Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-4090 State: PUBLISHED Published: 2024-08-01T06:00:05.396Z Last Updated: 2024-08-01T13:36:51.336Z Vendors: Unknown Products: Floating Notification Bar, Sticky Menu on Scroll, Announcement Banner, and Sticky Header for Any Theme Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Floating Notification Bar, Sticky Menu on Scroll, Announcement Banner, and Sticky Header for Any WordPress plugin before 2.7.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan
even when unfiltered_html is disallowed Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/aedcb986-0f2b-4852-baf1-6cb61e83e109/
CVE ID: CVE-2024-4091 State: PUBLISHED Published: 2025-05-15T20:09:45.628Z Last Updated: 2025-11-13T21:00:44.949Z Vendors: Unknown Products: Responsive Gallery Grid Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Responsive Gallery Grid WordPress plugin before 2.3.15 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/e28e79fa-f461-41fe-ad1c-ca768ea5f982/
CVE ID: CVE-2024-4092 State: PUBLISHED Published: 2024-05-02T16:52:20.424Z Last Updated: 2024-08-01T20:33:52.237Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: Revolution Slider Products: Slider Revolution Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Slider Revolution plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘htmltag’ parameter in all versions up to, and including, 6.7.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers to inject arbitrary web scripts in pages that will execute whenever
. This makes it possible for authenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. By default, this can only be exploited by administrators, but the ability to use and configure Slider Revolution can be extended to authors. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/8437abcc-3e34-4a8a-bfe2-2ff7c9f41164?source=cve - https://www.sliderrevolution.com/documentation/changelog/
CVE ID: CVE-2024-4093 State: PUBLISHED Published: 2024-04-24T01:00:07.384Z Last Updated: 2024-08-01T20:33:52.149Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: SourceCodester Products: Simple Subscription Website Problem Types: CWE-89 Description: A vulnerability, which was classified as critical, was found in SourceCodester Simple Subscription Website 1.0. Affected is an unknown function of the file view_application.php. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-261822 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CI
the public and may be used. VDB-261822 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.261822 - https://vuldb.com/?ctiid.261822 - https://vuldb.com/?submit.321505 - https://github.com/4wchen/Cve/blob/main/Simple%20Subscription%20Website%20with%20Admin%20System%20view_application.php%20has%20Sqlinjection.pdf
CVE ID: CVE-2024-4094 State: PUBLISHED Published: 2024-06-18T06:00:02.301Z Last Updated: 2025-03-18T20:25:05.878Z Vendors: Unknown Products: Simple Share Buttons Adder Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Simple Share Buttons Adder WordPress plugin before 8.5.1 does not sanitise and escape some of its settings, which could allow high privilege users such as editors to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://wpscan.com/vulnerability/04b2feba-e009-4fce-8539-5dfdb4300433/
CVE ID: CVE-2024-4095 State: PUBLISHED Published: 2024-06-15T08:42:18.216Z Last Updated: 2024-08-01T20:33:52.278Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: baden03 Products: Collapse-O-Matic Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Collapse-O-Matic plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'expand' and 'expandsub' shortcode in all versions up to, and including, 1.8.5.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level a
utput escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/d4c56931-c2af-4940-95e4-3f3dae51c31c?source=cve - https://github.com/baden03/collapse-o-matic/blob/561d8ab53a03e44c12234ba9687226fdbb5054cc/collapse-o-matic.php#L343 - https://wordpress.org/plugins/jquery-collapse-o-matic/ - https://pluginoven.com/plugins/collapse-o-matic/documentation/shortcode/ - https://plugi
gins/jquery-collapse-o-matic/ - https://pluginoven.com/plugins/collapse-o-matic/documentation/shortcode/ - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3094116%40jquery-collapse-o-matic&new=3094116%40jquery-collapse-o-matic&sfp_email=&sfph_mail=
CVE ID: CVE-2024-4096 State: PUBLISHED Published: 2024-07-30T06:00:07.893Z Last Updated: 2024-08-01T20:33:52.136Z Vendors: Unknown Products: Responsive Tabs Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Responsive Tabs WordPress plugin through 4.0.8 does not sanitise and escape some of its Tab settings, which could allow high privilege users such as Contributors and above to perform Stored Cross-Site Scripting attacks Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://wpscan.com/vulnerability/4dba5e9e-24be-458a-9150-7c7a958e66cb/
CVE ID: CVE-2024-4097 State: PUBLISHED Published: 2024-05-02T16:57:16.379Z Last Updated: 2024-08-01T20:33:52.142Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) Vendors: StylemixThemes Products: Cost Calculator Builder Problem Types: CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) Description: The Cost Calculator Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the SVG upload feature in all versions up to, and including, 3.1.67 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenev
. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/526add70-4fcf-44d1-b4d8-4cc35652b1f0?source=cve - https://docs.stylemixthemes.com/cost-calculator-builder/changelog-1/changelog-pro-version
CVE ID: CVE-2024-4098 State: PUBLISHED Published: 2024-06-20T06:58:02.886Z Last Updated: 2024-08-01T20:33:51.638Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: 3uu Products: Shariff Wrapper Problem Types: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Description: The Shariff Wrapper plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 4.6.13 via the shariff3uu_fetch_sharecounts function. This allows unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls,
files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/f49fba00-c576-4a1a-8b0b-9ebed3e3d090?source=cve - https://plugins.trac.wordpress.org/browser/shariff/trunk/shariff.php#L410 - https://plugins.trac.wordpress.org/changeset/3103137
CVE ID: CVE-2024-4099 State: PUBLISHED Published: 2024-09-26T23:02:15.810Z Last Updated: 2024-09-27T15:48:49.456Z Severity: LOW (CVSS 3.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: GitLab Products: GitLab Problem Types: CWE-116 Description: An issue has been discovered in GitLab EE affecting all versions starting from 16.0 prior to 17.2.8, from 17.3 prior to 17.3.4, and from 17.4 prior to 17.4.1. An AI feature was found to read unsanitized content in a way that could have allowed an attacker to hide prompt injection. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/457798 - https://hackerone.com/reports/2459597
CVE ID: CVE-2024-4100 State: PUBLISHED Published: 2024-07-09T08:33:05.715Z Last Updated: 2024-08-01T20:33:51.670Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: elfsight Products: Pricing Table Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The Pricing Table plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0.1. This is due to missing or incorrect nonce validation on the ajax() function. This makes it possible for unauthenticated attackers to perform a variety of actions related to managing pricing tables via a forged request granted they can trick a site administrator into perfor
actions related to managing pricing tables via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/4cb3d2d4-256c-4128-9397-8b9c7be1b9c8?source=cve - https://plugins.trac.wordpress.org/browser/elfsight-pricing-table/trunk/core/includes/widgets-api.php#L71
CVE ID: CVE-2024-4101 State: REJECTED Published: N/A Last Updated: 2025-02-11T01:05:27.902Z Description: No description available.
CVE ID: CVE-2024-4102 State: PUBLISHED Published: 2024-07-09T08:33:10.563Z Last Updated: 2024-08-01T20:33:52.272Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) Vendors: elfsight Products: Pricing Table Problem Types: CWE-862 Missing Authorization Description: The Pricing Table plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the ajax() function in all versions up to, and including, 2.0.1. This makes it possible for authenticated attackers, with subscriber-level access and above, to perform unauthorized actions like editing pricing tables. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container
thorized actions like editing pricing tables. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/aa769d51-8718-42e9-9070-0b878442dbc7?source=cve - https://plugins.trac.wordpress.org/browser/elfsight-pricing-table/trunk/core/includes/widgets-api.php#L71
CVE ID: CVE-2024-4103 State: PUBLISHED Published: 2024-05-09T20:03:33.406Z Last Updated: 2024-08-01T20:33:52.313Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: giuliopanda Products: ADFO – Custom data in admin dashboard Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The ADFO – Custom data in admin dashboard plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.9.0. This is due to missing or incorrect nonce validation on several functions hooked via the controller() function. This makes it possible for unauthenticated attackers to edit the plugin's settings via a forged request grante
function. This makes it possible for unauthenticated attackers to edit the plugin's settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/8d797238-f8f3-44d7-8c16-bee23ce12ae0?source=cve - https://plugins.trac.wordpress.org/changeset/3081090/admin-form/trunk/admin/class-af-list-admin.php
CVE ID: CVE-2024-4104 State: PUBLISHED Published: 2024-05-09T20:03:41.057Z Last Updated: 2024-08-01T20:33:52.235Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: giuliopanda Products: ADFO – Custom data in admin dashboard Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The ADFO – Custom data in admin dashboard plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'dbp_id' parameter in all versions up to, and including, 1.9.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scrip
put sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/e61110fc-cc2d-4207-97b6-b21459334216?source=cve - https://plugins.trac.wordpress.org/browser/admin-form/trunk/admin/class-af-list-admin.php - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3081090%40admin-form&new=3081090%40admin-form&sfp_email=&sfph_mail=
CVE ID: CVE-2024-4105 State: PUBLISHED Published: 2024-06-26T05:25:04.524Z Last Updated: 2024-08-01T20:33:52.203Z Severity: MEDIUM (CVSS 5.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N) Vendors: Yokogawa Electric Corporation Products: FAST/TOOLS, CI Server Problem Types: CWE-79 Description: A vulnerability has been found in FAST/TOOLS and CI Server. The affected product's WEB HMI server's function to process HTTP requests has a security flaw (Reflected XSS) that allows the execution of malicious scripts. Therefore, if a client PC with inadequate security measures accesses a product URL containing a malicious request, the malicious script may be executed on the client PC. The affected produc
a product URL containing a malicious request, the malicious script may be executed on the client PC. The affected products and versions are as follows: FAST/TOOLS (Packages: RVSVRN, UNSVRN, HMIWEB, FTEES, HMIMOB) R9.01 to R10.04 CI Server R1.01.00 to R1.03.00 Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://web-material3.yokogawa.com/1/36059/files/YSAR-24-0001-E.pdf
CVE ID: CVE-2024-4106 State: PUBLISHED Published: 2024-06-26T05:30:33.928Z Last Updated: 2024-08-01T20:33:52.203Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Yokogawa Electric Corporation Products: FAST/TOOLS, CI Server Problem Types: CWE-258 Description: A vulnerability has been found in FAST/TOOLS and CI Server. The affected products have built-in accounts with no passwords set. Therefore, if the product is operated without a password set by default, an attacker can break into the affected product. The affected products and versions are as follows: FAST/TOOLS (Packages: RVSVRN, UNSVRN, HMIWEB, FTEES, HMIMOB) R9.01 to R10.04 CI Server R1.01.00 to R1.03.
re as follows: FAST/TOOLS (Packages: RVSVRN, UNSVRN, HMIWEB, FTEES, HMIMOB) R9.01 to R10.04 CI Server R1.01.00 to R1.03.00 Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://web-material3.yokogawa.com/1/36059/files/YSAR-24-0001-E.pdf
CVE ID: CVE-2024-4107 State: PUBLISHED Published: 2024-05-09T20:03:19.432Z Last Updated: 2024-08-01T20:33:52.242Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: https://elementor.com/ Products: Elementor Website Builder Pro Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Elementor Website Builder – More than Just a Page Builder Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the several parameters in versions up to, and including, 3.21.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with cont
ue to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/0d5d47bd-4f05-4dc7-84c1-f7bc1196ee16?source=cve - https://doc.clickup.com/9011113249/d/h/8chnb91-5091/3951e6f2afbd388
CVE ID: CVE-2024-4108 State: REJECTED Published: N/A Last Updated: 2025-02-11T01:05:27.101Z Description: No description available.
CVE ID: CVE-2024-4109 State: REJECTED Published: 2024-12-12T09:04:50.299Z Last Updated: 2025-01-16T21:48:39.856Z Description: No description available.
CVE ID: CVE-2024-4111 State: PUBLISHED Published: 2024-04-24T14:00:05.565Z Last Updated: 2024-08-01T20:33:52.366Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C) Vendors: Tenda Products: TX9 Problem Types: CWE-121 Description: A vulnerability was found in Tenda TX9 22.03.02.10. It has been rated as critical. Affected by this issue is the function sub_42BD7C of the file /goform/SetLEDCfg. The manipulation of the argument time leads to stack-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-261854 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not
s the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.261854 - https://vuldb.com/?ctiid.261854 - https://vuldb.com/?submit.317205 - https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/TX9/SetLEDCfg.md
CVE ID: CVE-2024-4112 State: PUBLISHED Published: 2024-04-24T14:31:04.752Z Last Updated: 2024-08-21T21:12:18.068Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C) Vendors: Tenda Products: TX9 Problem Types: CWE-121 Description: A vulnerability classified as critical has been found in Tenda TX9 22.03.02.10. This affects the function sub_42CB94 of the file /goform/SetVirtualServerCfg. The manipulation of the argument list leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-261855. NOTE: The vendor was contacted early about this disclosure but d
ociated identifier of this vulnerability is VDB-261855. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.261855 - https://vuldb.com/?ctiid.261855 - https://vuldb.com/?submit.317206 - https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/TX9/formSetVirtualSer.md
CVE ID: CVE-2024-4113 State: PUBLISHED Published: 2024-04-24T15:00:06.772Z Last Updated: 2024-08-01T20:33:52.536Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C) Vendors: Tenda Products: TX9 Problem Types: CWE-121 Description: A vulnerability classified as critical was found in Tenda TX9 22.03.02.10. This vulnerability affects the function sub_42D4DC of the file /goform/SetSysTimeCfg. The manipulation of the argument time leads to stack-based buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-261856. NOTE: The vendor was contacted early about this disclosure but did not respond in
of this vulnerability is VDB-261856. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.261856 - https://vuldb.com/?ctiid.261856 - https://vuldb.com/?submit.317217 - https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/TX9/fromSetSysTime.md
CVE ID: CVE-2024-4114 State: PUBLISHED Published: 2024-04-24T15:00:08.450Z Last Updated: 2024-08-01T20:33:52.409Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C) Vendors: Tenda Products: TX9 Problem Types: CWE-121 Description: A vulnerability, which was classified as critical, has been found in Tenda TX9 22.03.02.10. This issue affects the function sub_42C014 of the file /goform/PowerSaveSet. The manipulation of the argument time leads to stack-based buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-261857 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but d
entifier VDB-261857 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.261857 - https://vuldb.com/?ctiid.261857 - https://vuldb.com/?submit.317218 - https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/TX9/setSmartPowerManagement.md
CVE ID: CVE-2024-4115 State: PUBLISHED Published: 2024-04-24T15:31:05.160Z Last Updated: 2024-08-01T20:33:52.396Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C) Vendors: Tenda Products: W15E Problem Types: CWE-121 Description: A vulnerability, which was classified as critical, was found in Tenda W15E 15.11.0.14. Affected is the function formAddDnsForward of the file /goform/AddDnsForward. The manipulation of the argument DnsForwardRule leads to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-261858 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this di
be used. VDB-261858 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.261858 - https://vuldb.com/?ctiid.261858 - https://vuldb.com/?submit.317818 - https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/W15Ev1.0/formAddDnsForward.md