Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-10351 State: PUBLISHED Published: 2024-10-24T23:31:11.527Z Last Updated: 2024-10-25T20:50:14.294Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C) Vendors: Tenda Products: RX9 Pro Problem Types: CWE-121 Description: A vulnerability was found in Tenda RX9 Pro 22.03.02.20. It has been rated as critical. This issue affects the function sub_424CE0 of the file /goform/setMacFilterCfg of the component POST Request Handler. The manipulation of the argument deviceList leads to stack-based buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.
disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.281699 - https://vuldb.com/?ctiid.281699 - https://vuldb.com/?submit.427706 - https://gitee.com/GXB0_0/iot-vul/blob/master/Tenda/RX9/20/setMacFilterCfg.md - https://www.tenda.com.cn/
CVE ID: CVE-2024-10352 State: PUBLISHED Published: 2024-11-09T11:38:25.510Z Last Updated: 2024-11-11T16:09:51.264Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: nalam-1 Products: Magical Addons For Elementor ( Header Footer Builder, Free Elementor Widgets, Elementor Templates Library ) Problem Types: CWE-200 Description: The Magical Addons For Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.2.4 via the get_content_type function in includes/widgets/content-reveal.php. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensitive private
his makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensitive private, pending, and draft template data. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/8aa2ba7f-c33d-4e80-b1cf-2d7b2a497f04?source=cve - https://plugins.trac.wordpress.org/changeset/3182827/magical-addons-for-elementor
CVE ID: CVE-2024-10353 State: PUBLISHED Published: 2024-10-24T23:31:14.842Z Last Updated: 2024-10-25T18:07:29.067Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: SourceCodester Products: Online Exam System Problem Types: CWE-284 Description: A vulnerability classified as critical has been found in SourceCodester Online Exam System 1.0. Affected is an unknown function of the file /admin-dashboard. The manipulation leads to improper access controls. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. This affects a different product and is a different issue than CVE-2024-40480. Additional Analyst Notes: - CISA ADP Vulnrichme
ffects a different product and is a different issue than CVE-2024-40480. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.281700 - https://vuldb.com/?ctiid.281700 - https://vuldb.com/?submit.427957 - https://drive.google.com/file/d/1hEXfbOOkWdYzaSI6ORQvPGBtn09R12Ui/view?usp=drive_link - https://www.sourcecodester.com/
CVE ID: CVE-2024-10354 State: PUBLISHED Published: 2024-10-25T00:00:07.014Z Last Updated: 2024-10-25T19:59:33.855Z Severity: N/A (CVSS 5.8 AV:N/AC:L/Au:M/C:P/I:P/A:P) Vendors: SourceCodester Products: Petrol Pump Management Software Problem Types: CWE-89 Description: A vulnerability classified as critical was found in SourceCodester Petrol Pump Management Software 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/print.php. The manipulation of the argument id leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.c
isclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.281701 - https://vuldb.com/?ctiid.281701 - https://vuldb.com/?submit.430074 - https://github.com/K1nako0/tmp_vuln3/blob/main/README.md - https://www.sourcecodester.com/
CVE ID: CVE-2024-10355 State: PUBLISHED Published: 2024-10-25T00:00:09.560Z Last Updated: 2024-10-25T19:58:37.030Z Severity: N/A (CVSS 5.8 AV:N/AC:L/Au:M/C:P/I:P/A:P) Vendors: SourceCodester Products: Petrol Pump Management Software Problem Types: CWE-89 Description: A vulnerability, which was classified as critical, has been found in SourceCodester Petrol Pump Management Software 1.0. Affected by this issue is some unknown functionality of the file /admin/invoice.php. The manipulation of the argument id leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - ht
it has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.281702 - https://vuldb.com/?ctiid.281702 - https://vuldb.com/?submit.430077 - https://github.com/K1nako0/tmp_vuln4/blob/main/README.md - https://www.sourcecodester.com/
CVE ID: CVE-2024-10356 State: PUBLISHED Published: 2024-12-17T12:43:38.479Z Last Updated: 2024-12-17T17:28:56.942Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: quomodosoft Products: ElementsReady Addons for Elementor Problem Types: CWE-200 Description: The ElementsReady Addons for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 6.4.8 in inc/Widgets/accordion/output/content.php. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensitive private, pending, and draft template data. Additional Analyst Notes: - CISA ADP Vulnrichment: Refer
to extract sensitive private, pending, and draft template data. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/b0a48c91-7e2c-4708-b5af-dfbcfea08f83?source=cve - https://plugins.trac.wordpress.org/changeset/3204333/element-ready-lite
CVE ID: CVE-2024-10357 State: PUBLISHED Published: 2024-10-26T09:35:21.626Z Last Updated: 2024-10-28T18:28:00.896Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: zootemplate Products: Clever Addons for Elementor Problem Types: CWE-200 Description: The Clever Addons for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.2.1 via the getTemplateContent function in src/widgets/class-clever-widget-base.php. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensitive private, pending, and draft template data. Additional Analyst Notes: - CISA A
vel access and above, to extract sensitive private, pending, and draft template data. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/e1fa3569-9a9a-4aa6-9057-c87601fadb9f?source=cve - https://plugins.trac.wordpress.org/browser/cafe-lite/trunk/src/widgets/class-clever-widget-base.php#L411
CVE ID: CVE-2024-10359 State: PUBLISHED Published: 2025-03-20T10:10:44.510Z Last Updated: 2025-03-20T18:17:28.379Z Severity: MEDIUM (CVSS 4.6 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N) Vendors: danny-avila Products: danny-avila/librechat Problem Types: CWE-915 Description: In danny-avila/librechat version v0.7.5-rc2, a vulnerability exists in the preset creation functionality where a user can manipulate the user ID field through mass assignment. This allows an attacker to inject a different user ID into the preset object, causing the preset to appear in the UI of another user. The vulnerability arises because the backend saves the entire object received without validating the attributes a
user. The vulnerability arises because the backend saves the entire object received without validating the attributes and their values, impacting both integrity and confidentiality. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/bba65eb4-4c83-4f33-83c1-ede5ed0d5656 - https://github.com/danny-avila/librechat/commit/e3e52402f69accc35c6d0acd9c3266ae1cb6333f
CVE ID: CVE-2024-10360 State: PUBLISHED Published: 2024-10-29T11:01:36.072Z Last Updated: 2024-10-29T14:50:18.357Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: moveaddons Products: Move Addons for Elementor Problem Types: CWE-200 Description: The Move Addons for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.3.5 via the render function in includes/widgets/accordion/widget.php, includes/widgets/remote-template/widget.php, and other widget.php files. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensitive private, pending, and dr
ible for authenticated attackers, with Contributor-level access and above, to extract sensitive private, pending, and draft template data. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/eafe73b4-b492-45c7-adca-d9a3042144b4?source=cve - https://plugins.trac.wordpress.org/changeset/3176341/move-addons
CVE ID: CVE-2024-10361 State: PUBLISHED Published: 2025-03-20T10:09:09.995Z Last Updated: 2025-10-15T12:50:08.542Z Severity: HIGH (CVSS 8.1 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H) Vendors: danny-avila Products: danny-avila/librechat Problem Types: CWE-22 Description: An arbitrary file deletion vulnerability exists in danny-avila/librechat version v0.7.5-rc2, specifically within the /api/files endpoint. This vulnerability arises from improper input validation, allowing path traversal techniques to delete arbitrary files on the server. Attackers can exploit this to bypass security mechanisms and delete files outside the intended directory, including critical system files, user data, or a
ss security mechanisms and delete files outside the intended directory, including critical system files, user data, or application resources. This vulnerability impacts the integrity and availability of the system. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/e811f7f7-9556-4564-82e2-5b3d17599b2d - https://github.com/danny-avila/librechat/commit/0b744db1e2af31a531ffb761584d85540430639c
CVE ID: CVE-2024-10362 State: PUBLISHED Published: 2025-05-15T20:06:42.846Z Last Updated: 2025-05-20T19:40:56.206Z Vendors: Unknown Products: Social Media Share Buttons & Social Sharing Icons Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Social Media Share Buttons & Social Sharing Icons WordPress plugin before 2.9.1 does not sanitize and escape some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/701f653b-a0c3-49b4-972e-f
itional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/701f653b-a0c3-49b4-972e-f26c3633ad92/
CVE ID: CVE-2024-10363 State: PUBLISHED Published: 2025-03-20T10:10:19.050Z Last Updated: 2025-10-15T12:49:26.990Z Severity: MEDIUM (CVSS 5.4 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) Vendors: danny-avila Products: danny-avila/librechat Problem Types: CWE-862 Description: In version 0.7.5 of danny-avila/LibreChat, there is an improper access control vulnerability. Users can share, use, and create prompts without being granted permission by the admin. This can break application logic and permissions, allowing unauthorized actions. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/41a1137d-e725-4fec-b04c-58555cb16b6b - https://github.com/danny-avil
nrichment: References: - https://huntr.com/bounties/41a1137d-e725-4fec-b04c-58555cb16b6b - https://github.com/danny-avila/librechat/commit/42a4d02c62e2a6cf677d1cb6cfcb36d136aaa599
CVE ID: CVE-2024-10365 State: PUBLISHED Published: 2024-11-20T06:42:57.155Z Last Updated: 2024-11-20T15:26:29.040Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: posimyththemes Products: The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce Problem Types: CWE-200 Description: The The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 6.0.3 via the render function in modules/widgets/tp_carousel_anything.php, modules/widgets/tp_page_scroll.php, and other widgets. This
ender function in modules/widgets/tp_carousel_anything.php, modules/widgets/tp_page_scroll.php, and other widgets. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensitive private, pending, and draft template data. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/f7ce1d19-25fa-434d-943b-d10c5cb2ec51?source=cve - https://plugins.trac.wordpress.org/changeset/3186482/the-plus-addons-for-elementor-page-builder
CVE ID: CVE-2024-10366 State: PUBLISHED Published: 2025-03-20T10:09:37.556Z Last Updated: 2025-07-15T10:48:56.156Z Severity: HIGH (CVSS 7.6 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L) Vendors: danny-avila Products: danny-avila/librechat Problem Types: CWE-639 Description: An improper access control vulnerability (IDOR) exists in the delete attachments functionality of danny-avila/librechat version v0.7.5-rc2. The endpoint does not verify whether the provided attachment ID belongs to the current user, allowing any authenticated user to delete attachments of other users. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/cde47cf8-dc81-46ab-b472-f7e44a
ditional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/cde47cf8-dc81-46ab-b472-f7e44a981a7e - https://github.com/danny-avila/librechat/commit/a350443661d001ac55787741969a75d94ca14116
CVE ID: CVE-2024-10367 State: PUBLISHED Published: 2024-11-01T11:01:55.530Z Last Updated: 2024-11-01T13:13:06.416Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: themeisle Products: Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE Problem Types: CWE-79 Description: The Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE plugin for WordPress is vulnerable to Stored Cross-Site Scripting via REST API SVG File uploads in all versions up to, and including, 3.0.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject
and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/9d83c085-b33a-4003-9e0a-8457669d6634?source=cve - https://wordpress.org/plugins/otter-blocks/#developers - https://plugins.trac.wordpress.org/changeset/3178637/
CVE ID: CVE-2024-10368 State: PUBLISHED Published: 2024-10-25T01:00:11.219Z Last Updated: 2024-10-25T18:39:34.923Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: Codezips Products: Sales Management System Problem Types: CWE-89 Description: A vulnerability was found in Codezips Sales Management System 1.0. It has been classified as critical. Affected is an unknown function of the file /addstock.php. The manipulation of the argument prodtype leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.281760 - https://vuldb.
be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.281760 - https://vuldb.com/?ctiid.281760 - https://vuldb.com/?submit.430114 - https://github.com/ppp-src/CVE/issues/17
CVE ID: CVE-2024-10369 State: PUBLISHED Published: 2024-10-25T01:00:12.981Z Last Updated: 2024-10-25T20:48:38.100Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: Codezips Products: Sales Management System Problem Types: CWE-89 Description: A vulnerability was found in Codezips Sales Management System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /addcustcom.php. The manipulation of the argument refno leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.281761 -
public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.281761 - https://vuldb.com/?ctiid.281761 - https://vuldb.com/?submit.430115 - https://github.com/ppp-src/CVE/issues/18
CVE ID: CVE-2024-10370 State: PUBLISHED Published: 2024-10-25T01:31:04.417Z Last Updated: 2024-10-25T20:47:38.848Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: Codezips Products: Sales Management System Problem Types: CWE-89 Description: A vulnerability was found in Codezips Sales Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /addcustind.php. The manipulation of the argument refno leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.281762 - https://
nd may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.281762 - https://vuldb.com/?ctiid.281762 - https://vuldb.com/?submit.430607 - https://github.com/ppp-src/CVE/issues/19
CVE ID: CVE-2024-10371 State: PUBLISHED Published: 2024-10-25T01:31:06.510Z Last Updated: 2024-10-25T18:06:12.245Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: SourceCodester Products: Payroll Management System Problem Types: CWE-120 Description: A vulnerability classified as critical has been found in SourceCodester Payroll Management System 1.0. This affects the function login of the file main. The manipulation leads to buffer overflow. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.281763 - https://vuldb.com/?ctiid.281763 - https://vuldb.com/?submit.43
ulnrichment: References: - https://vuldb.com/?id.281763 - https://vuldb.com/?ctiid.281763 - https://vuldb.com/?submit.430175 - https://github.com/CveSecLook/cve/issues/63 - https://www.sourcecodester.com/
CVE ID: CVE-2024-10372 State: PUBLISHED Published: 2024-10-25T02:00:06.067Z Last Updated: 2024-10-25T20:46:53.609Z Severity: MEDIUM (CVSS 4.5 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: chidiwilliams Products: buzz Problem Types: CWE-377 Description: A vulnerability classified as problematic was found in chidiwilliams buzz 1.1.0. This vulnerability affects the function download_model of the file buzz/model_loader.py. The manipulation leads to insecure temporary file. It is possible to launch the attack on the local host. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The vendor was
. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.281764 - https://vuldb.com/?ctiid.281764 - https://vuldb.com/?submit.425441 - https://github.com/Startr4ck/CVE_lists/blob/main/buzz/Insecure%20Temporary%20File%20in%20BUZZ.md
CVE ID: CVE-2024-10374 State: PUBLISHED Published: 2024-10-25T11:36:09.533Z Last Updated: 2024-10-25T15:16:27.376Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: cbutlerjr Products: WP-Members Membership Plugin Problem Types: CWE-79 Description: The WP-Members Membership Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wpmem_loginout shortcode in all versions up to, and including, 3.4.9.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will
or authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/5ea93a49-0e1a-4a24-8f6b-03e624f517d4?source=cve - https://wordpress.org/plugins/wp-members/#developers - https://plugins.trac.wordpress.org/changeset/3172530/
CVE ID: CVE-2024-10376 State: PUBLISHED Published: 2024-10-25T11:00:10.546Z Last Updated: 2024-10-25T18:52:13.349Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: ESAFENET Products: CDG Problem Types: CWE-89 Description: A vulnerability was found in ESAFENET CDG 5. It has been declared as critical. This vulnerability affects the function actionPassOrNotAutoSign of the file /com/esafenet/servlet/service/processsign/AutoSignService.java. The manipulation of the argument UniqueId leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any w
sclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.281806 - https://vuldb.com/?ctiid.281806 - https://vuldb.com/?submit.426083 - https://flowus.cn/share/127494ce-0d4c-4773-9fc0-810e26841c4b?code=G8A6P3
CVE ID: CVE-2024-10377 State: PUBLISHED Published: 2024-10-25T11:00:14.253Z Last Updated: 2024-10-25T18:51:59.393Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: ESAFENET Products: CDG Problem Types: CWE-89 Description: A vulnerability was found in ESAFENET CDG 5. It has been rated as critical. This issue affects the function actionPassDecryptApplication1 of the file /com/esafenet/servlet/client/DecryptApplicationService.java. The manipulation of the argument id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. This is a different issue than CVE-2024-10069. The vendor was contacted early about this disclo
public and may be used. This is a different issue than CVE-2024-10069. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.281807 - https://vuldb.com/?ctiid.281807 - https://vuldb.com/?submit.426085 - https://flowus.cn/share/1234f712-c774-4a26-a922-809e0a356405?code=G8A6P3