crafted request containing malicious XML entities. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/powertac/powertac-server - https://github.com/powertac/powertac-server/issues/1166 - https://mvnrepository.com/artifact/org.powertac/server-interface - http://www.powertac.org/
CVE ID: CVE-2024-51136 State: PUBLISHED Published: 2024-11-04T00:00:00 Last Updated: 2024-11-05T21:10:31.257Z Vendors: n/a Products: n/a Problem Types: n/a Description: An XML External Entity (XXE) vulnerability in Dmoz2CSV in openimaj v1.3.10 allows attackers to access sensitive information or execute arbitrary code via supplying a crafted XML file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/openimaj/openimaj - https://github.com/openimaj/openimaj/issues/382 - https://mvnrepository.com/artifact/org.openimaj.tools/WebTools
CVE ID: CVE-2024-51138 State: PUBLISHED Published: 2025-02-27T00:00:00.000Z Last Updated: 2025-02-28T21:31:37.139Z Vendors: n/a Products: n/a Problem Types: n/a Description: Vigor165/166 4.2.7 and earlier; Vigor2620/LTE200 3.9.8.9 and earlier; Vigor2860/2925 3.9.8 and earlier; Vigor2862/2926 3.9.9.5 and earlier; Vigor2133/2762/2832 3.9.9 and earlier; Vigor2135/2765/2766 4.4.5. and earlier; Vigor2865/2866/2927 4.4.5.3 and earlier; Vigor2962 4.3.2.8 and earlier; Vigor3912 4.3.6.1 and earlier; Vigor3910 4.4.3.1 and earlier a stack-based buffer overflow vulnerability has been identified in the URL parsing functionality of the TR069 STUN server. This flaw occurs due to insufficient bounds checkin
dentified in the URL parsing functionality of the TR069 STUN server. This flaw occurs due to insufficient bounds checking on the amount of URL parameters, allowing an attacker to exploit the overflow by sending a maliciously crafted request. Consequently, a remote attacker can execute arbitrary code with elevated privileges. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://draytek.com - https://medium.com/faraday/advisory-multiple-vulnerabilities-affecting-draytek-routers-78a6cb8b3946
CVE ID: CVE-2024-51139 State: PUBLISHED Published: 2025-02-27T00:00:00.000Z Last Updated: 2025-02-28T17:23:14.780Z Vendors: n/a Products: n/a Problem Types: n/a Description: Buffer Overflow vulnerability in Vigor2620/LTE200 3.9.8.9 and earlier and Vigor2860/2925 3.9.8 and earlier and Vigor2862/2926 3.9.9.5 and earlier and Vigor2133/2762/2832 3.9.9 and earlier and Vigor165/166 4.2.7 and earlier and Vigor2135/2765/2766 4.4.5.1 and earlier and Vigor2865/2866/2927 4.4.5.3 and earlier and Vigor2962/3910 4.3.2.8/4.4.3.1 and earlier and Vigor3912 4.3.6.1 and earlier allows a remote attacker to execute arbitrary code via the CGI parser's handling of the "Content-Length" header of HTTP POST requests.
e attacker to execute arbitrary code via the CGI parser's handling of the "Content-Length" header of HTTP POST requests. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://draytek.com - https://medium.com/faraday/advisory-multiple-vulnerabilities-affecting-draytek-routers-78a6cb8b3946
CVE ID: CVE-2024-51141 State: PUBLISHED Published: 2024-11-15T00:00:00 Last Updated: 2024-11-15T19:07:04.222Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in TOTOLINK Bluetooth Wireless Adapter A600UB allows a local attacker to execute arbitrary code via the WifiAutoInstallDriver.exe and MSASN1.dll components. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://infosecwriteups.com/dll-hijacking-in-totolink-a600ub-driver-installer-13787c4d97b4
CVE ID: CVE-2024-51142 State: PUBLISHED Published: 2024-11-15T00:00:00 Last Updated: 2024-11-15T18:52:11.685Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting vulnerability in Chamilo LMS v.1.11.26 allows an attacker to execute arbitrary code via the svkey parameter of the storageapi.php file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://infosecwriteups.com/chamilo-lms-authentication-bypass-and-cross-site-scripting-stored-3fcb874ac7c1
CVE ID: CVE-2024-51144 State: PUBLISHED Published: 2025-03-05T00:00:00.000Z Last Updated: 2025-09-30T13:42:08.029Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Request Forgery (CSRF) vulnerability exists in the 'pvmsg.php?action=add_message', pvmsg.php?action=confirm_delete , and ajax.server.php?page=user&action=flip_follow endpoints in Ampache <= 6.6.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/ampache/ampache - https://nitipoom-jar.github.io/CVE-2024-51144/ - https://nitipoom-jaroonchaipipat.github.io/security-research-portal/2024-51144
CVE ID: CVE-2024-51151 State: PUBLISHED Published: 2024-11-20T00:00:00 Last Updated: 2024-11-22T16:15:26.466Z Vendors: n/a Products: n/a Problem Types: n/a Description: D-Link DI-8200 16.07.26A1 is vulnerable to remote command execution in the msp_info_htm function via the flag parameter and cmd parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/faqiadegege/IoTVuln/blob/main/DI_8200_msp_info_htm_rce/detail.md