Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-45851 State: PUBLISHED Published: 2024-09-12T13:01:02.816Z Last Updated: 2024-09-12T17:15:51.405Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: mindsdb Products: mindsdb Problem Types: CWE-95 Description: An arbitrary code execution vulnerability exists in versions 23.10.5.0 up to 24.7.4.1 of the MindsDB platform, when the Microsoft SharePoint integration is installed on the server. For databases created with the SharePoint engine, an ‘INSERT’ query can be used for list item creation. If such a query is specially crafted to contain Python code and is run against the database, the code will be passed to an eval function and executed on the se
contain Python code and is run against the database, the code will be passed to an eval function and executed on the server. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://hiddenlayer.com/sai-security-advisory/2024-09-mindsdb/
CVE ID: CVE-2024-45852 State: PUBLISHED Published: 2024-09-12T13:02:29.831Z Last Updated: 2024-09-12T17:15:03.659Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: mindsdb Products: mindsdb Problem Types: CWE-502 Description: Deserialization of untrusted data can occur in versions 23.3.2.0 and newer of the MindsDB platform, enabling a maliciously uploaded model to run arbitrary code on the server when interacted with. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://hiddenlayer.com/sai-security-advisory/2024-09-mindsdb/
CVE ID: CVE-2024-45853 State: PUBLISHED Published: 2024-09-12T13:03:02.719Z Last Updated: 2024-09-12T17:13:52.469Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: mindsdb Products: mindsdb Problem Types: CWE-502 Description: Deserialization of untrusted data can occur in versions 23.10.2.0 and newer of the MindsDB platform, enabling a maliciously uploaded ‘inhouse’ model to run arbitrary code on the server when used for a prediction. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://hiddenlayer.com/sai-security-advisory/2024-09-mindsdb/
CVE ID: CVE-2024-45854 State: PUBLISHED Published: 2024-09-12T13:03:30.197Z Last Updated: 2024-09-12T17:06:22.868Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: mindsdb Products: mindsdb Problem Types: CWE-502 Description: Deserialization of untrusted data can occur in versions 23.10.3.0 and newer of the MindsDB platform, enabling a maliciously uploaded ‘inhouse’ model to run arbitrary code on the server when a ‘describe’ query is run on it. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://hiddenlayer.com/sai-security-advisory/2024-09-mindsdb/
CVE ID: CVE-2024-45855 State: PUBLISHED Published: 2024-09-12T13:04:13.076Z Last Updated: 2024-09-12T17:04:48.086Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: mindsdb Products: mindsdb Problem Types: CWE-502 Description: Deserialization of untrusted data can occur in versions 23.10.2.0 and newer of the MindsDB platform, enabling a maliciously uploaded ‘inhouse’ model to run arbitrary code on the server when using ‘finetune’ on it. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://hiddenlayer.com/sai-security-advisory/2024-09-mindsdb/
CVE ID: CVE-2024-45856 State: PUBLISHED Published: 2024-09-12T13:05:01.526Z Last Updated: 2024-09-12T16:57:45.128Z Severity: CRITICAL (CVSS 9 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H) Vendors: mindsdb Products: mindsdb Problem Types: CWE-79 Description: A cross-site scripting (XSS) vulnerability exists in all versions of the MindsDB platform, enabling the execution of a JavaScript payload whenever a user enumerates an ML Engine, database, project, or dataset containing arbitrary JavaScript code within the web UI. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://hiddenlayer.com/sai-security-advisory/2024-09-mindsdb/
CVE ID: CVE-2024-45857 State: PUBLISHED Published: 2024-09-12T12:53:43.963Z Last Updated: 2024-09-12T14:43:45.118Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Cleanlab Products: cleanlab Problem Types: CWE-502 Description: Deserialization of untrusted data can occur in versions 2.4.0 or newer of the Cleanlab project, enabling a maliciously crafted datalab.pkl file to run arbitrary code on an end user’s system when the data directory is loaded. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://hiddenlayer.com/sai-security-advisory/2024-09-cleanlab/
CVE ID: CVE-2024-45858 State: PUBLISHED Published: 2024-09-18T15:02:17.891Z Last Updated: 2024-09-18T17:45:44.580Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Guardrails AI Products: guardrails Problem Types: CWE-95 Description: An arbitrary code execution vulnerability exists in versions 0.2.9 up to 0.5.10 of the Guardrails AI Guardrails framework because of the way it validates XML files. If a victim user loads a maliciously crafted XML file containing Python code, the code will be passed to an eval function, causing it to execute on the user's machine. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://hiddenlayer.com/sai-security-
e user's machine. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://hiddenlayer.com/sai-security-advisory/2024-09-guardrails/
CVE ID: CVE-2024-45861 State: PUBLISHED Published: 2024-09-19T15:51:06.115Z Last Updated: 2024-09-20T13:05:06.549Z Vendors: Kastle Systems Products: Access Control System Problem Types: CWE-798 Description: Kastle Systems firmware prior to May 1, 2024, contained a hard-coded credential, which if accessed may allow an attacker to access sensitive information. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-24-263-05
CVE ID: CVE-2024-45862 State: PUBLISHED Published: 2024-09-19T15:54:32.596Z Last Updated: 2024-09-20T13:03:08.919Z Vendors: Kastle Systems Products: Access Control System Problem Types: CWE-312 Description: Kastle Systems firmware prior to May 1, 2024, stored machine credentials in cleartext, which may allow an attacker to access sensitive information. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-24-263-05
CVE ID: CVE-2024-45863 State: PUBLISHED Published: 2024-09-27T13:50:29.254Z Last Updated: 2024-09-27T14:29:01.158Z Vendors: Facebook Products: Facebook Thrift Problem Types: NULL Pointer Dereference (CWE-476) Description: A null-dereference vulnerability involving parsing requests specifying invalid protocols can cause the application to crash or potentially result in other undesirable effects. This issue affects Facebook Thrift from v2024.09.09.00 until v2024.09.23.00. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.facebook.com/security/advisories/cve-2024-45863
CVE ID: CVE-2024-45870 State: PUBLISHED Published: 2024-10-03T00:00:00 Last Updated: 2024-10-03T17:29:07.616Z Vendors: n/a Products: n/a Problem Types: n/a Description: Bandisoft BandiView 7.05 is vulnerable to Incorrect Access Control in sub_0x3d80fc via a crafted POC file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Jaecho6053/BandiView_PoC
CVE ID: CVE-2024-45871 State: PUBLISHED Published: 2024-10-03T00:00:00 Last Updated: 2024-10-03T19:38:02.678Z Vendors: n/a Products: n/a Problem Types: n/a Description: Bandisoft BandiView 7.05 is Incorrect Access Control via sub_0x232bd8 resulting in denial of service (DOS). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Jaecho6053/BandiView_PoC
CVE ID: CVE-2024-45872 State: PUBLISHED Published: 2024-10-03T00:00:00 Last Updated: 2024-10-03T19:29:53.216Z Vendors: n/a Products: n/a Problem Types: n/a Description: Bandisoft BandiView 7.05 is vulnerable to Buffer Overflow via sub_0x410d1d. The vulnerability occurs due to insufficient validation of PSD files. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Jaecho6053/BandiView_PoC
CVE ID: CVE-2024-45873 State: PUBLISHED Published: 2024-10-07T00:00:00 Last Updated: 2024-10-08T14:03:40.325Z Vendors: n/a Products: n/a Problem Types: n/a Description: A DLL hijacking vulnerability in VegaBird Yaazhini 2.0.2 allows attackers to execute arbitrary code / maintain persistence via placing a crafted DLL file in the same directory as Yaazhini.exe. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://vegabird.com - https://sploitus.com/exploit?id=PACKETSTORM:181912
CVE ID: CVE-2024-45874 State: PUBLISHED Published: 2024-10-07T00:00:00 Last Updated: 2024-10-08T14:03:33.155Z Vendors: n/a Products: n/a Problem Types: n/a Description: A DLL hijacking vulnerability in VegaBird Vooki 5.2.9 allows attackers to execute arbitrary code / maintain persistence via placing a crafted DLL file in the same directory as Vooki.exe. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://vegabird.com - https://sploitus.com/exploit?id=PACKETSTORM:181913
CVE ID: CVE-2024-45875 State: PUBLISHED Published: 2024-11-13T00:00:00 Last Updated: 2024-11-21T21:51:11.704Z Vendors: n/a Products: n/a Problem Types: n/a Description: The create user function in baltic-it TOPqw Webportal 1.35.287.1 (fixed in version1.35.291), in /Apps/TOPqw/BenutzerManagement.aspx/SaveNewUser, is vulnerable to SQL injection. The JSON object username allows the manipulation of SQL queries. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cyber.wtf/2024/11/11/topqw-webportal-cves/
CVE ID: CVE-2024-45876 State: PUBLISHED Published: 2024-11-13T00:00:00 Last Updated: 2024-11-21T21:48:47.183Z Vendors: n/a Products: n/a Problem Types: n/a Description: The login form of baltic-it TOPqw Webportal v1.35.283.2 (fixed in version 1.35.283.4) at /Apps/TOPqw/Login.aspx is vulnerable to SQL injection. The vulnerability exists in the POST parameter txtUsername, which allows for manipulation of SQL queries. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cyber.wtf/2024/11/11/topqw-webportal-cves/
CVE ID: CVE-2024-45877 State: PUBLISHED Published: 2024-11-13T00:00:00 Last Updated: 2024-11-26T19:56:32.467Z Vendors: n/a Products: n/a Problem Types: n/a Description: baltic-it TOPqw Webportal v1.35.283.2 is vulnerable to Incorrect Access Control in the User Management function in /Apps/TOPqw/BenutzerManagement.aspx. This allows a low privileged user to access all modules in the web portal, view and manipulate information and permissions of other users, lock other user or unlock the own account, change the password of other users, create new users or delete existing users and view, manipulate and delete reference data. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https:
and view, manipulate and delete reference data. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cyber.wtf/2024/11/11/topqw-webportal-cves/
CVE ID: CVE-2024-45878 State: PUBLISHED Published: 2024-11-13T00:00:00 Last Updated: 2024-11-21T22:02:18.278Z Vendors: n/a Products: n/a Problem Types: n/a Description: The "Stammdaten" menu of baltic-it TOPqw Webportal v1.35.283.2 (fixed in version 1.35.291), in /Apps/TOPqw/qwStammdaten.aspx, is vulnerable to persistent Cross-Site Scripting (XSS). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cyber.wtf/2024/11/11/topqw-webportal-cves/
CVE ID: CVE-2024-45879 State: PUBLISHED Published: 2024-11-13T00:00:00 Last Updated: 2024-11-21T22:02:18.148Z Vendors: n/a Products: n/a Problem Types: n/a Description: The file upload function in the "QWKalkulation" tool of baltic-it TOPqw Webportal v1.35.287.1 (fixed in version 1.35.291), in /Apps/TOPqw/QWKalkulation/QWKalkulation.aspx, is vulnerable to Cross-Site Scripting (XSS). To exploit the persistent XSS vulnerability, an attacker has to be authenticated to the application that uses the "TOPqw Webportal" as a software. When authenticated, the attacker can persistently place the malicious JavaScript code in the "QWKalkulation" menu.' Additional Analyst Notes: - CISA ADP Vulnrichment:
ly place the malicious JavaScript code in the "QWKalkulation" menu.' Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cyber.wtf/2024/11/11/topqw-webportal-cves/
CVE ID: CVE-2024-45880 State: PUBLISHED Published: 2024-10-08T00:00:00 Last Updated: 2024-10-08T15:27:13.517Z Vendors: n/a Products: n/a Problem Types: n/a Description: A command injection vulnerability exists in Motorola CX2L router v1.0.2 and below. The vulnerability is present in the SetStationSettings function. The system directly invokes the system function to execute commands for setting parameters such as MAC address without proper input filtering. This allows malicious users to inject and execute arbitrary commands. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/N1nEmAn/wp/blob/main/m0tOrol%40-Cx2l.pdf
CVE ID: CVE-2024-45882 State: PUBLISHED Published: 2024-11-04T00:00:00 Last Updated: 2024-11-04T16:57:45.107Z Vendors: n/a Products: n/a Problem Types: n/a Description: DrayTek Vigor3900 1.5.1.3 contains a command injection vulnerability. This vulnerability occurs when the `action` parameter in `cgi-bin/mainfunction.cgi` is set to `delete_map_profile.` Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/N1nEmAn/wp/blob/main/test_v.zip - https://github.com/fu37kola/cve/blob/main/DrayTek/Vigor3900/1.5.1.3/DrayTek_Vigor_3900_1.5.1.3.pdf
CVE ID: CVE-2024-45884 State: PUBLISHED Published: 2024-11-04T00:00:00 Last Updated: 2024-11-04T16:57:11.329Z Vendors: n/a Products: n/a Problem Types: n/a Description: DrayTek Vigor3900 1.5.1.3 contains a post-authentication command injection vulnerability. This vulnerability occurs when the `action` parameter in `cgi-bin/mainfunction.cgi` is set to `setSWMGroup.` Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/N1nEmAn/wp/blob/main/test_v.zip - https://github.com/fu37kola/cve/blob/main/DrayTek/Vigor3900/1.5.1.3/DrayTek_Vigor_3900_1.5.1.3.pdf
CVE ID: CVE-2024-45885 State: PUBLISHED Published: 2024-11-04T00:00:00 Last Updated: 2024-11-04T16:54:21.528Z Vendors: n/a Products: n/a Problem Types: n/a Description: DrayTek Vigor3900 1.5.1.3 contains a post-authentication command injection vulnerability. This vulnerability occurs when the `action` parameter in `cgi-bin/mainfunction.cgi` is set to `autodiscovery_clear.` Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/N1nEmAn/wp/blob/main/test_v.zip - https://github.com/fu37kola/cve/blob/main/DrayTek/Vigor3900/1.5.1.3/DrayTek_Vigor_3900_1.5.1.3.pdf
CVE ID: CVE-2024-45887 State: PUBLISHED Published: 2024-11-04T00:00:00 Last Updated: 2024-11-04T17:01:25.323Z Vendors: n/a Products: n/a Problem Types: n/a Description: DrayTek Vigor3900 1.5.1.3 contains a post-authentication command injection vulnerability. This vulnerability occurs when the `action` parameter in `cgi-bin/mainfunction.cgi` is set to `doOpenVPN.` Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/N1nEmAn/wp/blob/main/test_v.zip - https://github.com/fu37kola/cve/blob/main/DrayTek/Vigor3900/1.5.1.3/DrayTek_Vigor_3900_1.5.1.3.pdf
CVE ID: CVE-2024-45888 State: PUBLISHED Published: 2024-11-04T00:00:00 Last Updated: 2024-11-04T16:53:54.301Z Vendors: n/a Products: n/a Problem Types: n/a Description: DrayTek Vigor3900 1.5.1.3 contains a command injection vulnerability. This vulnerability occurs when the `action` parameter in `cgi-bin/mainfunction.cgi` is set to `set_ap_map_config.' Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/N1nEmAn/wp/blob/main/test_v.zip - https://github.com/fu37kola/cve/blob/main/DrayTek/Vigor3900/1.5.1.3/DrayTek_Vigor_3900_1.5.1.3.pdf
CVE ID: CVE-2024-45889 State: PUBLISHED Published: 2024-11-04T00:00:00 Last Updated: 2024-11-04T17:01:17.248Z Vendors: n/a Products: n/a Problem Types: n/a Description: DrayTek Vigor3900 1.5.1.3 contains a post-authentication command injection vulnerability. This vulnerability occurs when the `action` parameter in `cgi-bin/mainfunction.cgi` is set to `commandTable.` Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/N1nEmAn/wp/blob/main/test_v.zip - https://github.com/fu37kola/cve/blob/main/DrayTek/Vigor3900/1.5.1.3/DrayTek_Vigor_3900_1.5.1.3.pdf
CVE ID: CVE-2024-45890 State: PUBLISHED Published: 2024-11-04T00:00:00 Last Updated: 2024-11-04T17:00:03.821Z Vendors: n/a Products: n/a Problem Types: n/a Description: DrayTek Vigor3900 1.5.1.3 contains a post-authentication command injection vulnerability This vulnerability occurs when the `action` parameter in `cgi-bin/mainfunction.cgi` is set to `download_ovpn.` Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/N1nEmAn/wp/blob/main/test_v.zip - https://github.com/fu37kola/cve/blob/main/DrayTek/Vigor3900/1.5.1.3/DrayTek_Vigor_3900_1.5.1.3.pdf
CVE ID: CVE-2024-45891 State: PUBLISHED Published: 2024-11-04T00:00:00 Last Updated: 2024-11-04T16:54:11.546Z Vendors: n/a Products: n/a Problem Types: n/a Description: DrayTek Vigor3900 1.5.1.3 contains a post-authentication command injection vulnerability. This vulnerability occurs when the `action` parameter in `cgi-bin/mainfunction.cgi` is set to `delete_wlan_profile.` Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/N1nEmAn/wp/blob/main/test_v.zip - https://github.com/fu37kola/cve/blob/main/DrayTek/Vigor3900/1.5.1.3/DrayTek_Vigor_3900_1.5.1.3.pdf
CVE ID: CVE-2024-45893 State: PUBLISHED Published: 2024-11-04T00:00:00 Last Updated: 2024-11-04T16:53:44.085Z Vendors: n/a Products: n/a Problem Types: n/a Description: DrayTek Vigor3900 1.5.1.3 contains a post-authentication command injection vulnerability. This vulnerability occurs when the `action` parameter in `cgi-bin/mainfunction.cgi` is set to `setSWMOption.` Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/N1nEmAn/wp/blob/main/test_v.zip - https://github.com/fu37kola/cve/blob/main/DrayTek/Vigor3900/1.5.1.3/DrayTek_Vigor_3900_1.5.1.3.pdf
CVE ID: CVE-2024-45894 State: PUBLISHED Published: 2024-10-07T00:00:00 Last Updated: 2024-11-25T21:19:10.516Z Vendors: n/a Products: n/a Problem Types: n/a Description: BlueCMS 1.6 suffers from Arbitrary File Deletion via the file_name parameter in an /admin/database.php?act=del request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/source-trace/bluecms/issues/1 - https://gist.github.com/yihanjinchangtai/215ea4bf71edb0ac9df33b221b63a3a9
CVE ID: CVE-2024-45918 State: PUBLISHED Published: 2024-10-08T00:00:00 Last Updated: 2024-11-05T19:45:39.575Z Vendors: n/a Products: n/a Problem Types: n/a Description: Fujian Kelixin Communication Command and Dispatch Platform <=7.6.6.4391 is vulnerable to SQL Injection via /client/get_gis_fence.php. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.kirisun.com/ - https://gist.github.com/Y5neKO/3e29d32e07d90c96ae808d7e7839f0aa
CVE ID: CVE-2024-45919 State: PUBLISHED Published: 2024-10-07T00:00:00 Last Updated: 2024-10-08T14:08:44.567Z Vendors: n/a Products: n/a Problem Types: n/a Description: A security flaw has been discovered in Solvait version 24.4.2 that allows an attacker to elevate their privileges. By manipulating the Request ID and Action Type parameters in /AssignToMe/SetAction, an attacker can bypass approval workflows leading to unauthorized access to sensitive information or approval of fraudulent requests. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gist.github.com/ipxsec/28afaf965389283a68433c7afd54d17a
CVE ID: CVE-2024-45920 State: PUBLISHED Published: 2024-09-30T00:00:00 Last Updated: 2024-09-30T17:40:57.218Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Stored Cross-Site Scripting (XSS) vulnerability in Solvait 24.4.2 allows remote attackers to inject malicious scripts into the application. This issue arises due to insufficient input validation and sanitization in "Intrest" feature. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gist.github.com/ipxsec/10526db2cbfcb899a70dcb8f0ee53a99
CVE ID: CVE-2024-45932 State: PUBLISHED Published: 2024-10-07T00:00:00 Last Updated: 2024-10-07T17:03:41.418Z Vendors: n/a Products: n/a Problem Types: n/a Description: Krayin CRM v1.3.0 is vulnerable to Cross Site Scripting (XSS) via the organization name field in /admin/contacts/organizations/edit/2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://TobeReleased.com - https://github.com/AslamMahi/CVE-Aslam-Mahi/blob/main/Laravel%20CRM%20v1.3.0/CVE-2024-45932.md
CVE ID: CVE-2024-45933 State: PUBLISHED Published: 2024-10-07T00:00:00 Last Updated: 2024-10-08T18:49:00.637Z Vendors: n/a Products: n/a Problem Types: n/a Description: OnlineNewsSite v1.0 is vulnerable to Cross Site Scripting (XSS) which allows attackers to execute arbitrary code via the Title and summary fields in the /admin/post/edit/ endpoint. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://TobeReleased.com - https://github.com/AslamMahi/CVE-Aslam-Mahi/blob/main/MobinaJafarian-OnlineNewsSite%20v%201.0/CVE-2024-45933.md
CVE ID: CVE-2024-45944 State: PUBLISHED Published: 2024-10-18T00:00:00 Last Updated: 2024-10-21T18:07:32.534Z Vendors: n/a Products: n/a Problem Types: n/a Description: In J2eeFAST <=2.7, the backend function has unsafe filtering, which allows an attacker to trigger certain sensitive functions resulting in arbitrary code execution. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/dromara/J2EEFAST - https://gitee.com/dromara/J2EEFAST - https://github.com/lazy-forever/CVE-Reference/tree/main/2024/45944
CVE ID: CVE-2024-45955 State: PUBLISHED Published: 2025-07-30T00:00:00.000Z Last Updated: 2025-07-30T19:01:42.831Z Vendors: n/a Products: n/a Problem Types: n/a Description: Rocket Software Rocket Zena 4.4.1.26 is vulnerable to SQL Injection via the filter parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://rocket.com - https://notes.netbytesec.com/2025/07/cve-2024-45955-sql-injection.html
CVE ID: CVE-2024-45960 State: PUBLISHED Published: 2024-10-02T00:00:00 Last Updated: 2024-10-02T20:16:13.833Z Vendors: n/a Products: n/a Problem Types: n/a Description: Zenario 9.7.61188 allows authenticated admin users to upload PDF files containing malicious code into the target system. If the PDF file is accessed through the website, it can trigger a Cross Site Scripting (XSS) attack. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://grimthereaperteam.medium.com/zenario-9-7-9-7-61188-malicious-file-upload-xss-in-pdf-eb11729fe059
CVE ID: CVE-2024-45962 State: PUBLISHED Published: 2024-10-02T00:00:00 Last Updated: 2024-10-02T20:35:08.391Z Vendors: n/a Products: n/a Problem Types: n/a Description: October 3.6.30 allows an authenticated admin account to upload a PDF file containing malicious JavaScript into the target system. If the file is accessed through the website, it could lead to a Cross-Site Scripting (XSS) attack or execute arbitrary code via a crafted JavaScript to the target. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://grimthereaperteam.medium.com/october-cms-3-6-30-stored-xss-ddf2be7a226e
CVE ID: CVE-2024-45964 State: PUBLISHED Published: 2024-10-02T00:00:00 Last Updated: 2024-10-02T20:17:48.386Z Vendors: n/a Products: n/a Problem Types: n/a Description: Zenario 9.7.61188 is vulnerable to Cross Site Scripting (XSS) in the Image library via the "Organizer tags" field. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://grimthereaperteam.medium.com/zenario-9-7-61188-reflect-xss-bee4ab9187e7