Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-40074 State: PUBLISHED Published: 2025-04-16T00:00:00.000Z Last Updated: 2025-04-18T12:02:49.516Z Vendors: n/a Products: n/a Problem Types: n/a Description: Sourcecodester Online ID Generator System 1.0 was discovered to contain Stored Cross Site Scripting (XSS) via id_generator/classes/SystemSettings.php?f=update_settings, and the point of vulnerability is in the POST parameter 'short_name'. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/DiliLearngent/BugReport/blob/main/php/Online-ID-Generator-System/bug1-XSS-short_name.md
CVE ID: CVE-2024-40075 State: PUBLISHED Published: 2024-07-22T00:00:00 Last Updated: 2024-12-02T17:59:10.651Z Vendors: n/a Products: n/a Problem Types: n/a Description: Laravel v11.x was discovered to contain an XML External Entity (XXE) vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://gitee.com/Q16G/laravel_bug/blob/master/laravelBug.md
CVE ID: CVE-2024-40083 State: PUBLISHED Published: 2024-10-21T00:00:00 Last Updated: 2024-10-22T17:10:57.446Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Buffer Overflow vulnerabilty in the local_app_set_router_token function of Vilo 5 Mesh WiFi System <= 5.16.1.33 allows remote, unauthenticated attackers to execute arbitrary code via sscanf reading the token and timezone JSON fields into a fixed-length buffer. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://vilo.com - https://github.com/byu-cybersecurity-research/vilo/blob/main/vulns/CVE-2024-40083.md
CVE ID: CVE-2024-40084 State: PUBLISHED Published: 2024-10-21T00:00:00 Last Updated: 2024-10-22T17:07:11.530Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Buffer Overflow in the Boa webserver of Vilo 5 Mesh WiFi System <= 5.16.1.33 allows remote, unauthenticated attackers to execute arbitrary code via exceptionally long HTTP methods or paths. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://vilo.com - https://github.com/byu-cybersecurity-research/vilo/blob/main/vulns/CVE-2024-40084.md
CVE ID: CVE-2024-40085 State: PUBLISHED Published: 2024-10-21T00:00:00 Last Updated: 2024-10-22T16:58:08.437Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Buffer Overflow vulnerability in the local_app_set_router_wan function of Vilo 5 Mesh WiFi System <= 5.16.1.33 allows remote, unauthenticated attackers to execute arbitrary code via pppoe_username and pppoe_password fields being larger than 128 bytes in length. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://vilo.com - https://github.com/byu-cybersecurity-research/vilo/blob/main/vulns/CVE-2024-40085.md
CVE ID: CVE-2024-40086 State: PUBLISHED Published: 2024-10-21T00:00:00 Last Updated: 2024-10-22T17:05:43.084Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Buffer Overflow vulnerability in the local_app_set_router_wifi_SSID_PWD function of Vilo 5 Mesh WiFi System <= 5.16.1.33 allows remote, unauthenticated attackers to execute arbitrary code via a password field larger than 64 bytes in length. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://vilo.com - https://github.com/byu-cybersecurity-research/vilo/blob/main/vulns/CVE-2024-40086.md
CVE ID: CVE-2024-40087 State: PUBLISHED Published: 2024-10-21T00:00:00 Last Updated: 2024-10-22T17:04:02.343Z Vendors: n/a Products: n/a Problem Types: n/a Description: Vilo 5 Mesh WiFi System <= 5.16.1.33 is vulnerable to Insecure Permissions. Lack of authentication in the custom TCP service on port 5432 allows remote, unauthenticated attackers to gain administrative access over the router. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://vilo.com - https://github.com/byu-cybersecurity-research/vilo/blob/main/vulns/CVE-2024-40087.md
CVE ID: CVE-2024-40088 State: PUBLISHED Published: 2024-10-21T00:00:00 Last Updated: 2024-10-22T13:46:38.226Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Directory Traversal vulnerability in the Boa webserver of Vilo 5 Mesh WiFi System <= 5.16.1.33 allows remote, unauthenticated attackers to enumerate the existence and length of any file in the filesystem by placing malicious payloads in the path of any HTTP request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://vilo.com - https://github.com/byu-cybersecurity-research/vilo/blob/main/vulns/CVE-2024-40088.md
CVE ID: CVE-2024-40089 State: PUBLISHED Published: 2024-10-21T00:00:00 Last Updated: 2024-10-22T17:00:01.603Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Command Injection vulnerability in Vilo 5 Mesh WiFi System <= 5.16.1.33 allows remote, authenticated attackers to execute arbitrary code by injecting shell commands into the name of the Vilo device. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://vilo.com - https://github.com/byu-cybersecurity-research/vilo/blob/main/vulns/CVE-2024-40089.md
CVE ID: CVE-2024-40090 State: PUBLISHED Published: 2024-10-21T00:00:00 Last Updated: 2024-10-22T16:21:23.812Z Vendors: n/a Products: n/a Problem Types: n/a Description: Vilo 5 Mesh WiFi System <= 5.16.1.33 is vulnerable to Information Disclosure. An information leak in the Boa webserver allows remote, unauthenticated attackers to leak memory addresses of uClibc and the stack via sending a GET request to the index page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://vilo.com - https://github.com/byu-cybersecurity-research/vilo/blob/main/vulns/CVE-2024-40090.md
CVE ID: CVE-2024-40091 State: PUBLISHED Published: 2024-10-21T00:00:00 Last Updated: 2024-10-22T16:16:56.068Z Vendors: n/a Products: n/a Problem Types: n/a Description: Vilo 5 Mesh WiFi System <= 5.16.1.33 lacks authentication in the Boa webserver, which allows remote, unauthenticated attackers to retrieve logs with sensitive system. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://vilo.com - https://github.com/byu-cybersecurity-research/vilo/blob/main/vulns/CVE-2024-40091.md
CVE ID: CVE-2024-40094 State: PUBLISHED Published: 2024-07-30T00:00:00 Last Updated: 2024-11-20T20:13:40.560Z Vendors: n/a Products: n/a Problem Types: n/a Description: GraphQL Java (aka graphql-java) before 21.5 does not properly consider ExecutableNormalizedFields (ENFs) as part of preventing denial of service via introspection queries. 20.9 and 19.11 are also fixed versions. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/graphql-java/graphql-java/releases/tag/v21.5 - https://github.com/graphql-java/graphql-java/releases/tag/v20.9 - https://github.com/graphql-java/graphql-java/releases/tag/v19.11 - https://github.com/graphql-jav
a/releases/tag/v20.9 - https://github.com/graphql-java/graphql-java/releases/tag/v19.11 - https://github.com/graphql-java/graphql-java/commit/97743bc1b5caa2b0bd894dc8e128b47e4d771e4a - https://github.com/graphql-java/graphql-java/discussions/3641 - https://github.com/graphql-java/graphql-java/pull/3539
CVE ID: CVE-2024-40096 State: PUBLISHED Published: 2024-08-05T00:00:00 Last Updated: 2024-10-28T20:36:25.137Z Vendors: n/a Products: n/a Problem Types: n/a Description: The com.cascadialabs.who (aka Who - Caller ID, Spam Block) application 15.0 for Android places sensitive information in the system log. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.quokka.io/critical-vulnerabilities-exploits-cve - https://www.quokka.io/blog/critical-pii-exposure-in-who-caller-id-spam-block-app
CVE ID: CVE-2024-40101 State: PUBLISHED Published: 2024-08-06T00:00:00.000Z Last Updated: 2025-03-25T13:46:34.824Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Reflected Cross-site scripting (XSS) vulnerability exists in '/search' in microweber 2.0.15 and earlier allowing unauthenticated remote attackers to inject arbitrary web script or HTML via the 'keywords' parameter. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://microweber.com - https://seclists.org/fulldisclosure/2024/Aug/1 - https://github.com/microweber/microweber/commit/0dede6886c6df3d1f31c4f4e3ba1ab4a336fbf79
CVE ID: CVE-2024-40110 State: PUBLISHED Published: 2024-07-12T00:00:00 Last Updated: 2024-08-02T04:33:11.609Z Vendors: n/a Products: n/a Problem Types: n/a Description: Sourcecodester Poultry Farm Management System v1.0 contains an Unauthenticated Remote Code Execution (RCE) vulnerability via the productimage parameter at /farm/product.php. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/w3bn00b3r/Unauthenticated-Remote-Code-Execution-RCE---Poultry-Farm-Management-System-v1.0/
CVE ID: CVE-2024-40111 State: PUBLISHED Published: 2024-08-23T00:00:00 Last Updated: 2024-08-26T16:41:30.860Z Vendors: n/a Products: n/a Problem Types: n/a Description: A persistent (stored) cross-site scripting (XSS) vulnerability has been identified in Automad 2.0.0-alpha.4. This vulnerability enables an attacker to inject malicious JavaScript code into the template body. The injected code is stored within the flat file CMS and is executed in the browser of any user visiting the forum. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/w3bn00b3r/Stored-Cross-Site-Scripting-XSS---Automad-2.0.0-alpha.4/ - https://drive.google.com/file/d/10BVQKYo2H1-Nx3FOGteL2
n00b3r/Stored-Cross-Site-Scripting-XSS---Automad-2.0.0-alpha.4/ - https://drive.google.com/file/d/10BVQKYo2H1-Nx3FOGteL2xww4lbZ3xlS/view?usp=sharing
CVE ID: CVE-2024-40112 State: PUBLISHED Published: 2025-06-02T00:00:00.000Z Last Updated: 2025-06-02T19:04:00.383Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Local File Inclusion (LFI) vulnerability exists in Sitecom WLX-2006 Wall Mount Range Extender N300 v1.5 and before, which allows an attacker to manipulate the "language" cookie to include arbitrary files from the server. This vulnerability can be exploited to disclose sensitive information. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://www.sitecomlearningcentre.com/products/wlx-2006v1001/wi-fi-range-extender-n300/downloads - https://github.com/Emm448/vulnerability-research/tree/main/CVE-2024-4
lx-2006v1001/wi-fi-range-extender-n300/downloads - https://github.com/Emm448/vulnerability-research/tree/main/CVE-2024-40112
CVE ID: CVE-2024-40113 State: PUBLISHED Published: 2025-06-02T00:00:00.000Z Last Updated: 2025-06-02T19:34:57.553Z Vendors: n/a Products: n/a Problem Types: n/a Description: Sitecom WLX-2006 Wall Mount Range Extender N300 v.1.5 and before is vulnerable to Use of Default Credentials. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://www.sitecomlearningcentre.com/products/wlx-2006v1001/wi-fi-range-extender-n300/downloads - https://github.com/Emm448/vulnerability-research/tree/main/CVE-2024-40113
CVE ID: CVE-2024-40114 State: PUBLISHED Published: 2025-06-02T00:00:00.000Z Last Updated: 2025-06-02T19:39:28.932Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Cross Site Scripting (XSS) vulnerability in Sitecom WLX-2006 Wall Mount Range Extender N300 v1.5 and before allows an attacker to manipulate the language cookie to inject malicious JavaScript code. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://www.sitecomlearningcentre.com/products/wlx-2006v1001/wi-fi-range-extender-n300/downloads - https://github.com/Emm448/vulnerability-research/tree/main/CVE-2024-40114
CVE ID: CVE-2024-40116 State: PUBLISHED Published: 2024-07-26T00:00:00.000Z Last Updated: 2025-03-26T16:07:40.109Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in Solar-Log 1000 before v2.8.2 and build 52-23.04.2013 was discovered to store plaintext passwords in the export.html, email.html, and sms.html files -- fixed with 3.0.0-60 11.10.2013 for SL 200, 500, 1000 / not existing for SL 250, 300, 1200, 2000, SL 50 Gateway, SL Base. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.solar-log.com/en/support/firmware-database-1 - https://github.com/nepenthe0320/cve_poc/blob/master/Solar-Log%201000%20-%20Unprotected%20Stor
port/firmware-database-1 - https://github.com/nepenthe0320/cve_poc/blob/master/Solar-Log%201000%20-%20Unprotected%20Storage%20of%20Credentials
CVE ID: CVE-2024-40117 State: PUBLISHED Published: 2024-07-26T00:00:00 Last Updated: 2024-11-11T23:05:55.253426 Vendors: n/a Products: n/a Problem Types: n/a Description: Incorrect access control in Solar-Log 1000 before v2.8.2 and build 52- 23.04.2013 allows attackers to obtain Administrative privileges via connecting to the web administration server. Not existing for SL 200, 500, 1000 / fixed in 4.2.8 for SL 250, 300, 1200, 2000, SL 50 Gateway / fixed in 5.1.2 / 6.0.0 for SL Base. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.solar-log.com/en/support/firmware-database-1 - https://github.com/nepenthe0320/cve_poc/blob/master/Solar-Log%2
tps://www.solar-log.com/en/support/firmware-database-1 - https://github.com/nepenthe0320/cve_poc/blob/master/Solar-Log%201000%20-%20Incorrect%20Access%20Control - https://github.com/nepenthe0320/cve_poc/blob/master/CVE-2024-40117
CVE ID: CVE-2024-40119 State: PUBLISHED Published: 2024-07-17T00:00:00 Last Updated: 2024-08-02T04:33:11.610Z Vendors: n/a Products: n/a Problem Types: n/a Description: Nepstech Wifi Router xpon (terminal) model NTPL-Xpon1GFEVN v.1.0 Firmware V2.0.1 contains a Cross-Site Request Forgery (CSRF) vulnerability in the password change function, which allows remote attackers to change the admin password without the user's consent, leading to a potential account takeover. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/sudo-subho/nepstech-xpon-router-CVE-2024-40119
CVE ID: CVE-2024-40120 State: PUBLISHED Published: 2025-05-16T00:00:00.000Z Last Updated: 2025-05-16T15:11:00.736Z Vendors: n/a Products: n/a Problem Types: n/a Description: seaweedfs v3.68 was discovered to contain a SQL injection vulnerability via the component /abstract_sql/abstract_sql_store.go. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/seaweedfs/seaweedfs/issues/5710 - https://gist.github.com/sud0why/1b2115c1d644bd3db1c1b3f16684a78c
CVE ID: CVE-2024-40124 State: PUBLISHED Published: 2025-04-17T00:00:00.000Z Last Updated: 2025-04-18T15:09:19.107Z Vendors: n/a Products: n/a Problem Types: n/a Description: Pydio Core <= 8.2.5 is vulnerable to Cross Site Scripting (XSS) via the New URL Bookmark feature. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gist.github.com/Xib3rR4dAr/711195d5793bfbb4364dc179ecaae25d - https://pydio.com/en/community/releases/pydio-core/pydio-core-pydio-enterprise-825-hotfix-824
CVE ID: CVE-2024-40125 State: PUBLISHED Published: 2024-09-19T00:00:00 Last Updated: 2024-09-20T13:00:18.058Z Vendors: n/a Products: n/a Problem Types: n/a Description: An arbitrary file upload vulnerability in the Media Manager function of Closed-Loop Technology CLESS Server v4.5.2 allows attackers to execute arbitrary code via uploading a crafted PHP file to the upload endpoint. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.closed-loop.biz/ - https://github.com/brendontkl/My-CVEs/tree/main/CVE-2024-40125
CVE ID: CVE-2024-40129 State: PUBLISHED Published: 2024-07-16T00:00:00 Last Updated: 2024-08-02T04:33:11.502Z Vendors: n/a Products: n/a Problem Types: n/a Description: Open5GS v2.6.4 is vulnerable to Buffer Overflow. via /lib/pfcp/context.c. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/open5gs/open5gs/issues/2585 - https://github.com/open5gs/open5gs/commit/2fbc445d32aa7749166396a9c055a199f90a1b01
CVE ID: CVE-2024-40130 State: PUBLISHED Published: 2024-07-16T00:00:00 Last Updated: 2024-08-02T04:33:11.654Z Vendors: n/a Products: n/a Problem Types: n/a Description: open5gs v2.6.4 is vulnerable to Buffer Overflow. via /lib/core/abts.c. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/open5gs/open5gs/issues/2577 - https://github.com/open5gs/open5gs/commit/2f8ae91b0b9467f94f128090c88cae91bd73e008
CVE ID: CVE-2024-40137 State: PUBLISHED Published: 2024-07-24T00:00:00 Last Updated: 2024-08-02T04:33:11.524Z Vendors: n/a Products: n/a Problem Types: n/a Description: Dolibarr ERP CRM before 19.0.2-php8.2 was discovered to contain a remote code execution (RCE) vulnerability via the Computed field parameter under the Users Module Setup function. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/c0d3x27/CVEs/tree/main/CVE-2024-40137
CVE ID: CVE-2024-40239 State: PUBLISHED Published: 2024-11-08T00:00:00 Last Updated: 2024-11-13T15:11:11.692Z Vendors: n/a Products: n/a Problem Types: n/a Description: An incorrect access control issue in Life: Personal Diary, Journal android app 17.5.0 allows a physically proximate attacker to escalate privileges via the fingerprint authentication function. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://play.google.com/store/apps/details?id=com.hitbytes.minidiarynotes - https://zzzxiin.github.io/post/life-personal-diary/
CVE ID: CVE-2024-40240 State: PUBLISHED Published: 2024-11-08T00:00:00 Last Updated: 2024-11-13T15:16:15.128Z Vendors: n/a Products: n/a Problem Types: n/a Description: An incorrect access control issue in HomeServe Home Repair' android app - 3.3.4 allows a physically proximate attacker to escalate privileges via the fingerprint authentication function. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://homeserve.com - https://apkpure.com/homeserve-home-repair/com.homeserveapp.homeserve - https://zzzxiin.github.io/post/homeserve/
CVE ID: CVE-2024-40318 State: PUBLISHED Published: 2024-07-25T00:00:00 Last Updated: 2024-08-02T04:33:11.645Z Vendors: n/a Products: n/a Problem Types: n/a Description: An arbitrary file upload vulnerability in Webkul Qloapps v1.6.0.0 allows attackers to execute arbitrary code via uploading a crafted file. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/3v1lC0d3/RCE-QloApps/blob/main/qloapps--RCE.pdf
CVE ID: CVE-2024-40322 State: PUBLISHED Published: 2024-07-16T00:00:00 Last Updated: 2024-08-02T04:33:11.547Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in JFinalCMS v.5.0.0. There is a SQL injection vulnerablity via /admin/div_data/data Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/KakeruJ/CVE/blob/main/JFinalCMS_SQL.md
CVE ID: CVE-2024-40324 State: PUBLISHED Published: 2024-07-25T00:00:00 Last Updated: 2024-08-02T04:33:11.656Z Vendors: n/a Products: n/a Problem Types: n/a Description: A CRLF injection vulnerability in E-Staff v5.1 allows attackers to insert Carriage Return (CR) and Line Feed (LF) characters into input fields, leading to HTTP response splitting and header manipulation. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/aleksey-vi/CVE-2024-40324
CVE ID: CVE-2024-40328 State: PUBLISHED Published: 2024-07-10T00:00:00 Last Updated: 2024-08-02T04:33:11.664Z Vendors: n/a Products: n/a Problem Types: n/a Description: idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/memberOnline_deal.php?mudi=del&dataType=&dataID=6 Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/Tank992/cms/blob/main/70/csrf.md
CVE ID: CVE-2024-40329 State: PUBLISHED Published: 2024-07-10T00:00:00 Last Updated: 2024-08-02T04:33:11.667Z Vendors: n/a Products: n/a Problem Types: n/a Description: idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/softBak_deal.php?mudi=backup Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/Tank992/cms/blob/main/67/csrf.md
CVE ID: CVE-2024-40331 State: PUBLISHED Published: 2024-07-10T00:00:00 Last Updated: 2024-08-02T04:33:11.557Z Vendors: n/a Products: n/a Problem Types: n/a Description: idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/dbBakMySQL_deal.php?mudi=backup Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/Tank992/cms/blob/main/66/csrf.md
CVE ID: CVE-2024-40332 State: PUBLISHED Published: 2024-07-10T00:00:00 Last Updated: 2024-08-02T04:33:11.646Z Vendors: n/a Products: n/a Problem Types: n/a Description: idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/moneyRecord_deal.php?mudi=delRecord Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/Tank992/cms/blob/main/65/csrf.md
CVE ID: CVE-2024-40333 State: PUBLISHED Published: 2024-07-10T00:00:00 Last Updated: 2024-08-02T04:33:11.574Z Vendors: n/a Products: n/a Problem Types: n/a Description: idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/softBak_deal.php?mudi=del&dataID=2 Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/Tank992/cms/blob/main/68/csrf.md
CVE ID: CVE-2024-40334 State: PUBLISHED Published: 2024-07-10T00:00:00 Last Updated: 2024-08-02T04:33:11.647Z Vendors: n/a Products: n/a Problem Types: n/a Description: idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/serverFile_deal.php?mudi=upFileDel&dataID=3 Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/Tank992/cms/blob/main/69/csrf.md
CVE ID: CVE-2024-40336 State: PUBLISHED Published: 2024-07-10T00:00:00 Last Updated: 2024-08-02T04:33:11.668Z Vendors: n/a Products: n/a Problem Types: n/a Description: idccms v1.35 is vulnerable to Cross Site Scripting (XSS) within the 'Image Advertising Management.' Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/Tank992/cms/blob/main/73/readme.md
CVE ID: CVE-2024-40347 State: PUBLISHED Published: 2024-07-20T00:00:00.000Z Last Updated: 2025-03-18T14:15:38.612Z Vendors: n/a Products: n/a Problem Types: n/a Description: A reflected cross-site scripting (XSS) vulnerability in Hyland Alfresco Platform 23.2.1-r96 allows attackers to execute arbitrary code in the context of a user's browser via injecting a crafted payload into the parameter htmlid. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/4rdr/proofs/blob/main/info/Alfresco_Reflected_XSS_via_htmlid_parameter.md
CVE ID: CVE-2024-40348 State: PUBLISHED Published: 2024-07-20T00:00:00 Last Updated: 2024-08-02T04:33:11.569Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in the component /api/swaggerui/static of Bazaar v1.4.3 allows unauthenticated attackers to execute a directory traversal. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/4rdr/proofs/blob/main/info/Bazaar_1.4.3_File_Traversal_via_Filename.md
CVE ID: CVE-2024-40391 State: REJECTED Published: N/A Last Updated: 2024-12-03T21:53:48.758381 Description: No description available.
CVE ID: CVE-2024-40392 State: PUBLISHED Published: 2024-07-16T00:00:00 Last Updated: 2024-08-02T04:33:11.519Z Vendors: n/a Products: n/a Problem Types: n/a Description: SourceCodester Pharmacy/Medical Store Point of Sale System Using PHP/MySQL and Bootstrap Framework with Source Code 1.0 was discovered to contain a SQL injection vulnerability via the name parameter under addnew.php. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/CveSecLook/cve/issues/46