Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-7417 State: PUBLISHED Published: 2024-10-17T03:32:50.985Z Last Updated: 2024-10-17T19:50:55.442Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: wproyal Products: Royal Elementor Addons and Templates Problem Types: CWE-200 Description: The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.3.986 via the data_fetch. This makes it possible for authenticated attackers, with subscriber-level access and above, to extract data from password protected posts. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vuln
cted posts. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/c3dfb0b7-5d9f-492b-9a1a-d4445d39c00c?source=cve - https://plugins.trac.wordpress.org/changeset/3162784/royal-elementor-addons/tags/1.3.987/classes/modules/wpr-ajax-search.php?old=3141814&old_path=royal-elementor-addons%2Ftags%2F1.3.985%2Fclasses%2Fmodules%2Fwpr-ajax-search.php - https://plugins.trac.wordpress.org/browser/royal-elementor-addons/tags/1.3.985/classes/modules/wpr-ajax-search.php#L21
CVE ID: CVE-2024-7418 State: PUBLISHED Published: 2024-08-29T03:52:58.022Z Last Updated: 2024-08-29T14:07:48.890Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: techlabpro1 Products: The Post Grid – Shortcode, Gutenberg Blocks and Elementor Addon for Post Grid Problem Types: CWE-200 Description: The The Post Grid – Shortcode, Gutenberg Blocks and Elementor Addon for Post Grid plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 7.7.11 via the post_query_guten and post_query functions. This makes it possible for authenticated attackers, with contributor-level access and above, to extract information from
his makes it possible for authenticated attackers, with contributor-level access and above, to extract information from posts that are not public (i.e. draft, future, etc..). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/dddecb2e-9ad6-4e44-afce-5eba7da6322d?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3142599%40the-post-grid&new=3142599%40the-post-grid&sfp_email=&sfph_mail= - https://plugins.trac.wordpress.org/changeset/3142599/the-post-grid/trunk/app/Controllers/Blocks/BlockBase.php - https://plugins.trac.wordpress.org/changeset/3142599/the-post-grid/trunk/app/Widget
p/Controllers/Blocks/BlockBase.php - https://plugins.trac.wordpress.org/changeset/3142599/the-post-grid/trunk/app/Widgets/elementor/rtTPGElementorQuery.php
CVE ID: CVE-2024-7419 State: PUBLISHED Published: 2025-02-07T15:21:05.068Z Last Updated: 2025-02-10T17:14:14.503Z Severity: HIGH (CVSS 8.3 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H) Vendors: WP All Import Products: WP All Export Pro Problem Types: CWE-94 Description: The WP ALL Export Pro plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.9.1 via the custom export fields. This is due to the missing input validation and sanitization of user-supplied data. This makes it possible for unauthenticated attackers to inject arbitrary PHP code into form fields that get executed on the server during the export, potentially leading to a complete site
ary PHP code into form fields that get executed on the server during the export, potentially leading to a complete site compromise. As a prerequisite, the custom export field should include fields containing user-supplied data. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/40b57370-4fd7-4316-9e99-a3f1d34616e8?source=cve - https://www.wpallimport.com/upgrade-to-wp-all-export-pro/
CVE ID: CVE-2024-7420 State: PUBLISHED Published: 2024-08-15T02:30:35.992Z Last Updated: 2024-08-15T14:51:53.900Z Severity: MEDIUM (CVSS 5.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N) Vendors: f1logic Products: Insert PHP Code Snippet Problem Types: CWE-352 Description: The Insert PHP Code Snippet plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.3.6. This is due to missing or incorrect nonce validation in the /admin/snippets.php file. This makes it possible for unauthenticated attackers to activate/deactivate and delete code snippets via a forged request granted they can trick a site administrator into performing an action such as cl
lete code snippets via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/88001f3c-f5cc-4051-a713-788014e2241a?source=cve - https://plugins.trac.wordpress.org/browser/insert-php-code-snippet/trunk/admin/snippets.php#L28 - https://plugins.trac.wordpress.org/changeset/3134787/insert-php-code-snippet/trunk/admin/snippets.php
CVE ID: CVE-2024-7421 State: PUBLISHED Published: 2024-09-25T15:12:54.854Z Last Updated: 2025-03-17T14:10:14.983Z Vendors: Devolutions Products: Remote Desktop Manager Problem Types: CWE-532 Description: An information exposure in Devolutions Remote Desktop Manager 2024.2.20.0 and earlier on Windows allows local attackers with access to system logs to obtain session credentials via passwords included in command-line arguments when launching WinSCP sessions Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://devolutions.net/security/advisories/DEVO-2024-0014
CVE ID: CVE-2024-7422 State: PUBLISHED Published: 2024-08-16T03:20:19.025Z Last Updated: 2024-08-16T15:09:37.311Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: jfarthing84 Products: Theme My Login Problem Types: CWE-352 Description: The Theme My Login plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 7.1.7. This is due to missing or incorrect nonce validation on the tml_admin_save_ms_settings() function. This makes it possible for unauthenticated attackers to update the theme's settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Please note that this only affects multi-site instances. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/0fb8e956-3a95-4e55-9816-be7eddb5835d?source=cve - https://plugins.trac.wordpress.org/changeset/3135854/theme-my-login/trunk/admin/settings.php
CVE ID: CVE-2024-7423 State: PUBLISHED Published: 2024-09-13T15:10:40.919Z Last Updated: 2024-09-13T20:03:58.787Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: xwp Products: Stream Problem Types: CWE-352 Description: The Stream plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.0.1. This is due to missing or incorrect nonce validation on the network_options_action() function. This makes it possible for unauthenticated attackers to update arbitrary options that can lead to DoS or privilege escalation via a forged request granted they can trick a site administrator into performing an action such as clicking
e escalation via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/9d15e418-36bb-4f53-ac67-8f6122591dd2?source=cve - https://plugins.trac.wordpress.org/browser/stream/tags/4.0.1/classes/class-network.php#L353 - https://plugins.trac.wordpress.org/changeset/3139815/stream/trunk/classes/class-network.php
CVE ID: CVE-2024-7424 State: PUBLISHED Published: 2024-11-01T07:33:29.575Z Last Updated: 2024-11-01T14:00:58.446Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) Vendors: themeisle Products: Multiple Page Generator Plugin – MPG Problem Types: CWE-284 Description: The Multiple Page Generator Plugin – MPG plugin for WordPress is vulnerable to unauthorized modification of and access to data due to a missing capability check on several functions in all versions up to, and including, 4.0.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to invoke those functions intended for admin use resulting in subscribers being able to uplo
ber-level access and above, to invoke those functions intended for admin use resulting in subscribers being able to upload csv files and view the contents of MPG projects. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/860848c1-dd67-4baf-a571-bc866c5f12f8?source=cve - https://plugins.trac.wordpress.org/browser/multiple-pages-generator-by-porthas/trunk/controllers/DatasetController.php#L261 - https://plugins.trac.wordpress.org/browser/multiple-pages-generator-by-porthas/trunk/models/ProjectModel.php#L286 - https://plugins.trac.wordpress.org/changeset/3174918/multiple-pages-generator-by-porthas/trunk/controllers/Datase
L286 - https://plugins.trac.wordpress.org/changeset/3174918/multiple-pages-generator-by-porthas/trunk/controllers/DatasetController.php - https://plugins.trac.wordpress.org/changeset/3174918/multiple-pages-generator-by-porthas/trunk/models/ProjectModel.php - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3178830%40multiple-pages-generator-by-porthas%2Ftrunk&old=3174918%40multiple-pages-generator-by-porthas%2Ftrunk&sfp_email=&sfph_mail=
CVE ID: CVE-2024-7425 State: PUBLISHED Published: 2025-02-07T16:21:20.564Z Last Updated: 2025-02-07T16:38:32.242Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H) Vendors: WP All Import Products: WP All Export Pro Problem Types: CWE-94 Description: The WP ALL Export Pro plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to improper user input validation and sanitization in all versions up to, and including, 1.9.1. This makes it possible for authenticated attackers, with Shop Manager-level access and above, to update arbitrary options on the WordPress site. This can be leveraged to update the default role f
access and above, to update arbitrary options on the WordPress site. This can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/c9205896-487d-4b8f-84cf-7ba16e1205e3?source=cve - https://www.wpallimport.com/upgrade-to-wp-all-export-pro/
CVE ID: CVE-2024-7426 State: PUBLISHED Published: 2024-09-25T02:05:05.185Z Last Updated: 2024-09-27T15:20:57.293Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: peepso Products: Community by PeepSo – Social Network, Membership, Registration, User Profiles, Premium – Mobile App Problem Types: CWE-200 Description: The Community by PeepSo – Social Network, Membership, Registration, User Profiles plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 6.4.6.0. This is due to the plugin displaying errors and allowing direct access to the sse.php file. This makes it possible for unauthenticated attackers to retrieve the fu
and allowing direct access to the sse.php file. This makes it possible for unauthenticated attackers to retrieve the full path of the web application, which can be used to aid other attacks. The information displayed is not useful on its own, and requires another vulnerability to be present for damage to an affected website. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/2e69d666-50de-4c82-9ad4-9ed40fcc7218?source=cve - https://wordpress.org/plugins/peepso-core/#developers
CVE ID: CVE-2024-7427 State: PUBLISHED Published: 2024-08-23T17:05:37.231Z Last Updated: 2024-08-23T18:56:47.870Z Vendors: OpenText™ Products: Network Node Manager i (NNMi) Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in OpenText™ Network Node Manager i (NNMi) could allow Cross-Site Scripting (XSS).This issue affects Network Node Manager i (NNMi): 2022.11, 2023.05, 23.4, 24.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://portal.microfocus.com/s/article/KM000033018?language=en_US
CVE ID: CVE-2024-7428 State: PUBLISHED Published: 2024-08-23T17:05:35.345Z Last Updated: 2024-08-23T18:58:01.620Z Vendors: OpenText™ Products: Network Node Manager i (NNMi) Problem Types: CWE-601 Description: URL Redirection to Untrusted Site ('Open Redirect') vulnerability in OpenText™ Network Node Manager i (NNMi) allows URL Redirector Abuse.This issue affects Network Node Manager i (NNMi): 2022.11, 2023.05, 23.4, 24.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://portal.microfocus.com/s/article/KM000033015?language=en_US
CVE ID: CVE-2024-7429 State: PUBLISHED Published: 2024-11-05T09:30:58.286Z Last Updated: 2024-11-05T14:52:27.537Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: kseaborn Products: Zotpress Problem Types: CWE-284 Description: The Zotpress plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the Zotpress_process_accounts_AJAX function in all versions up to, and including, 7.3.12. This makes it possible for authenticated attackers, with Contributor-level access and above, to reset the plugin's settings. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel
ugin's settings. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/1f38676b-270f-4b0f-bc98-a14a26b86a50?source=cve - https://plugins.trac.wordpress.org/browser/zotpress/trunk/lib/admin/admin.php#L40 - https://plugins.trac.wordpress.org/changeset/3153348/zotpress/trunk/lib/admin/admin.php
CVE ID: CVE-2024-7432 State: PUBLISHED Published: 2024-10-01T07:30:08.690Z Last Updated: 2024-10-01T16:06:30.469Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: ultrapressorg Products: Unseen Blog Problem Types: CWE-502 Description: The Unseen Blog theme for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.0.0 via deserialization of untrusted input. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software. If a POP chain is present via an additional plugin or theme installed on the target system, it could
lnerable software. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/1a14b86f-a5c8-4ec2-9940-68a37a6c4a86?source=cve - https://wordpress.org/themes/unseen-blog/
CVE ID: CVE-2024-7433 State: PUBLISHED Published: 2024-10-01T07:30:10.797Z Last Updated: 2024-10-01T15:44:41.795Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: ultrapressorg Products: Empowerment Problem Types: CWE-502 Description: The Empowerment theme for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.0.2 via deserialization of untrusted input. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software. If a POP chain is present via an additional plugin or theme installed on the target system, it could
lnerable software. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/3d96d38a-7f0e-4e47-ba49-727705eaaac6?source=cve - https://wordpress.org/themes/empowerment/
CVE ID: CVE-2024-7434 State: PUBLISHED Published: 2024-10-01T07:30:16.381Z Last Updated: 2024-10-01T13:41:47.768Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: ultrapressorg Products: UltraPress Problem Types: CWE-502 Description: The UltraPress theme for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.2.1 via deserialization of untrusted input. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software. If a POP chain is present via an additional plugin or theme installed on the target system, it could al
erable software. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/c9cf97a6-38bb-4499-98f0-ca2b7111f654?source=cve - https://wordpress.org/themes/ultrapress/
CVE ID: CVE-2024-7435 State: PUBLISHED Published: 2024-08-31T02:33:21.647Z Last Updated: 2024-09-03T18:18:33.044Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: shafayat-alam Products: Attire Problem Types: CWE-502 Description: The Attire theme for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.0.6 via deserialization of untrusted input. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the
oftware. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/f21cbe18-77e1-4a9a-96a0-74edaef0db3e?source=cve - https://themes.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=240321%40attire%2F2.0.7&old=231937%40attire%2F2.0.6
CVE ID: CVE-2024-7436 State: PUBLISHED Published: 2024-08-03T14:00:08.723Z Last Updated: 2024-08-07T16:07:37.883Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: D-Link Products: DI-8100 Problem Types: CWE-77 Description: A vulnerability, which was classified as critical, has been found in D-Link DI-8100 16.07. This issue affects the function msp_info_htm of the file msp_info.htm. The manipulation of the argument cmd leads to command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-273521 was assigned to this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vul
-273521 was assigned to this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.273521 - https://vuldb.com/?ctiid.273521 - https://vuldb.com/?submit.370591 - https://github.com/aLtEr6/pdf/blob/main/2.pdf
CVE ID: CVE-2024-7437 State: PUBLISHED Published: 2024-08-03T14:31:04.930Z Last Updated: 2024-08-10T06:26:10.103Z Severity: N/A (CVSS 5.5 AV:N/AC:L/Au:S/C:N/I:P/A:P) Vendors: SimpleMachines Products: SMF Problem Types: CWE-99 Description: A vulnerability, which was classified as critical, was found in SimpleMachines SMF 2.1.4. Affected is an unknown function of the file /index.php?action=profile;u=2;area=showalerts;do=remove of the component Delete User Handler. The manipulation of the argument aid leads to improper control of resource identifiers. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP
the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.273522 - https://vuldb.com/?ctiid.273522 - https://vuldb.com/?submit.380189 - https://github.com/Fewword/Poc/blob/main/smf/smf-poc1.md
CVE ID: CVE-2024-7438 State: PUBLISHED Published: 2024-08-03T15:31:03.669Z Last Updated: 2024-08-10T06:26:12.241Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: SimpleMachines Products: SMF Problem Types: CWE-99 Description: A vulnerability has been found in SimpleMachines SMF 2.1.4 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /index.php?action=profile;u=2;area=showalerts;do=read of the component User Alert Read Status Handler. The manipulation of the argument aid leads to improper control of resource identifiers. The attack can be launched remotely. The exploit has been disclosed to the public and ma
ontrol of resource identifiers. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.273523 - https://vuldb.com/?ctiid.273523 - https://vuldb.com/?submit.380190 - https://github.com/Fewword/Poc/blob/main/smf/smf-poc2.md
CVE ID: CVE-2024-7439 State: PUBLISHED Published: 2024-08-03T16:00:07.798Z Last Updated: 2024-08-05T15:09:25.672Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C) Vendors: Vivotek Products: CC8160 Problem Types: CWE-121 Description: ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in Vivotek CC8160 VVTK-0100d and classified as critical. Affected by this issue is the function read of the component httpd. The manipulation of the argument Content-Length leads to stack-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-273524. NOTE: This vulnerability only affects products
blic and may be used. The identifier of this vulnerability is VDB-273524. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: Vendor was contacted early and confirmed that the affected release tree is end-of-life. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.273524 - https://vuldb.com/?ctiid.273524 - https://vuldb.com/?submit.383830 - https://yjz233.notion.site/vivotek-CC8160-has-stack-buffer-overflow-vulnerability-in-httpd-8409f967d3064493b649720f36d59081?pvs=4
CVE ID: CVE-2024-7440 State: PUBLISHED Published: 2024-08-03T16:31:04.256Z Last Updated: 2024-08-07T20:36:03.492Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: Vivotek Products: CC8160 Problem Types: CWE-77 Description: ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in Vivotek CC8160 VVTK-0100d. It has been classified as critical. This affects the function getenv of the file upload_file.cgi. The manipulation of the argument QUERY_STRING leads to command injection. It is possible to initiate the attack remotely. The identifier VDB-273525 was assigned to this vulnerability. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.