Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-46463 State: PUBLISHED Published: 2024-11-15T00:00:00 Last Updated: 2024-11-25T20:03:29.334Z Vendors: n/a Products: n/a Problem Types: n/a Description: By default, dedicated folders of ORIZON for Windows up to 2024.3 can be accessed by other users to misuse technical files and make them perform tasks with higher privileges. Configuration of ORIZON has to be modified to prevent this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.primx.eu/en/bulletins/security-bulletin-24932297/
CVE ID: CVE-2024-46464 State: PUBLISHED Published: 2025-01-09T00:00:00 Last Updated: 2025-01-10T17:19:59.505Z Vendors: n/a Products: n/a Problem Types: n/a Description: In PRIMX ZED Enterprise up to 2024.3, technical files stored in local folders with common user access can be manipulated to render the host computer unavailable or to execute programs with an elevation of privilege. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.primx.eu/en/bulletins/security-bulletin-24931935/
CVE ID: CVE-2024-46465 State: PUBLISHED Published: 2024-11-15T00:00:00 Last Updated: 2024-11-25T20:03:56.945Z Vendors: n/a Products: n/a Problem Types: n/a Description: By default, dedicated folders of CRYHOD for Windows up to 2024.3 can be accessed by other users to misuse technical files and make them perform tasks with higher privileges. Configuration of CRYHOD has to be modified to prevent this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.primx.eu/en/bulletins/security-bulletin-24932296/
CVE ID: CVE-2024-46466 State: PUBLISHED Published: 2024-11-15T00:00:00 Last Updated: 2024-11-25T20:01:58.685Z Vendors: n/a Products: n/a Problem Types: n/a Description: By default, dedicated folders of ZONECENTRAL for Windows up to 2024.3 or up to Q.2021.2 (ANSSI qualification submission) can be accessed by other users to misuse technical files and make them perform tasks with higher privileges. Configuration of ZONECENTRAL has to be modified to prevent this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.primx.eu/en/bulletins/security-bulletin-24931934/
CVE ID: CVE-2024-46467 State: PUBLISHED Published: 2024-11-15T00:00:00 Last Updated: 2024-11-25T20:04:28.642Z Vendors: n/a Products: n/a Problem Types: n/a Description: By default, dedicated folders of ZONEPOINT for Windows up to 2024.1 can be accessed by other users to misuse technical files and make them perform tasks with higher privileges. Configuration of ZONEPOINT has to be modified to prevent this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.primx.eu/en/bulletins/security-bulletin-24932299/
CVE ID: CVE-2024-46468 State: PUBLISHED Published: 2024-10-11T00:00:00 Last Updated: 2024-10-15T17:53:08.741Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Server-Side Request Forgery (SSRF) vulnerability exists in the jpress <= v5.1.1, which can be exploited by an attacker to obtain sensitive information, resulting in an information disclosure. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/JPressProjects/jpress/issues/190 - https://gist.github.com/ilikeoyt/b396bbb9ef858105c46e999630e7afbe
CVE ID: CVE-2024-46470 State: PUBLISHED Published: 2024-09-27T00:00:00 Last Updated: 2024-09-27T16:22:43.418Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting vulnerability in CodeAstro Membership Management System 1.0 allows attackers to run malicious JavaScript via the membership_type field in the edit-type.php component. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://codeastro.com/membership-management-system-in-php-with-source-code/ - https://github.com/JonMoriSenpai/CVE-WriteUps/blob/main/CodeAstro%20-%20MembershipM-PHP/CVE-2024-46470/writeup.md
CVE ID: CVE-2024-46471 State: PUBLISHED Published: 2024-09-27T00:00:00 Last Updated: 2024-09-27T16:22:33.810Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Directory Listing in /uploads/ Folder in CodeAstro Membership Management System 1.0 exposes the structure and contents of directories, potentially revealing sensitive information. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://codeastro.com/membership-management-system-in-php-with-source-code/ - https://github.com/JonMoriSenpai/CVE-WriteUps/blob/main/CodeAstro%20-%20MembershipM-PHP/CVE-2024-46471/writeup.md
CVE ID: CVE-2024-46472 State: PUBLISHED Published: 2024-09-27T00:00:00 Last Updated: 2024-09-27T15:21:23.488Z Vendors: n/a Products: n/a Problem Types: n/a Description: CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection via the parameter 'email' in the Login Page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://codeastro.com/membership-management-system-in-php-with-source-code/ - https://github.com/JonMoriSenpai/CVE-WriteUps/blob/main/CodeAstro%20-%20MembershipM-PHP/CVE-2024-46472/writeup.md
CVE ID: CVE-2024-46475 State: PUBLISHED Published: 2024-09-30T00:00:00 Last Updated: 2024-09-30T17:38:41.318Z Vendors: n/a Products: n/a Problem Types: n/a Description: A reflected cross-site scripting (XSS) vulnerability on the homepage of Metronic Admin Dashboard Template v2.0 allows attackers to execute arbitrary code in the context of a user's browser via injecting a crafted payload. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://blog.csdn.net/qq_45744104/article/details/141903463
CVE ID: CVE-2024-46478 State: PUBLISHED Published: 2024-10-24T00:00:00 Last Updated: 2024-10-25T20:03:38.105Z Vendors: n/a Products: n/a Problem Types: n/a Description: HTMLDOC v1.9.18 contains a buffer overflow in parse_pre function,ps-pdf.cxx:5681. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/michaelrsweet/htmldoc/issues/529 - https://github.com/michaelrsweet/htmldoc/commit/683bec548e642cf4a17e003fb34f6bbaf2d27b98
CVE ID: CVE-2024-46479 State: PUBLISHED Published: 2025-01-13T00:00:00 Last Updated: 2025-01-13T21:01:58.000Z Severity: CRITICAL (CVSS 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: Venki Products: Supravizio BPM Problem Types: CWE-434 Description: Venki Supravizio BPM through 18.0.1 was discovered to contain an arbitrary file upload vulnerability. An authenticated attacker may upload a malicious file, leading to remote code execution. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Lorenzo-de-Sa/Vulnerability-Research - https://www.venki.com.br/ferramenta-bpm/supravizio/ - https://github.com/Lorenzo-de-Sa/Vulnerability-Research/blob/main/CVE-2
://www.venki.com.br/ferramenta-bpm/supravizio/ - https://github.com/Lorenzo-de-Sa/Vulnerability-Research/blob/main/CVE-2024-46479.md
CVE ID: CVE-2024-46480 State: PUBLISHED Published: 2025-01-13T00:00:00 Last Updated: 2025-01-13T20:18:27.631Z Severity: HIGH (CVSS 8.4 CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: Venki Products: Supravizio BPM Problem Types: CWE-522 Description: An NTLM hash leak in Venki Supravizio BPM up to 18.0.1 allows authenticated attackers with Application Administrator access to escalate privileges on the underlying host system. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Lorenzo-de-Sa/Vulnerability-Research - https://www.venki.com.br/ferramenta-bpm/supravizio/ - https://github.com/Lorenzo-de-Sa/Vulnerability-Research/blob/main/CVE-2024-46480.md
CVE ID: CVE-2024-46481 State: PUBLISHED Published: 2025-01-13T00:00:00 Last Updated: 2025-01-13T20:19:10.156Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) Vendors: Venki Products: Supravizio BPM Problem Types: CWE-601 Description: The login page of Venki Supravizio BPM up to 18.1.1 is vulnerable to open redirect leading to reflected XSS. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Lorenzo-de-Sa/Vulnerability-Research - https://www.venki.com.br/ferramenta-bpm/supravizio/ - https://github.com/Lorenzo-de-Sa/Vulnerability-Research/blob/main/CVE-2024-46481.md
CVE ID: CVE-2024-46482 State: PUBLISHED Published: 2024-10-22T00:00:00 Last Updated: 2024-10-23T17:21:50.871Z Vendors: n/a Products: n/a Problem Types: n/a Description: An arbitrary file upload vulnerability in the Ticket Generation function of Ladybird Web Solution Faveo-Helpdesk v2.0.3 allows attackers to execute arbitrary code via uploading a crafted .html or .svg file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Asadiqbal2/Vulnerabilities-Research/tree/main/CVE-2024-46482
CVE ID: CVE-2024-46483 State: PUBLISHED Published: 2024-10-22T00:00:00 Last Updated: 2024-10-23T18:28:25.050Z Vendors: n/a Products: n/a Problem Types: n/a Description: Xlight FTP Server <3.9.4.3 has an integer overflow vulnerability in the packet parsing logic of the SFTP server, which can lead to a heap overflow with attacker-controlled content. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/kn32/cve-2024-46483
CVE ID: CVE-2024-46484 State: PUBLISHED Published: 2025-08-29T00:00:00.000Z Last Updated: 2025-08-29T19:40:25.096Z Vendors: n/a Products: n/a Problem Types: n/a Description: TRENDnet TV-IP410 vA1.0R was discovered to contain an OS command injection vulnerability via the /server/cgi-bin/testserv.cgi component. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://trendnet.com - https://gist.github.com/powalll/682c1b81696888fd692e595598f2ae3e
CVE ID: CVE-2024-46485 State: PUBLISHED Published: 2024-09-25T00:00:00 Last Updated: 2024-09-25T18:14:05.934Z Vendors: n/a Products: n/a Problem Types: n/a Description: dingfanzu CMS 1.0 was discovered to contain a Cross-Site Request Forgery (CSRF) via /admin/doAdminAction.php?act=addCate Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/kikaku-ship/cms/tree/main/1/readme.md
CVE ID: CVE-2024-46486 State: PUBLISHED Published: 2024-10-04T00:00:00 Last Updated: 2024-10-04T18:39:53.419Z Vendors: n/a Products: n/a Problem Types: n/a Description: TP-LINK TL-WDR5620 v2.3 was discovered to contain a remote code execution (RCE) vulnerability via the httpProcDataSrv function. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/fishykz/TP-POC - https://yuhehe88.github.io/2024/09/04/TL-WDR5620-Gigabit-Edition-v2-3/
CVE ID: CVE-2024-46488 State: PUBLISHED Published: 2024-09-25T00:00:00 Last Updated: 2024-09-25T20:08:50.464Z Vendors: n/a Products: n/a Problem Types: n/a Description: sqlite-vec v0.1.1 was discovered to contain a heap buffer overflow via the npy_token_next function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/VulnSphere/LLMVulnSphere/blob/main/VectorDB/sqlite-vec/OOBR_2.md
CVE ID: CVE-2024-46489 State: PUBLISHED Published: 2024-09-25T00:00:00 Last Updated: 2024-09-26T15:47:49.000Z Vendors: n/a Products: n/a Problem Types: n/a Description: A remote command execution (RCE) vulnerability in promptr v6.0.7 allows attackers to execute arbitrary commands via a crafted URL. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/VulnSphere/LLMVulnSphere/blob/main/Prompt/promptr/RCE_FC_6.0.7.md
CVE ID: CVE-2024-46494 State: PUBLISHED Published: 2025-04-07T00:00:00.000Z Last Updated: 2025-04-08T19:21:03.931Z Vendors: n/a Products: n/a Problem Types: n/a Description: A cross-site scripting (XSS) vulnerability in Typecho v1.2.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into Name parameter under a comment for an Article. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://h40vv3n.github.io/2024/09/05/typecho-xss/
CVE ID: CVE-2024-46503 State: REJECTED Published: 2024-09-30T00:00:00 Last Updated: 2024-10-10T13:42:07.709461 Description: No description available.
CVE ID: CVE-2024-46505 State: PUBLISHED Published: 2025-01-09T00:00:00.000Z Last Updated: 2025-01-23T17:25:18.715Z Vendors: n/a Products: n/a Problem Types: n/a Description: Infoblox BloxOne v2.4 was discovered to contain a business logic flaw due to thick client vulnerabilities. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://jayaramyalla.medium.com/bloxone-business-logic-flaw-due-to-thick-client-vulnerabilities-cve-2024-46505-04a4f1966f4b
CVE ID: CVE-2024-46506 State: PUBLISHED Published: 2025-05-13T00:00:00.000Z Last Updated: 2025-05-13T19:09:51.072Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: NetAlertX Products: NetAlertX Problem Types: CWE-306 Description: NetAlertX 23.01.14 through 24.x before 24.10.12 allows unauthenticated command injection via settings update because function=savesettings lacks an authentication requirement, as exploited in the wild in May 2025. This is related to settings.php and util.php. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://rhinosecuritylabs.com/research/cve-2024-46506-rce-in-netalertx/
CVE ID: CVE-2024-46510 State: PUBLISHED Published: 2024-09-30T00:00:00 Last Updated: 2024-09-30T20:55:27.684Z Vendors: n/a Products: n/a Problem Types: n/a Description: ESAFENET CDG v5 was discovered to contain a SQL injection vulnerability via the id parameter in the NavigationAjax interface Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://flowus.cn/share/c7784cff-2840-4761-8d1b-621016b6b1b9?code=G8A6P3
CVE ID: CVE-2024-46511 State: PUBLISHED Published: 2024-09-30T00:00:00 Last Updated: 2024-09-30T19:01:04.509Z Vendors: n/a Products: n/a Problem Types: n/a Description: LoadZilla LLC LoadLogic v1.4.3 was discovered to contain insecure permissions vulnerability which allows a remote attacker to execute arbitrary code via the LogicLoadEc2DeployLambda and CredsGenFunction function. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/zolaer9527/serverless-app/security/advisories/GHSA-3ggq-wrf4-c88v
CVE ID: CVE-2024-46528 State: PUBLISHED Published: 2024-10-14T00:00:00.000Z Last Updated: 2025-08-28T15:37:59.437Z Vendors: n/a Products: n/a Problem Types: n/a Description: An Insecure Direct Object Reference (IDOR) vulnerability in KubeSphere 4.x before 4.1.3 and 3.x through 3.4.1 and KubeSphere Enterprise 4.x before 4.1.3 and 3.x through 3.5.0 allows low-privileged authenticated attackers to access sensitive resources without proper authorization checks. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://okankurtulus.com.tr/2024/09/09/idor-vulnerability-in-kubesphere/ - https://kubesphere.io/ - https://github.com/kubesphere/kubesphere/issues/6227
CVE ID: CVE-2024-46531 State: PUBLISHED Published: 2024-10-30T00:00:00 Last Updated: 2024-10-31T15:53:02.874Z Vendors: n/a Products: n/a Problem Types: n/a Description: phpgurukul Vehicle Record Management System v1.0 was discovered to contain a SQL injection vulnerability via the searchinputdata parameter at /index.php. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/shouvikdutta1998/Vehicle_Record_Management_System
CVE ID: CVE-2024-46532 State: PUBLISHED Published: 2024-10-11T00:00:00 Last Updated: 2024-10-16T17:13:19.281Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL Injection vulnerability in OpenHIS v.1.0 allows an attacker to execute arbitrary code via the refund function in the PayController.class.php component. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://openhis.com - https://github.com/1638824607/OpenHIS?tab=readme-ov-file - https://github.com/KamenRiderDarker/CVE-2024-46532/tree/main/README.md
CVE ID: CVE-2024-46535 State: PUBLISHED Published: 2024-10-14T00:00:00.000Z Last Updated: 2025-03-18T14:10:30.920Z Vendors: n/a Products: n/a Problem Types: n/a Description: Jepaas v7.2.8 was discovered to contain a SQL injection vulnerability via the orderSQL parameter at /homePortal/loadUserMsg. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitee.com/ketr/jepaas-release/issues/IAPJ8H?from=project-issue
CVE ID: CVE-2024-46538 State: PUBLISHED Published: 2024-10-22T00:00:00 Last Updated: 2024-10-22T18:51:47.447Z Vendors: n/a Products: n/a Problem Types: n/a Description: A cross-site scripting (XSS) vulnerability in pfsense v2.5.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the $pconfig variable at interfaces_groups_edit.php. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/physicszq/web_issue/blob/main/pfsense/interfaces_groups_edit_file.md_xss.md - https://redmine.pfsense.org/issues/15778
CVE ID: CVE-2024-46539 State: PUBLISHED Published: 2024-10-08T00:00:00 Last Updated: 2024-10-08T20:03:32.116Z Vendors: n/a Products: n/a Problem Types: n/a Description: Insecure permissions in the Bluetooth Low Energy (BLE) component of Fire-Boltt Artillery Smart Watch NJ-R6E-10.3 allow attackers to cause a Denial of Service (DoS). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://nvd.nist.gov/vuln/detail/CVE-2024-32368 - https://github.com/harishmanam/-Fireboltt-Artillery-Smartwatch/blob/main/FB_Artillerysmart_watch_Security_Assessment_report.pdf
CVE ID: CVE-2024-46540 State: PUBLISHED Published: 2024-09-30T00:00:00 Last Updated: 2024-09-30T17:52:07.726Z Vendors: n/a Products: n/a Problem Types: n/a Description: A remote code execution (RCE) vulnerability in the component /admin/store.php of Emlog Pro before v2.3.15 allows attackers to use remote file downloads and self-extract fucntions to upload webshells to the target server, thereby obtaining system privileges. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/emlog/emlog - https://github.com/microvorld/CVE-2024/blob/main/emlog.md - https://gist.github.com/microvorld/1c1ef9c3390a5d88a5ede9f9424a8bd2
CVE ID: CVE-2024-46542 State: PUBLISHED Published: 2024-12-30T00:00:00.000Z Last Updated: 2025-10-17T14:54:09.212Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N) Vendors: Veritas Products: Data Insight Problem Types: CWE-89 Description: Veritas / Arctera Data Insight before 7.1.1 allows Application Administrators to conduct SQL injection attacks. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.veritas.com/support/en_US/security/ARC24-001 - https://github.com/MarioTesoro/vulnerability-research/tree/main/CVE-2024-46542
CVE ID: CVE-2024-46544 State: PUBLISHED Published: 2024-09-23T10:43:57.123Z Last Updated: 2024-10-31T19:59:53.770Z Vendors: Apache Software Foundation Products: Apache Tomcat Connectors Problem Types: CWE-276 Description: Incorrect Default Permissions vulnerability in Apache Tomcat Connectors allows local users to view and modify shared memory containing mod_jk configuration which may lead to information disclosure and/or denial of service. This issue affects Apache Tomcat Connectors: from 1.2.9-beta through 1.2.49. Only mod_jk on Unix like systems is affected. Neither the ISAPI redirector nor mod_jk on Windows is affected. Users are recommended to upgrade to version 1.2.50, which fixes the
ISAPI redirector nor mod_jk on Windows is affected. Users are recommended to upgrade to version 1.2.50, which fixes the issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://lists.apache.org/thread/q1gp7cc38hs1r8gj8gfnopwznd5fpr4d
CVE ID: CVE-2024-46546 State: PUBLISHED Published: 2025-04-22T00:00:00.000Z Last Updated: 2025-04-22T15:08:16.522Z Vendors: n/a Products: n/a Problem Types: n/a Description: NEXTU FLETA AX1500 WIFI6 Router v1.0.3 was discovered to contain a stack overflow via the url parameter at /boafrm/formFilter. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://ez-net.co.kr/new_2012/customer/download_view.php?cid=&sid=&goods=&cate=&q=&seq=233 - https://ez-net.co.kr/new_2012/product/view.php?cid=461&sid=467&q=%C7%C3%B7%B9%C5%B8&seq=3479&page= - https://gist.github.com/laskdjlaskdj12/5b
ew_2012/product/view.php?cid=461&sid=467&q=%C7%C3%B7%B9%C5%B8&seq=3479&page= - https://gist.github.com/laskdjlaskdj12/5b29b8b68f8a2279c9294708f080496b
CVE ID: CVE-2024-46547 State: PUBLISHED Published: 2024-12-09T00:00:00 Last Updated: 2024-12-11T15:46:58.242Z Vendors: n/a Products: n/a Problem Types: n/a Description: A vulnerability was found in Romain Bourdon Wampserver all versions (discovered in v3.2.3 and v3.2.6) where unauthorized users could access sensitive information due to improper access control validation via PHP Info Page. This issue can lead to data leaks. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gist.github.com/omkar170/232236c38b6e795fb73921e555e1a609
CVE ID: CVE-2024-46548 State: PUBLISHED Published: 2024-09-30T00:00:00 Last Updated: 2024-09-30T20:19:16.384Z Vendors: n/a Products: n/a Problem Types: n/a Description: TP-Link Tapo P125M and Kasa KP125M v1.0.3 was discovered to improperly validate certificates, allowing attackers to eavesdrop on communications and access sensitive information via a man-in-the-middle attack. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Chapoly1305/tp-link-cve/blob/main/CVE-2024-46548.md
CVE ID: CVE-2024-46549 State: PUBLISHED Published: 2024-09-30T00:00:00 Last Updated: 2024-09-30T20:51:18.694Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in the TP-Link MQTT Broker and API gateway of TP-Link Kasa KP125M v1.0.3 allows attackers to establish connections by impersonating devices owned by other users. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Chapoly1305/tp-link-cve/blob/main/CVE-2024-46549.md
CVE ID: CVE-2024-46550 State: PUBLISHED Published: 2024-09-18T00:00:00.000Z Last Updated: 2025-03-17T18:54:00.266Z Vendors: n/a Products: n/a Problem Types: n/a Description: Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the CGIbyFieldName parameter at chglog.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://ink-desk-28f.notion.site/Draytek-vigor-3910-Analysis-Report-b3b23e150c4f4bab822c3c47fd7b9de9#bffdd8897d944a77834b865d9326a1d7
CVE ID: CVE-2024-46551 State: PUBLISHED Published: 2024-09-18T00:00:00.000Z Last Updated: 2025-03-13T19:40:17.884Z Vendors: n/a Products: n/a Problem Types: n/a Description: Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the sBPA_Pwd parameter at inet15.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://ink-desk-28f.notion.site/Draytek-vigor-3910-Analysis-Report-b3b23e150c4f4bab822c3c47fd7b9de9#aabdeced2a5e407ba3b3c0d318af0a29
CVE ID: CVE-2024-46552 State: PUBLISHED Published: 2024-09-18T00:00:00.000Z Last Updated: 2025-03-17T19:50:44.348Z Vendors: n/a Products: n/a Problem Types: n/a Description: Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the sStRtMskShow parameter at ipstrt.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://ink-desk-28f.notion.site/Draytek-vigor-3910-Analysis-Report-b3b23e150c4f4bab822c3c47fd7b9de9#53ad238cc1af41f7a32b29260f7274ec
CVE ID: CVE-2024-46553 State: PUBLISHED Published: 2024-09-18T00:00:00.000Z Last Updated: 2025-03-19T17:48:59.977Z Vendors: n/a Products: n/a Problem Types: n/a Description: Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the ipaddrmsk%d parameter at v2x00.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://ink-desk-28f.notion.site/Draytek-vigor-3910-Analysis-Report-b3b23e150c4f4bab822c3c47fd7b9de9#1e21ab70186245aa8fb17578863216e2