Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
s this message in the Zimbra webmail classic interface, the payload is executed in the context of the victim's session, potentially leading to execution of arbitrary JavaScript code. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wiki.zimbra.com/wiki/Zimbra_Releases/10.0.7#Security_Fixes - https://wiki.zimbra.com/wiki/Zimbra_Releases/9.0.0/P39#Security_Fixes
CVE ID: CVE-2024-27444 State: PUBLISHED Published: 2024-02-26T00:00:00 Last Updated: 2024-08-06T15:13:44.695Z Vendors: n/a Products: n/a Problem Types: n/a Description: langchain_experimental (aka LangChain Experimental) in LangChain before 0.1.8 allows an attacker to bypass the CVE-2023-44467 fix and execute arbitrary code via the __import__, __subclasses__, __builtins__, __globals__, __getattribute__, __bases__, __mro__, or __base__ attribute in Python code. These are not prohibited by pal_chain/base.py. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/langchain-ai/langchain/commit/de9a6cdf163ed00adaf2e559203ed0a9ca2f1de7
CVE ID: CVE-2024-27447 State: PUBLISHED Published: 2024-02-26T00:00:00 Last Updated: 2024-08-05T15:16:33.447Z Vendors: n/a Products: n/a Problem Types: n/a Description: pretix before 2024.1.1 mishandles file validation. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/pretix/pretix/compare/v2023.10.2...v2024.1.1
CVE ID: CVE-2024-27448 State: PUBLISHED Published: 2024-04-05T00:00:00.000Z Last Updated: 2025-03-13T14:44:13.514Z Vendors: n/a Products: n/a Problem Types: n/a Description: MailDev 2 through 2.1.0 allows Remote Code Execution via a crafted Content-ID header for an e-mail attachment, leading to lib/mailserver.js writing arbitrary code into the routes.js file. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/Tim-Hoekstra/MailDev-2.1.0-Exploit-RCE - https://github.com/maildev/maildev/releases - https://intrix.com.au/articles/exposing-major-security-flaw-in-maildev - https://github.com/maildev/maildev/issues/467 - https://gist.github.c
articles/exposing-major-security-flaw-in-maildev - https://github.com/maildev/maildev/issues/467 - https://gist.github.com/stypr/fe2003f00959f7e3d92ab9d5260433f8
CVE ID: CVE-2024-27453 State: PUBLISHED Published: 2024-05-03T00:00:00 Last Updated: 2024-08-02T00:34:52.263Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Extreme XOS through 22.6.1.4, a read-only user can escalate privileges to root via a crafted HTTP POST request to the python method of the Machine-to-Machine Interface (MMI). Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.exsiliumsecurity.com/CVE-2024-27453.html - https://extreme-networks.my.site.com/ExtrArticleDetail?an=000118266
CVE ID: CVE-2024-27454 State: PUBLISHED Published: 2024-02-26T00:00:00 Last Updated: 2024-08-02T17:14:21.107Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AC:L/AV:N/A:H/C:N/I:N/PR:N/S:U/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: orjson.loads in orjson before 3.9.15 does not limit recursion for deeply nested JSON documents. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/ijl/orjson/issues/458 - https://github.com/ijl/orjson/commit/b0e4d2c06ce06c6e63981bf0276e4b7c74e5845e - https://github.com/ijl/orjson/blob/master/CHANGELOG.md#3915 - https://monicz.dev/CVE-2024-27454
CVE ID: CVE-2024-27455 State: PUBLISHED Published: 2024-02-26T00:00:00 Last Updated: 2024-08-14T14:47:22.686Z Vendors: n/a Products: n/a Problem Types: n/a Description: In the Bentley ALIM Web application, certain configuration settings can cause exposure of a user's ALIM session token when the user attempts to download files. This is fixed in Assetwise ALIM Web 23.00.04.04 and Assetwise Information Integrity Server 23.00.02.03. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.bentley.com/advisories/be-2024-0001/
CVE ID: CVE-2024-27456 State: PUBLISHED Published: 2024-02-26T00:00:00 Last Updated: 2024-08-02T18:54:36.787Z Vendors: n/a Products: n/a Problem Types: n/a Description: rack-cors (aka Rack CORS Middleware) 2.0.1 has 0666 permissions for the .rb files. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/cyu/rack-cors/issues/274
CVE ID: CVE-2024-27457 State: PUBLISHED Published: 2024-10-08T18:43:16.361Z Last Updated: 2024-10-09T14:56:17.471Z Severity: LOW (CVSS 2.5 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:L/I:N/A:N) Vendors: n/a Products: Intel(R) TDX Module firmware Problem Types: information disclosure, CWE-754 Description: Improper check for unusual or exceptional conditions in Intel(R) TDX Module firmware before version 1.5.06 may allow a privileged user to potentially enable information disclosure via local access. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01099.html
CVE ID: CVE-2024-27458 State: PUBLISHED Published: 2024-10-07T16:51:17.861Z Last Updated: 2024-10-07T18:48:44.056Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: HP, Inc. Products: HP Hotkey Support Problem Types: CWE-59 Description: A potential security vulnerability has been identified in the HP Hotkey Support software, which might allow local escalation of privilege. HP is releasing mitigation for the potential vulnerability. Customers using HP Programmable Key are recommended to update HP Hotkey Support. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.hp.com/us-en/document/ish_11342101-11342130-16/hpsbhf03977
CVE ID: CVE-2024-27459 State: PUBLISHED Published: 2024-07-08T10:14:06.208Z Last Updated: 2024-08-23T15:05:42.997Z Vendors: OpenVPN Products: OpenVPN GUI Problem Types: CWE-121 Description: The interactive service in OpenVPN 2.6.9 and earlier allows an attacker to send data causing a stack overflow which can be used to execute arbitrary code with more privileges. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://community.openvpn.net/openvpn/wiki/CVE-2024-27459 - https://openvpn.net/security-advisory/ovpnx-vulnerability-cve-2024-27903-cve-2024-27459-cve-2024-24974/ - https://www.mail-archive.com/openvpn-users@lists.sourceforge.net/msg07534.html
CVE ID: CVE-2024-27460 State: PUBLISHED Published: 2024-05-10T20:23:40.777Z Last Updated: 2024-08-27T15:10:24.958Z Vendors: HP Inc. Products: Plantronics Hub Description: A privilege escalation exists in the updater for Plantronics Hub 3.25.1 and below. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.hp.com/us-en/document/ish_9869257-9869285-16/hpsbpy03895
CVE ID: CVE-2024-27461 State: PUBLISHED Published: 2024-08-14T13:45:15.965Z Last Updated: 2024-08-14T15:25:29.972Z Severity: MEDIUM (CVSS 5.6 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:H) Vendors: n/a Products: Intel(R) MAS (GUI) Problem Types: denial of service, CWE-276 Description: Incorrect default permissions in software installer for Intel(R) MAS (GUI) may allow an authenticated user to potentially enable denial of service via local access. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01164.html
CVE ID: CVE-2024-27462 State: REJECTED Published: N/A Last Updated: 2024-04-14T21:47:14.304550 Description: No description available.
CVE ID: CVE-2024-27474 State: PUBLISHED Published: 2024-04-10T00:00:00 Last Updated: 2024-08-21T20:18:30.064Z Vendors: n/a Products: n/a Problem Types: n/a Description: Leantime 3.0.6 is vulnerable to Cross Site Request Forgery (CSRF). This vulnerability allows malicious actors to perform unauthorized actions on behalf of authenticated users, specifically administrators. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://drive.proton.me/urls/67VER05Z84#f0fXnmp8o6Y9 - https://github.com/Leantime/leantime/blob/264a7dbc2c9b18f574821bf27dd568a287ee8498/app/Domain/Users/Controllers/NewUser.php#L16 - https://github.com/dead1nfluence/Leantime-POC/blob/
21bf27dd568a287ee8498/app/Domain/Users/Controllers/NewUser.php#L16 - https://github.com/dead1nfluence/Leantime-POC/blob/main/README.md
CVE ID: CVE-2024-27476 State: PUBLISHED Published: 2024-04-10T00:00:00 Last Updated: 2024-08-02T00:34:52.312Z Vendors: n/a Products: n/a Problem Types: n/a Description: Leantime 3.0.6 is vulnerable to HTML Injection via /dashboard/show#/tickets/newTicket. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://drive.proton.me/urls/X9G9MY1FAW#NLS8RkHUihLY - https://github.com/Leantime/leantime/blob/264a7dbc2c9b18f574821bf27dd568a287ee8498/app/Domain/Tickets/Controllers/ShowTicket.php#L20 - https://github.com/dead1nfluence/Leantime-POC/blob/main/README.md
CVE ID: CVE-2024-27477 State: PUBLISHED Published: 2024-04-10T00:00:00 Last Updated: 2024-11-06T15:57:33.528Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Leantime 3.0.6, a Cross-Site Scripting vulnerability exists within the ticket creation and modification functionality, allowing attackers to inject malicious JavaScript code into the title field of tickets (also known as to-dos). This stored XSS vulnerability can be exploited to perform Server-Side Request Forgery (SSRF) attacks. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/Leantime/leantime/blob/264a7dbc2c9b18f574821bf27dd568a287ee8498/app/Domain/Tickets/Cont
References: - https://github.com/Leantime/leantime/blob/264a7dbc2c9b18f574821bf27dd568a287ee8498/app/Domain/Tickets/Controllers/ShowTicket.php#L20 - https://drive.proton.me/urls/35CKB8RV04#sEubCKVOuXqt - https://github.com/dead1nfluence/Leantime-POC/blob/main/README.md
CVE ID: CVE-2024-27488 State: PUBLISHED Published: 2024-04-08T00:00:00 Last Updated: 2024-08-22T17:07:53.305Z Vendors: n/a Products: n/a Problem Types: n/a Description: Incorrect Access Control vulnerability in ZLMediaKit versions 1.0 through 8.0, allows remote attackers to escalate privileges and obtain sensitive information. The application system enables the http API interface by default and uses the secret parameter method to authenticate the http restful api interface, but the secret is hardcoded by default. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gist.github.com/tr4pmaker/44442d6f068458175213f4ba71da1312
CVE ID: CVE-2024-27489 State: PUBLISHED Published: 2024-07-19T00:00:00.000Z Last Updated: 2025-03-27T15:46:32.947Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in the DelFile() function of WMCMS v4.4 allows attackers to delete arbitrary files via a crafted POST request. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://gitee.com/y1336247431/poc-public/issues/I920OW - https://gist.github.com/yyyyy7777777/a36541cb60d9e55628f78f2a68968212
CVE ID: CVE-2024-27497 State: PUBLISHED Published: 2024-03-01T00:00:00 Last Updated: 2024-08-16T16:03:18.333Z Vendors: n/a Products: n/a Problem Types: n/a Description: Linksys E2000 Ver.1.0.06 build 1 is vulnerable to authentication bypass via the position.js file. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://warp-desk-89d.notion.site/Linksys-E-2000-efcd532d8dcf4710a4af13fca131a5b8
CVE ID: CVE-2024-27499 State: PUBLISHED Published: 2024-03-01T00:00:00.000Z Last Updated: 2025-08-11T15:56:16.331Z Vendors: n/a Products: n/a Problem Types: n/a Description: Bagisto v1.5.1 is vulnerable for Cross site scripting(XSS) via png file upload vulnerability in product review option. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/bagisto/bagisto/pull/9474 - https://github.com/Ek-Saini/security/blob/main/xss-bagisto-v1.5.1 - https://github.com/auspicious7/Vulnerability-Discover/blob/main/CVE-2024-27499_bagisto-V-1.5.1
CVE ID: CVE-2024-27507 State: PUBLISHED Published: 2024-02-27T00:00:00.000Z Last Updated: 2025-11-04T18:30:10.338Z Vendors: n/a Products: n/a Problem Types: n/a Description: libLAS 1.8.1 contains a memory leak vulnerability in /libLAS/apps/ts2las.cpp. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/LuMingYinDetect/libLAS_defects/blob/main/libLAS_detect_1.md - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WVOY7E2QWQRVXZTJGI7Z4KXGSU6BGEKH/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3QRV2D4GYUZNZRJHVGFSYSOSZLCETI4E/ - https://lis
ect.org/archives/list/package-announce%40lists.fedoraproject.org/message/3QRV2D4GYUZNZRJHVGFSYSOSZLCETI4E/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6T2B6GZQ3WUVFNAAWFQJAQY7UM4OH5TA/
CVE ID: CVE-2024-27508 State: PUBLISHED Published: 2024-02-27T00:00:00 Last Updated: 2024-08-29T15:01:56.327Z Vendors: n/a Products: n/a Problem Types: n/a Description: Atheme 7.2.12 contains a memory leak vulnerability in /atheme/src/crypto-benchmark/main.c. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/LuMingYinDetect/Atheme_defects/blob/main/Atheme_detect_1.md
CVE ID: CVE-2024-27515 State: PUBLISHED Published: 2024-02-28T00:00:00 Last Updated: 2024-08-05T17:33:03.898Z Vendors: n/a Products: n/a Problem Types: n/a Description: Osclass 5.1.2 is vulnerable to SQL Injection. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/mindstellar/Osclass/issues/495
CVE ID: CVE-2024-27516 State: PUBLISHED Published: 2024-02-28T00:00:00 Last Updated: 2024-08-02T00:34:52.303Z Vendors: n/a Products: n/a Problem Types: n/a Description: Server-Side Template Injection (SSTI) vulnerability in livehelperchat before 4.34v, allows remote attackers to execute arbitrary code and obtain sensitive information via the search parameter in lhc_web/modules/lhfaq/faqweight.php. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/LiveHelperChat/livehelperchat/issues/2054 - https://github.com/LiveHelperChat/livehelperchat/commit/a61d231526a36d4a7d8cc957914799ee1f9db0ab
CVE ID: CVE-2024-27517 State: PUBLISHED Published: 2024-02-28T00:00:00 Last Updated: 2024-08-29T17:21:19.949Z Vendors: n/a Products: n/a Problem Types: n/a Description: Webasyst 2.9.9 has a Cross-Site Scripting (XSS) vulnerability, Attackers can create blogs containing malicious code after gaining blog permissions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/webasyst/webasyst-framework/issues/377
CVE ID: CVE-2024-27518 State: PUBLISHED Published: 2024-04-29T00:00:00 Last Updated: 2024-08-22T19:05:57.452Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in SUPERAntiSyware Professional X 10.0.1262 and 10.0.1264 allows unprivileged attackers to escalate privileges via a restore of a crafted DLL file into the C:\Program Files\SUPERAntiSpyware folder. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.youtube.com/watch?v=FM5XlZPdvdo - https://www.superantispyware.com/ - https://github.com/secunnix/CVE-2024-27518
CVE ID: CVE-2024-27521 State: PUBLISHED Published: 2024-03-26T00:00:00 Last Updated: 2024-08-09T20:17:09.908Z Vendors: n/a Products: n/a Problem Types: n/a Description: TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain an unauthenticated remote command execution (RCE) vulnerability via multiple parameters in the "setOpModeCfg" function. This security issue allows an attacker to take complete control of the device. In detail, exploitation allows unauthenticated, remote attackers to execute arbitrary system commands with administrative privileges (i.e., as user "root"). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://m.totolink.
r "root"). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://m.totolink.net/portal/article/index/id/410.html - https://github.com/SpikeReply/advisories/blob/main/cve/totolink/cve-2024-27521.md
CVE ID: CVE-2024-27524 State: PUBLISHED Published: 2024-11-01T00:00:00 Last Updated: 2024-11-04T19:30:28.785Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting vulnerability in Chamilo LMS v.1.11.26 allows a remote attacker to escalate privileges via a crafted script to the filename parameter of the new_ticket.php component. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.less-secure.com/2024/10/chamilo-lms-cve-2024-27524-cve-2024.html - https://github.com/chamilo/chamilo-lms/commit/53275c152275958b33a1f87a21843daa52fb543a
CVE ID: CVE-2024-27525 State: PUBLISHED Published: 2024-11-01T00:00:00 Last Updated: 2024-11-04T19:29:49.470Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting vulnerability in Chamilo LMS v.1.11.26 allows a remote attacker to escalate privileges via a crafted script to the filename parameter of the home.php component. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.less-secure.com/2024/10/chamilo-lms-cve-2024-27524-cve-2024.html - https://github.com/chamilo/chamilo-lms/commit/a63e03ef961e7bf2dab56f4ede6f87edef40ba0c
CVE ID: CVE-2024-27527 State: PUBLISHED Published: 2024-11-08T00:00:00 Last Updated: 2024-11-13T20:32:12.790Z Vendors: n/a Products: n/a Problem Types: n/a Description: wasm3 139076a is vulnerable to Denial of Service (DoS). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/wasm3/wasm3/issues/464 - https://gist.github.com/haruki3hhh/5d2f3a216457aeef9f40331aca33be6e
CVE ID: CVE-2024-27528 State: PUBLISHED Published: 2024-11-08T00:00:00 Last Updated: 2024-11-18T14:27:55.856Z Vendors: n/a Products: n/a Problem Types: n/a Description: wasm3 139076a suffers from Invalid Memory Read, leading to DoS and potential Code Execution. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/wasm3/wasm3/issues/463 - https://gist.github.com/haruki3hhh/baa757c4af4fefb410d9c74d7a68152e
CVE ID: CVE-2024-27529 State: PUBLISHED Published: 2024-11-08T00:00:00 Last Updated: 2024-11-18T14:21:11.631Z Vendors: n/a Products: n/a Problem Types: n/a Description: wasm3 139076a contains memory leaks in Read_utf8. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/wasm3/wasm3/issues/462 - https://gist.github.com/haruki3hhh/ac70bd83b9c0ed1de6289d818488da78
CVE ID: CVE-2024-27530 State: PUBLISHED Published: 2024-11-08T00:00:00.000Z Last Updated: 2025-03-13T18:30:34.966Z Vendors: n/a Products: n/a Problem Types: n/a Description: wasm3 139076a contains a Use-After-Free in ForEachModule. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/wasm3/wasm3/issues/458 - https://gist.github.com/haruki3hhh/94dd274487b58e037bcc8839dc88b203
CVE ID: CVE-2024-27532 State: PUBLISHED Published: 2024-11-08T00:00:00 Last Updated: 2024-11-19T20:20:18.225Z Vendors: n/a Products: n/a Problem Types: n/a Description: wasm-micro-runtime (aka WebAssembly Micro Runtime or WAMR) 06df58f is vulnerable to NULL Pointer Dereference in function `block_type_get_result_types. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/bytecodealliance/wasm-micro-runtime/issues/3130 - https://gist.github.com/haruki3hhh/e468ac3b3234f9bc42a9cc367457119a
CVE ID: CVE-2024-27536 State: REJECTED Published: N/A Last Updated: 2024-04-23T21:57:20.499913 Description: No description available.
CVE ID: CVE-2024-27537 State: REJECTED Published: N/A Last Updated: 2024-04-23T22:01:33.731431 Description: No description available.
CVE ID: CVE-2024-27558 State: PUBLISHED Published: 2024-03-01T00:00:00.000Z Last Updated: 2025-04-22T15:45:12.076Z Vendors: n/a Products: n/a Problem Types: n/a Description: Stupid Simple CMS 1.2.4 is vulnerable to Cross Site Scripting (XSS) within the blog title of the settings. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/kilooooo/cms/blob/main/2.md
CVE ID: CVE-2024-27559 State: PUBLISHED Published: 2024-03-01T00:00:00 Last Updated: 2024-08-02T00:34:52.268Z Vendors: n/a Products: n/a Problem Types: n/a Description: Stupid Simple CMS v1.2.4 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /save_settings.php Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/kilooooo/cms/blob/main/1.md
CVE ID: CVE-2024-27561 State: PUBLISHED Published: 2024-03-05T00:00:00 Last Updated: 2024-08-27T19:28:28.726Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Server-Side Request Forgery (SSRF) in the installUpdateThemePluginAction function of WonderCMS v3.1.3 allows attackers to force the application to make arbitrary requests via injection of crafted URLs into the installThemePlugin parameter. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/zer0yu/CVE_Request/blob/master/WonderCMS/wondercms_installUpdateThemePluginAction_plugins.md
CVE ID: CVE-2024-27563 State: PUBLISHED Published: 2024-03-05T00:00:00 Last Updated: 2024-08-29T15:29:28.519Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Server-Side Request Forgery (SSRF) in the getFileFromRepo function of WonderCMS v3.1.3 allows attackers to force the application to make arbitrary requests via injection of crafted URLs into the pluginThemeUrl parameter. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/zer0yu/CVE_Request/blob/master/WonderCMS/wondercms_pluginThemeUrl.md
CVE ID: CVE-2024-27564 State: PUBLISHED Published: 2024-03-05T00:00:00.000Z Last Updated: 2025-03-20T14:28:44.751Z Severity: MEDIUM (CVSS 5.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N) Vendors: dirk1983 Products: mm1.ltd source code Problem Types: CWE-918 Description: pictureproxy.php in the dirk1983 mm1.ltd source code f9f4bbc allows SSRF via the url parameter. NOTE: the references section has an archived copy of pictureproxy.php from its original GitHub location, but the repository name might later change because it is misleading. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/dirk1983/chatgpt/issues/114 - https://web.archive
m Container: - CISA ADP Vulnrichment: References: - https://github.com/dirk1983/chatgpt/issues/114 - https://web.archive.org/save/https://github.com/dirk1983/chatgpt/issues/114 - https://web.archive.org/web/20250320032559/https://github.com/dirk1983/chatgpt/blob/f9f4bbc99eed7210b291ec116bd57b3d8276bee5/pictureproxy.php - https://web.archive.org/web/20250320031248/https://mm1.ltd/ - https://web.archive.org/save/https://github.com/dirk1983/chatgpt/blob/f9f4bbc99eed7210b291ec116bd57b3d8276bee5/README.md
CVE ID: CVE-2024-27565 State: PUBLISHED Published: 2024-03-05T00:00:00 Last Updated: 2024-08-29T13:56:09.911Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Server-Side Request Forgery (SSRF) in weixin.php of ChatGPT-wechat-personal commit a0857f6 allows attackers to force the application to make arbitrary requests. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/dirk1983/chatgpt-wechat-personal/issues/4