Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-54674 State: PUBLISHED Published: 2024-12-04T00:00:00 Last Updated: 2024-12-05T19:03:58.512Z Vendors: n/a Products: n/a Problem Types: n/a Description: app/View/GalaxyClusters/cluster_export_misp_galaxy.ctp in MISP through 2.5.2 has stored XSS when exporting custom clusters into the misp-galaxy format. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/MISP/MISP/commit/d0330989e235a8a9f43c90817896de87a589ef7d
CVE ID: CVE-2024-54675 State: PUBLISHED Published: 2024-12-04T00:00:00 Last Updated: 2024-12-05T19:02:48.824Z Vendors: n/a Products: n/a Problem Types: n/a Description: app/webroot/js/workflows-editor/workflows-editor.js in MISP through 2.5.2 has stored XSS in the editor interface for an ad-hoc workflow. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/MISP/MISP/commit/e02c2b864a85d14d64adf9f878f9c7b2bdd15173
CVE ID: CVE-2024-54676 State: PUBLISHED Published: 2025-01-08T08:40:03.705Z Last Updated: 2025-01-08T14:00:52.923Z Vendors: Apache Software Foundation Products: Apache OpenMeetings Problem Types: CWE-502 Description: Vendor: The Apache Software Foundation Versions Affected: Apache OpenMeetings from 2.1.0 before 8.0.0 Description: Default clustering instructions at https://openmeetings.apache.org/Clustering.html doesn't specify white/black lists for OpenJPA this leads to possible deserialisation of untrusted data. Users are recommended to upgrade to version 8.0.0 and update their startup scripts to include the relevant 'openjpa.serialization.class.blacklist' and 'openjpa.serialization.class.w
their startup scripts to include the relevant 'openjpa.serialization.class.blacklist' and 'openjpa.serialization.class.whitelist' configurations as shown in the documentation. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://lists.apache.org/thread/o0k05jxrt5tp4nm45lj14yfjxmg67m95
CVE ID: CVE-2024-54677 State: PUBLISHED Published: 2024-12-17T12:35:50.948Z Last Updated: 2025-11-03T19:32:11.848Z Vendors: Apache Software Foundation Products: Apache Tomcat Problem Types: CWE-400 Description: Uncontrolled Resource Consumption vulnerability in the examples web application provided with Apache Tomcat leads to denial of service. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.1, from 10.1.0-M1 through 10.1.33, from 9.0.0.M1 through 9.9.97. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions may also be affected. Users are recommended to upgrade to version 11.0.2, 10.1.34 o
8.5.100. Other, older, EOL versions may also be affected. Users are recommended to upgrade to version 11.0.2, 10.1.34 or 9.0.98, which fixes the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://lists.apache.org/thread/tdtbbxpg5trdwc2wnopcth9ccvdftq2n
CVE ID: CVE-2024-54678 State: PUBLISHED Published: 2025-08-12T11:16:53.387Z Last Updated: 2025-10-14T09:15:07.708Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H) Vendors: Siemens Products: SIMATIC PCS neo V4.1, SIMATIC PCS neo V5.0, SIMATIC PCS neo V6.0, SIMATIC S7-PLCSIM V17, SIMATIC STEP 7 V17, SIMATIC STEP 7 V18, SIMATIC STEP 7 V19, SIMATIC STEP 7 V20, SIMATIC WinCC V17, SIMATIC WinCC V18, SIMATIC WinCC V19, SIMATIC WinCC V20, SIMOCODE ES V17, SIMOCODE ES V18, SIMOCODE ES V19, SIMOCODE ES V20, SIMOTION SCOUT TIA V5.4, SIMOTION SCOUT TIA V5.5, SIMOTION SCOUT TIA V5.6, SIMOTION SCOUT TIA V5.7, SINAMICS Startdrive V17, SINAMICS Startdrive V18, SINAMICS Startdrive V19,
TION SCOUT TIA V5.6, SIMOTION SCOUT TIA V5.7, SINAMICS Startdrive V17, SINAMICS Startdrive V18, SINAMICS Startdrive V19, SINAMICS Startdrive V20, SIRIUS Safety ES V17 (TIA Portal), SIRIUS Safety ES V18 (TIA Portal), SIRIUS Safety ES V19 (TIA Portal), SIRIUS Safety ES V20 (TIA Portal), SIRIUS Soft Starter ES V17 (TIA Portal), SIRIUS Soft Starter ES V18 (TIA Portal), SIRIUS Soft Starter ES V19 (TIA Portal), SIRIUS Soft Starter ES V20 (TIA Portal), TIA Portal Cloud V17, TIA Portal Cloud V18, TIA Portal Cloud V19, TIA Portal Cloud V20, TIA Portal Test Suite V20 Problem Types: CWE-502 Description: A vulnerability has been identified in SIMATIC PCS neo V4.1 (All versions), SIMATIC PCS neo V5.0 (Al
WE-502 Description: A vulnerability has been identified in SIMATIC PCS neo V4.1 (All versions), SIMATIC PCS neo V5.0 (All versions), SIMATIC PCS neo V6.0 (All versions), SIMATIC S7-PLCSIM V17 (All versions), SIMATIC STEP 7 V17 (All versions), SIMATIC STEP 7 V18 (All versions), SIMATIC STEP 7 V19 (All versions < V19 Update 4), SIMATIC STEP 7 V20 (All versions < V20 Update 4), SIMATIC WinCC V17 (All versions), SIMATIC WinCC V18 (All versions), SIMATIC WinCC V19 (All versions < V19 Update 4), SIMATIC WinCC V20 (All versions < V20 Update 4), SIMOCODE ES V17 (All versions), SIMOCODE ES V18 (All versions), SIMOCODE ES V19 (All versions), SIMOCODE ES V20 (All versions), SIMOTION SCOUT TIA V5.4 (All
CODE ES V18 (All versions), SIMOCODE ES V19 (All versions), SIMOCODE ES V20 (All versions), SIMOTION SCOUT TIA V5.4 (All versions), SIMOTION SCOUT TIA V5.5 (All versions), SIMOTION SCOUT TIA V5.6 (All versions < V5.6 SP1 HF7), SIMOTION SCOUT TIA V5.7 (All versions), SINAMICS Startdrive V17 (All versions), SINAMICS Startdrive V18 (All versions), SINAMICS Startdrive V19 (All versions), SINAMICS Startdrive V20 (All versions), SIRIUS Safety ES V17 (TIA Portal) (All versions), SIRIUS Safety ES V18 (TIA Portal) (All versions), SIRIUS Safety ES V19 (TIA Portal) (All versions), SIRIUS Safety ES V20 (TIA Portal) (All versions), SIRIUS Soft Starter ES V17 (TIA Portal) (All versions), SIRIUS Soft Start
IUS Safety ES V20 (TIA Portal) (All versions), SIRIUS Soft Starter ES V17 (TIA Portal) (All versions), SIRIUS Soft Starter ES V18 (TIA Portal) (All versions), SIRIUS Soft Starter ES V19 (TIA Portal) (All versions), SIRIUS Soft Starter ES V20 (TIA Portal) (All versions), TIA Portal Cloud V17 (All versions), TIA Portal Cloud V18 (All versions), TIA Portal Cloud V19 (All versions < V5.2.1.1), TIA Portal Cloud V20 (All versions < V5.2.2.2), TIA Portal Test Suite V20 (All versions < V20 Update 4). Affected products do not properly sanitize Interprocess Communication input received through a Windows Named Pipe accessible to all local users. This could allow an authenticated local attacker to cause
ed through a Windows Named Pipe accessible to all local users. This could allow an authenticated local attacker to cause a type confusion and execute arbitrary code within the affected application. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/html/ssa-693808.html
CVE ID: CVE-2024-54679 State: PUBLISHED Published: 2024-12-05T00:00:00 Last Updated: 2024-12-06T15:02:20.712124Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AC:L/AV:N/A:L/C:N/I:N/PR:L/S:U/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: CyberPanel (aka Cyber Panel) before 6778ad1 does not require the FilemanagerAdmin capability for restartMySQL actions. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cyberpanel.net/ - https://github.com/usmannasir/cyberpanel/commit/6778ad1eaae41f72365da8fd021f9a60369600dc - https://github.com/hotplugin0x01/CVE-2024-54679
CVE ID: CVE-2024-54680 State: REJECTED Published: 2025-01-11T12:35:43.170Z Last Updated: 2025-04-02T15:20:35.748Z Description: No description available.
CVE ID: CVE-2024-54681 State: PUBLISHED Published: 2025-01-17T16:46:40.813Z Last Updated: 2025-01-21T16:40:59.307Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L) Vendors: Ossur Products: Mobile Logic Application Problem Types: CWE-77 Description: Multiple bash files were present in the application's private directory. Bash files can be used on their own, by an attacker that has already full access to the mobile platform to compromise the translations for the application. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-medical-advisories/icsma-24-354-01
CVE ID: CVE-2024-54682 State: PUBLISHED Published: 2024-12-16T08:03:44.318Z Last Updated: 2024-12-16T16:03:22.685Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: Mattermost Products: Mattermost Problem Types: CWE-409 Description: Mattermost versions 10.1.x <= 10.1.2, 10.0.x <= 10.0.2, 9.11.x <= 9.11.4, 9.5.x <= 9.5.12 fail to limit the file size for slack import file uploads which allows a user to cause a DoS via zip bomb by importing data in a team they are a team admin. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://mattermost.com/security-updates
CVE ID: CVE-2024-54683 State: PUBLISHED Published: 2025-01-11T12:29:54.407Z Last Updated: 2025-10-01T19:57:21.581Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: netfilter: IDLETIMER: Fix for possible ABBA deadlock Deletion of the last rule referencing a given idletimer may happen at the same time as a read of its file in sysfs: | ====================================================== | WARNING: possible circular locking dependency detected | 6.12.0-rc7-01692-g5e9a28f41134-dirty #594 Not tainted | ------------------------------------------------------ | iptables/3303 is trying to acquire lock: | ffff8881057e04b8 (kn->active#48)
------------------------------------------ | iptables/3303 is trying to acquire lock: | ffff8881057e04b8 (kn->active#48){++++}-{0:0}, at: __kernfs_remove+0x20 | | but task is already holding lock: | ffffffffa0249068 (list_mutex){+.+.}-{3:3}, at: idletimer_tg_destroy_v] | | which lock already depends on the new lock. A simple reproducer is: | #!/bin/bash | | while true; do | iptables -A INPUT -i foo -j IDLETIMER --timeout 10 --label "testme" | iptables -D INPUT -i foo -j IDLETIMER --timeout 10 --label "testme" | done & | while true; do | cat /sys/class/xt_idletimer/timers/testme >/dev/null | done Avoid this by freeing list_mutex right after deleting the element from the list, then continuing
stme >/dev/null | done Avoid this by freeing list_mutex right after deleting the element from the list, then continuing with the teardown. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/8c2c8445cda8f59c38dec7dc10509bcb23ae26a0 - https://git.kernel.org/stable/c/45fe76573a2557f632e248cc141342233f422b9a - https://git.kernel.org/stable/c/f36b01994d68ffc253c8296e2228dfe6e6431c03
CVE ID: CVE-2024-54687 State: PUBLISHED Published: 2025-01-10T00:00:00 Last Updated: 2025-01-13T20:05:45.029Z Vendors: n/a Products: n/a Problem Types: n/a Description: Vtiger CRM v.6.1 and before is vulnerable to Cross Site Scripting (XSS) via the Documents module and function uploadAndSaveFile in CRMEntity.php. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://andrea0.medium.com - https://andrea0.medium.com/analysis-of-cve-2024-54687-9d82f4c0eaa8
CVE ID: CVE-2024-54724 State: PUBLISHED Published: 2025-01-09T00:00:00 Last Updated: 2025-01-21T15:25:31.722Z Vendors: n/a Products: n/a Problem Types: n/a Description: PHPYun before 7.0.2 is vulnerable to code execution through backdoor-restricted arbitrary file writing and file inclusion. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://phpyun.com - https://github.com/la12138la/detail/blob/main/1.md
CVE ID: CVE-2024-54728 State: PUBLISHED Published: 2025-01-27T00:00:00.000Z Last Updated: 2025-02-03T17:56:15.125Z Vendors: n/a Products: n/a Problem Types: n/a Description: Incorrect access control in BYD QIN PLUS DM-i Dilink OS 3.0_13.1.7.2204050.1 allows unauthorized attackers to access system logcat logs. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gist.github.com/xu-yanbo202000460009/00dacd7bfede713a0f052a531da4fabd - https://gist.github.com/rainymode/00dacd7bfede713a0f052a531da4fabd
CVE ID: CVE-2024-54730 State: PUBLISHED Published: 2025-01-14T00:00:00.000Z Last Updated: 2025-03-18T14:41:35.895Z Vendors: n/a Products: n/a Problem Types: n/a Description: Flatnotes <v5.3.1 is vulnerable to denial of service through the upload image function. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Startr4ck/CVE_lists/blob/main/flatnotes/flatnotes%20webserver%20dos.md - https://github.com/dullage/flatnotes/issues/259
CVE ID: CVE-2024-54731 State: PUBLISHED Published: 2025-01-08T00:00:00 Last Updated: 2025-01-08T14:41:39.510Z Severity: MEDIUM (CVSS 4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: Coherent Graphics Products: CPDF Problem Types: CWE-674 Description: cpdf through 2.8 allows stack consumption via a crafted PDF document. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/johnwhitington/cpdf-source/issues/366
CVE ID: CVE-2024-54745 State: PUBLISHED Published: 2024-12-06T00:00:00 Last Updated: 2024-12-11T16:20:13.049Z Vendors: n/a Products: n/a Problem Types: n/a Description: WAVLINK WN701AE M01AE_V240305 was discovered to contain a hardcoded password vulnerability in /etc/shadow, which allows attackers to log in as root. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://colorful-meadow-5b9.notion.site/WN701AE_HardCode_vuln-14ac216a1c308015b571e68810d83e16?pvs=4 - https://docs.wavlink.xyz/Firmware_ch/fm-701e/
CVE ID: CVE-2024-54747 State: PUBLISHED Published: 2024-12-06T00:00:00 Last Updated: 2024-12-09T14:54:34.895Z Vendors: n/a Products: n/a Problem Types: n/a Description: WAVLINK WN531P3 202383 was discovered to contain a hardcoded password vulnerability in /etc/shadow, which allows attackers to log in as root. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://colorful-meadow-5b9.notion.site/WN531P3_HardCode_vuln-14ac216a1c30805c9b4dd59028d866cc?pvs=73 - https://docs.wavlink.xyz/Firmware_ch/fm-531p3/
CVE ID: CVE-2024-54749 State: PUBLISHED Published: 2024-12-06T00:00:00 Last Updated: 2024-12-11T20:26:24.482Z Vendors: n/a Products: n/a Problem Types: n/a Description: Ubiquiti U7-Pro 7.0.35 was discovered to contain a hardcoded password vulnerability in /etc/shadow, which allows attackers to log in as root. NOTE: this is disputed by the Supplier because the observation only established that a password is present in a firmware image; however, the device cannot be deployed without setting a new password during installation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://colorful-meadow-5b9.notion.site/U7-Pro_HardCode_vuln-14bc216a1c30802e9c4cd03753e880cc?pvs=4
CVE ID: CVE-2024-54750 State: PUBLISHED Published: 2024-12-06T00:00:00 Last Updated: 2024-12-09T22:29:42.234850Z Vendors: n/a Products: n/a Problem Types: n/a Description: Ubiquiti U6-LR 6.6.65 was discovered to contain a hardcoded password vulnerability in /etc/shadow, which allows attackers to log in as root. NOTE: In Ubiquiti's view there is no vulnerability as the Hardcoded Password should be after setup not before. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://colorful-meadow-5b9.notion.site/U6-LR_HardCode_vuln-14bc216a1c30806487ebdda3bb984e91?pvs=4
CVE ID: CVE-2024-54751 State: PUBLISHED Published: 2024-12-10T00:00:00 Last Updated: 2024-12-11T15:21:39.183Z Vendors: n/a Products: n/a Problem Types: n/a Description: COMFAST CF-WR630AX v2.7.0.2 was discovered to contain a hardcoded password vulnerability in /etc/shadow, which allows attackers to log in as root. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://colorful-meadow-5b9.notion.site/CF-WR630AX_HardCode_vuln-14bc216a1c3080968161ce15e35fa652?pvs=4
CVE ID: CVE-2024-54756 State: PUBLISHED Published: 2025-02-20T00:00:00.000Z Last Updated: 2025-02-21T21:29:11.654Z Vendors: n/a Products: n/a Problem Types: n/a Description: A remote code execution (RCE) vulnerability in the ZScript function of ZDoom Team GZDoom v4.13.1 allows attackers to execute arbitrary code via supplying a crafted PK3 file containing a malicious ZScript source file. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/Chainmanner/GZDoom-Arbitrary-Code-Execution-via-ZScript-PoC - https://seclists.org/fulldisclosure/2025/Feb/11
CVE ID: CVE-2024-54761 State: PUBLISHED Published: 2025-01-09T00:00:00 Last Updated: 2025-01-10T15:54:56.713Z Vendors: n/a Products: n/a Problem Types: n/a Description: BigAnt Office Messenger 5.6.06 is vulnerable to SQL Injection via the 'dev_code' parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/nscan9/BigAnt-Office-Messenger-5.6.06-RCE-via-SQL-Injection/ - https://gist.github.com/nscan9/a31982c90ab40a8e00373bf15efbf52a
CVE ID: CVE-2024-54762 State: PUBLISHED Published: 2025-01-09T00:00:00 Last Updated: 2025-01-10T15:52:41.854Z Vendors: n/a Products: n/a Problem Types: n/a Description: Ruoyi v.4.7.9 and before contains an authenticated SQL injection vulnerability. This is because the filterKeyword method does not completely filter SQL injection keywords, resulting in the risk of SQL injection. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/yangzongzhuan/RuoYi/ - https://locrian-lightning-dc7.notion.site/CVE-2024-54762-1748e5e2b1a280b4a549dcce2c4823e8
CVE ID: CVE-2024-54763 State: PUBLISHED Published: 2025-01-06T00:00:00 Last Updated: 2025-01-07T21:34:32.942Z Vendors: n/a Products: n/a Problem Types: n/a Description: An access control issue in the component /login/hostinfo.cgi of ipTIME A2004 v12.17.0 allows attackers to obtain sensitive information without authentication. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Shuanunio/CVE_Requests/blob/main/ipTIME/A2004/ipTIME_A2004_unauthorized_access_vulnerability_first.md
CVE ID: CVE-2024-54764 State: PUBLISHED Published: 2025-01-06T00:00:00 Last Updated: 2025-01-07T21:27:47.594Z Vendors: n/a Products: n/a Problem Types: n/a Description: An access control issue in the component /login/hostinfo2.cgi of ipTIME A2004 v12.17.0 allows attackers to obtain sensitive information without authentication. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Shuanunio/CVE_Requests/blob/main/ipTIME/A2004/ipTIME_A2004_unauthorized_access_vulnerability_second.md
CVE ID: CVE-2024-54767 State: PUBLISHED Published: 2025-01-06T00:00:00.000Z Last Updated: 2025-04-02T14:09:56.855Z Vendors: n/a Products: n/a Problem Types: n/a Description: An access control issue in the component /juis_boxinfo.xml of AVM FRITZ!Box 7530 AX v7.59 allows attackers to obtain sensitive information without authentication. NOTE: this is disputed by the Supplier because it cannot be reproduced, and the issue report focuses on an unintended configuration with direct Internet exposure. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Shuanunio/CVE_Requests/blob/main/AVM/fritz/AVM_FRITZ%21Box_7530%20AX_unauthorized_access_vulnerability_first.md - ht
com/Shuanunio/CVE_Requests/blob/main/AVM/fritz/AVM_FRITZ%21Box_7530%20AX_unauthorized_access_vulnerability_first.md - https://github.com/Shuanunio/CVE_Requests/issues/1
CVE ID: CVE-2024-54772 State: PUBLISHED Published: 2025-02-11T00:00:00.000Z Last Updated: 2025-02-24T15:32:18.010Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the Winbox service of MikroTik RouterOS long-term release v6.43.13 through v6.49.13 and stable v6.43 through v7.17.2. A patch is available in the stable release v6.49.18. A discrepancy in response size between connection attempts made with a valid username and those with an invalid username allows attackers to enumerate for valid accounts. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/deauther890/CVE-2024-54772
CVE ID: CVE-2024-54774 State: PUBLISHED Published: 2024-12-27T00:00:00 Last Updated: 2024-12-28T17:57:31.438Z Vendors: n/a Products: n/a Problem Types: n/a Description: Dcat Admin v2.2.0-beta contains a cross-site scripting (XSS) vulnerability in /admin/articles/create. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/taynes-llllzt/taynes/issues/4
CVE ID: CVE-2024-54775 State: PUBLISHED Published: 2024-12-27T00:00:00 Last Updated: 2024-12-28T16:51:07.415Z Vendors: n/a Products: n/a Problem Types: n/a Description: Dcat-Admin v2.2.0-beta and v2.2.2-beta contains a Cross-Site Scripting (XSS) vulnerability via /admin/auth/menu and /admin/auth/extensions. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/taynes-llllzt/taynes/issues/5
CVE ID: CVE-2024-54779 State: PUBLISHED Published: 2025-05-14T00:00:00.000Z Last Updated: 2025-05-20T14:28:11.648Z Vendors: n/a Products: n/a Problem Types: n/a Description: Netgate pfSense CE (prior to 2.8.0 beta release) and corresponding Plus builds is vulnerable to Cross Site Scripting (XSS) in widgets/log.widget.php. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://blog.brillantit.com/exploiting-pfsense-xss-command-injection-cloud-hijack/ - https://www.netgate.com/blog/important-security-updates-for-pfsense-plus-24.11-and-ce-2.7.2 - https://docs.netgate.com/downloads/pfSense-SA-25_01.webgui.asc
CVE ID: CVE-2024-54780 State: PUBLISHED Published: 2025-05-14T00:00:00.000Z Last Updated: 2025-05-20T14:29:04.503Z Vendors: n/a Products: n/a Problem Types: n/a Description: Netgate pfSense CE (prior to 2.8.0 beta release) and corresponding Plus builds are vulnerable to command injection in the OpenVPN widget due to improper sanitization of user-supplied input to the OpenVPN management interface. An authenticated attacker can exploit this vulnerability by injecting arbitrary OpenVPN management commands via the remipp parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://blog.brillantit.com/exploiting-pfsense-xss-command-injection-cloud-hijack/ - https://www.netg
ent: References: - https://blog.brillantit.com/exploiting-pfsense-xss-command-injection-cloud-hijack/ - https://www.netgate.com/blog/important-security-updates-for-pfsense-plus-24.11-and-ce-2.7.2
CVE ID: CVE-2024-54790 State: PUBLISHED Published: 2024-12-19T00:00:00 Last Updated: 2024-12-19T15:52:05.059Z Vendors: n/a Products: n/a Problem Types: n/a Description: A SQL Injection vulnerability was found in /index.php in PHPGurukul Pre-School Enrollment System v1.0, which allows remote attackers to execute arbitrary code via the visittime parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Santoshcyber1/CVE-wirteup/blob/main/Phpgurukul/Pre-School%20Enrollment/SQL%20Injection%20pr-school%20i.pdf
CVE ID: CVE-2024-54792 State: PUBLISHED Published: 2025-01-21T00:00:00.000Z Last Updated: 2025-10-17T15:18:49.209Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Cross-Site Request Forgery (CSRF) vulnerability has been found in SpagoBI v3.5.1 in the user administration panel. An authenticated user can lead another user into executing unwanted actions inside the application they are logged in, like adding, editing or deleting users. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/MarioTesoro/CVE-2024-54792 - https://github.com/MarioTesoro/vulnerability-research/tree/main/CVE-2024-54792
CVE ID: CVE-2024-54794 State: PUBLISHED Published: 2025-01-21T00:00:00.000Z Last Updated: 2025-10-17T15:15:56.401Z Vendors: n/a Products: n/a Problem Types: n/a Description: The script input feature of SpagoBI 3.5.1 allows arbitrary code execution. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/MarioTesoro/CVE-2024-54794 - https://github.com/MarioTesoro/vulnerability-research/tree/main/CVE-2024-54794