Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-53473 State: PUBLISHED Published: 2024-12-07T00:00:00 Last Updated: 2025-01-03T16:31:09.513422Z Vendors: n/a Products: n/a Problem Types: n/a Description: WeGIA 3.2.0 before 3998672 does not verify permission to change a password. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wegia.org - https://github.com/nmmorette/vulnerability-research/tree/main/CVE-2024-53473 - https://github.com/nilsonLazarin/WeGIA/commit/3998672f1b86db58eab2808a640903d73b37bd2d - https://github.com/nilsonLazarin/WeGIA/issues/791 - https://github.com/nmmorette/vulnerability-research/blob/main/CVE-2024-53473/README.md
CVE ID: CVE-2024-53476 State: PUBLISHED Published: 2024-12-27T00:00:00 Last Updated: 2024-12-28T18:22:23.419Z Vendors: n/a Products: n/a Problem Types: n/a Description: A race condition vulnerability in SimplCommerce at commit 230310c8d7a0408569b292c5a805c459d47a1d8f allows attackers to bypass inventory restrictions by simultaneously submitting purchase requests from multiple accounts for the same product. This can lead to overselling when stock is limited, as the system fails to accurately track inventory under high concurrency, resulting in potential loss and unfulfilled orders. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/simplcommerce/SimplCommerce
orders. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/simplcommerce/SimplCommerce - https://github.com/AbdullahAlmutawa/CVE-2024-53476 - https://github.com/simplcommerce/SimplCommerce/issues/1111
CVE ID: CVE-2024-53477 State: PUBLISHED Published: 2024-12-02T00:00:00 Last Updated: 2024-12-11T16:00:18.279Z Vendors: n/a Products: n/a Problem Types: n/a Description: JFinal CMS 5.1.0 is vulnerable to Command Execution via unauthorized execution of deserialization in the file ApiForm.java Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/jflyfox/jfinal_cms/releases/tag/v5.1.0 - https://gist.github.com/kaoniniang2/c2deceea281fcd0aec5a8165183be3c1
CVE ID: CVE-2024-53480 State: PUBLISHED Published: 2024-12-10T00:00:00 Last Updated: 2024-12-12T14:33:41.206Z Vendors: n/a Products: n/a Problem Types: n/a Description: Phpgurukul's Beauty Parlour Management System v1.1 is vulnerable to SQL Injection in `login.php` via the `emailcont` parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://phpgurukul.com - https://github.com/sbksibi/CVEs/blob/main/CVE-2024-53480.md
CVE ID: CVE-2024-53481 State: PUBLISHED Published: 2024-12-10T00:00:00 Last Updated: 2024-12-10T20:53:12.815Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Cross Site Scripting (XSS) vulnerability in the profile.php of PHPGurukul Beauty Parlour Management System v1.1 allows remote attackers to execute arbitrary code by injecting arbitrary HTML into the "Firstname" and "Last name" parameters. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://phpgurukul.com - https://github.com/sbksibi/CVEs/blob/main/CVE-2024-53481.md
CVE ID: CVE-2024-53484 State: PUBLISHED Published: 2024-12-02T00:00:00 Last Updated: 2024-12-03T16:06:31.926Z Vendors: n/a Products: n/a Problem Types: n/a Description: Ever Traduora 0.20.0 and below is vulnerable to Privilege Escalation due to the use of a hard-coded JWT signing key. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/ever-co/ever-traduora/issues/431%2C - https://github.com/ever-co/ever-traduora/pull/432%2C - https://youtu.be/8JL89syikLE - https://github.com/yamerooo123/CVE/blob/main/CVE-2024-53484/Description.md
CVE ID: CVE-2024-53490 State: PUBLISHED Published: 2024-12-05T00:00:00 Last Updated: 2024-12-11T16:45:59.481Z Vendors: n/a Products: n/a Problem Types: n/a Description: Favorites-web 1.3.0 favorites-web has a directory traversal vulnerability in SecurityFilter.java. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/DYX217/directory-traversal
CVE ID: CVE-2024-53494 State: PUBLISHED Published: 2025-08-22T00:00:00.000Z Last Updated: 2025-08-26T14:07:51.588Z Vendors: n/a Products: n/a Problem Types: n/a Description: Incorrect access control in the preHandle function of SpringBootBlog v1.0.0 allows attackers to access sensitive components without authentication. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/caozongpeng/SpringBootBlog/issues/23 - https://gitee.com/fushuling/cve/blob/master/CVE-2024-53494.md
CVE ID: CVE-2024-53495 State: PUBLISHED Published: 2025-08-20T00:00:00.000Z Last Updated: 2025-08-21T13:43:50.384Z Vendors: n/a Products: n/a Problem Types: n/a Description: Incorrect access control in the preHandle function of my-site v1.0.2.RELEASE allows attackers to access sensitive components without authentication. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/WinterChenS/my-site/issues/88
CVE ID: CVE-2024-53496 State: PUBLISHED Published: 2025-08-22T00:00:00.000Z Last Updated: 2025-08-22T17:59:07.157Z Vendors: n/a Products: n/a Problem Types: n/a Description: Incorrect access control in the doFilter function of my-site v1.0.2.RELEASE allows attackers to access sensitive components without authentication. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/5kywa1ker/mall/issues/19 - https://gitee.com/fushuling/cve/blob/master/CVE-2024-53496.md
CVE ID: CVE-2024-53499 State: PUBLISHED Published: 2025-08-22T00:00:00.000Z Last Updated: 2025-08-26T14:07:38.032Z Vendors: n/a Products: n/a Problem Types: n/a Description: Jeewms v3.7 was discovered to contain a SQL injection vulnerability via the CgReportController API. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitee.com/erzhongxmu/JEEWMS/issues/IB2XZG - http://www.huayi-tec.com/ - https://gitee.com/fushuling/cve/blob/master/CVE-2024-53499.md
CVE ID: CVE-2024-53502 State: PUBLISHED Published: 2024-12-03T00:00:00 Last Updated: 2024-12-04T17:34:23.439Z Vendors: n/a Products: n/a Problem Types: n/a Description: Seecms v4.8 was discovered to contain a SQL injection vulnerability in the SEMCMS_SeoAndTag.php page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Megrez0423/sescms4.8/tree/main
CVE ID: CVE-2024-53504 State: PUBLISHED Published: 2024-11-29T00:00:00 Last Updated: 2024-12-02T16:52:51.716Z Vendors: n/a Products: n/a Problem Types: n/a Description: A SQL injection vulnerability has been identified in Siyuan 3.1.11 via the notebook parameter in /searchHistory. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/siyuan-note/siyuan/issues/13058 - https://github.com/siyuan-note/siyuan/issues/13077
CVE ID: CVE-2024-53505 State: PUBLISHED Published: 2024-11-29T00:00:00 Last Updated: 2024-12-02T16:50:27.594Z Vendors: n/a Products: n/a Problem Types: n/a Description: A SQL injection vulnerability has been identified in Siyuan 3.1.11 via the id parameter at /getAssetContent. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/siyuan-note/siyuan/issues/13077 - https://github.com/siyuan-note/siyuan/issues/13059
CVE ID: CVE-2024-53506 State: PUBLISHED Published: 2024-11-29T00:00:00 Last Updated: 2024-12-02T16:47:00.312Z Vendors: n/a Products: n/a Problem Types: n/a Description: A SQL injection vulnerability has been identified in Siyuan 3.1.11 via the ids array parameter in /batchGetBlockAttrs. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/siyuan-note/siyuan/issues/13077 - https://github.com/siyuan-note/siyuan/issues/13060
CVE ID: CVE-2024-53507 State: PUBLISHED Published: 2024-11-29T00:00:00 Last Updated: 2024-12-02T16:44:19.424Z Vendors: n/a Products: n/a Problem Types: n/a Description: A SQL injection vulnerability was discovered in Siyuan 3.1.11 in /getHistoryItems. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/siyuan-note/siyuan/issues/13077 - https://github.com/siyuan-note/siyuan/issues/13057
CVE ID: CVE-2024-53522 State: PUBLISHED Published: 2025-01-07T00:00:00 Last Updated: 2025-01-09T15:33:12.050434Z Vendors: n/a Products: n/a Problem Types: n/a Description: Bangkok Medical Software HOSxP XE v4.64.11.3 was discovered to contain a hardcoded IDEA Key-IV pair in the HOSxPXE4.exe and HOS-WIN32.INI components. This allows attackers to access sensitive information. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://bangkok.com - http://hosxp.com - https://www.safecloud.co.th/researches/blog/CVE-2024-53522 - http://hosxp.net
CVE ID: CVE-2024-53523 State: PUBLISHED Published: 2024-12-05T00:00:00 Last Updated: 2024-12-11T16:25:31.558Z Vendors: n/a Products: n/a Problem Types: n/a Description: JSFinder commit d70ab9bc5221e016c08cffaf0d9ac79646c90645 is vulnerable to Directory Traversal in the find_by_file function. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Threezh1/JSFinder - https://github.com/Threezh1/JSFinder/issues/33
CVE ID: CVE-2024-53526 State: PUBLISHED Published: 2025-01-08T00:00:00.000Z Last Updated: 2025-01-31T17:49:10.424Z Vendors: n/a Products: n/a Problem Types: n/a Description: composio >=0.5.40 is vulnerable to Command Execution in composio_openai, composio_claude, and composio_julep via the handle_tool_calls function. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/ComposioHQ/composio/blob/11ee7470aa6543097ee30bb036af8e9726dc7a85/python/plugins/openai/composio_openai/toolset.py#L184 - https://github.com/ComposioHQ/composio/blob/11ee7470aa6543097ee30bb036af8e9726dc7a85/python/plugins/claude/composio_claude/toolset.py#L156 - https://github.com/ComposioHQ/comp
543097ee30bb036af8e9726dc7a85/python/plugins/claude/composio_claude/toolset.py#L156 - https://github.com/ComposioHQ/composio/blob/11ee7470aa6543097ee30bb036af8e9726dc7a85/python/plugins/julep/composio_julep/toolset.py#L21 - https://github.com/ComposioHQ/composio/issues/1073
CVE ID: CVE-2024-53537 State: PUBLISHED Published: 2025-01-31T00:00:00.000Z Last Updated: 2025-03-20T14:29:25.608Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in OpenPanel v0.3.4 to v0.2.1 allows attackers to execute a directory traversal in File Actions of File Manager. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://openpanel.com/docs/changelog/0.3.5/#%EF%B8%8F-security-fixes - https://packetstorm.news/files/id/188913/
CVE ID: CVE-2024-53542 State: PUBLISHED Published: 2025-02-24T00:00:00.000Z Last Updated: 2025-02-25T20:29:23.940Z Vendors: n/a Products: n/a Problem Types: n/a Description: Incorrect access control in the component /iclock/Settings?restartNCS=1 of NovaCHRON Zeitsysteme GmbH & Co. KG Smart Time Plus v8.x to v8.6 allows attackers to arbitrarily restart the NCServiceManger via a crafted GET request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://secure77.de/smart-time-plus-rce-cve-2024-53543/
CVE ID: CVE-2024-53543 State: PUBLISHED Published: 2025-02-24T00:00:00.000Z Last Updated: 2025-02-25T20:14:13.406Z Vendors: n/a Products: n/a Problem Types: n/a Description: NovaCHRON Zeitsysteme GmbH & Co. KG Smart Time Plus v8.x to v8.6 was discovered to contain a SQL injection vulnerability via the addProject method in the smarttimeplus/MySQLConnection endpoint. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://secure77.de/smart-time-plus-rce-cve-2024-53543/
CVE ID: CVE-2024-53544 State: PUBLISHED Published: 2025-02-24T00:00:00.000Z Last Updated: 2025-02-25T14:34:51.852Z Vendors: n/a Products: n/a Problem Types: n/a Description: NovaCHRON Zeitsysteme GmbH & Co. KG Smart Time Plus v8.x to v8.6 was discovered to contain a SQL injection vulnerability via the getCookieNames method in the smarttimeplus/MySQLConnection endpoint. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://secure77.de/smart-time-plus-rce-cve-2024-53543/
CVE ID: CVE-2024-53552 State: PUBLISHED Published: 2024-12-10T00:00:00 Last Updated: 2024-12-11T15:26:27.063Z Vendors: n/a Products: n/a Problem Types: n/a Description: CrushFTP 10 before 10.8.3 and 11 before 11.2.3 mishandles password reset, leading to account takeover. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.crushftp.com/crush11wiki/Wiki.jsp?page=Update
CVE ID: CVE-2024-53553 State: PUBLISHED Published: 2025-01-16T00:00:00.000Z Last Updated: 2025-02-03T20:33:28.708Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in OPEXUS FOIAXPRESS PUBLIC ACCESS LINK v11.1.0 allows attackers to bypass authentication via crafted web requests. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://infosecwriteups.com/exploiting-execute-after-redirect-ear-vulnerability-in-htb-previse-92ea3f1dbf3d - https://github.com/Turbul3nce/Vulnerability.Research/tree/main/CVE-2024-53553
CVE ID: CVE-2024-53554 State: PUBLISHED Published: 2024-11-25T00:00:00 Last Updated: 2024-11-26T15:26:04.957Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Client-Side Template Injection (CSTI) vulnerability in the component /project/new/scrum of Taiga v 8.6.1 allows remote attackers to execute arbitrary code by injecting a malicious payload within the new project details. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://drive.google.com/file/d/1v2MLZn4Ro9TCpw-KtksUACYFIzsbuTkL/view?usp=sharing - https://gist.githubusercontent.com/Tommywarren/5ed67ab173ed60faeb791215d68e3fac/raw/352cb4259c0d41d70a206d108b5578c15824b2ff/CVE-2024-53554
CVE ID: CVE-2024-53555 State: PUBLISHED Published: 2024-11-26T00:00:00 Last Updated: 2024-11-26T21:09:25.421Z Vendors: n/a Products: n/a Problem Types: n/a Description: A CSV injection vulnerability in Taiga v6.8.1 allows attackers to execute arbitrary code via uploading a crafted CSV file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://drive.google.com/file/d/1M4UjoTUqlPWLYjevCuE3WhdUqQkRj0-r/view?usp=drive_link - https://gist.githubusercontent.com/Tommywarren/bb1287d17ac83f2e277c0dea798f6ff7/raw/e21132dbaf81e210c2e1cb5babfc4dcca9b2c0d8/CVE-2024-53555
CVE ID: CVE-2024-53556 State: PUBLISHED Published: 2024-11-25T00:00:00 Last Updated: 2024-11-27T16:27:13.293Z Vendors: n/a Products: n/a Problem Types: n/a Description: An Open Redirect vulnerability in Taiga v6.8.1 allows attackers to redirect users to arbitrary websites via appending a crafted link to /login?next= in the login page URL. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://drive.google.com/file/d/1CIr8oHSF4JaqOn51wIhyZyvsCtlX0Q_e/view?usp=drive_link - https://gist.githubusercontent.com/Tommywarren/b42479a048aa8ef11a63a76d14403443/raw/e24c1003accf8daf2e840b7c67d2f0ab30bdd3e6/CVE-2024-53556
CVE ID: CVE-2024-53561 State: PUBLISHED Published: 2025-01-14T00:00:00.000Z Last Updated: 2025-01-31T16:45:22.879Z Vendors: n/a Products: n/a Problem Types: n/a Description: A remote code execution (RCE) vulnerability in Arcadyan Meteor 2 CPE FG360 Firmware ETV2.10 allows attackers to execute arbitrary code via a crafted request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.arcadyan.com/en-us/solutions/idea/fiveG/ - https://github.com/Mrnmap/mrnmap-cve/blob/main/CVE-2024-53561
CVE ID: CVE-2024-53563 State: PUBLISHED Published: 2025-01-14T00:00:00 Last Updated: 2025-01-16T17:19:38.641Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stored cross-site scripting (XSS) vulnerability in Arcadyan Meteor 2 CPE FG360 Firmware ETV2.10 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.arcadyan.com/en-us/solutions/idea/fiveG/ - https://github.com/Mrnmap/mrnmap-cve/blob/main/CVE-2024-53563.
CVE ID: CVE-2024-53564 State: PUBLISHED Published: 2024-12-02T00:00:00 Last Updated: 2025-01-14T16:41:16.578Z Severity: LOW (CVSS 2.2 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N) Vendors: Sangoma Products: FreePBX Problem Types: CWE-434 Description: A vulnerability was discovered in FreePBX 17.0.19.17. It does not verify the type of uploaded (valid FreePBX module) files, allowing high-privilege administrators to insert unwanted files. NOTE: the Supplier's position is that there is no risk beyond what high-privilege administrators are intentionally allowed to do. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gist.github.com/hyp164D1/490732de230edf97423f6d95b0d2f903
Analyst Notes: - CISA ADP Vulnrichment: References: - https://gist.github.com/hyp164D1/490732de230edf97423f6d95b0d2f903 - https://gist.github.com/hyp164D1/d419bdf3e7e352088a21631d0f452a8c
CVE ID: CVE-2024-53566 State: PUBLISHED Published: 2024-12-02T00:00:00.000Z Last Updated: 2025-02-06T01:29:55.639Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in the action_listcategories() function of Sangoma Asterisk v22/22.0.0/22.0.0-rc1/22.0.0-rc2/22.0.0-pre1 allows attackers to execute a path traversal. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/asterisk/asterisk/blob/22/main/manager.c#L2556 - https://gist.github.com/hyp164D1/e7c0f44ffb38c00320aa1a6d98bee616
CVE ID: CVE-2024-53568 State: PUBLISHED Published: 2025-04-22T00:00:00.000Z Last Updated: 2025-04-23T13:56:44.111Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stored cross-site scripting (XSS) vulnerability in the Image Upload section of Volmarg Personal Management System v1.4.65 allows authenticated attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the tag parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://medium.com/@rudranshsinghrajpurohit/cve-2024-53568-stored-cross-site-scripting-xss-vulnerability-in-volmarg-personal-management-cfbaec55046f - https://www.getastra.com/blog/vulnerability/cve-2024-53568
s-vulnerability-in-volmarg-personal-management-cfbaec55046f - https://www.getastra.com/blog/vulnerability/cve-2024-53568stored-cross-site-scripting-xss-vulnerability-in-volmarg-personal-management-system/
CVE ID: CVE-2024-53569 State: PUBLISHED Published: 2025-04-22T00:00:00.000Z Last Updated: 2025-04-22T20:17:43.352Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stored cross-site scripting (XSS) vulnerability in the New Goal Creation section of Volmarg Personal Management System v1.4.65 allows authenticated attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the description parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://medium.com/@rudranshsinghrajpurohit/cve-2024-53569-stored-cross-site-scripting-xss-in-volmarg-personal-management-system-6cb0b9d6fe88 - https://www.getastra.com/blog/vulnerability/cve-2024
-scripting-xss-in-volmarg-personal-management-system-6cb0b9d6fe88 - https://www.getastra.com/blog/vulnerability/cve-2024-53569stored-cross-site-scripting-xss-in-volmarg-personal-management-system/
CVE ID: CVE-2024-53573 State: PUBLISHED Published: 2025-02-26T00:00:00.000Z Last Updated: 2025-03-04T20:58:29.959Z Vendors: n/a Products: n/a Problem Types: n/a Description: Unifiedtransform v2.X is vulnerable to Incorrect Access Control. Unauthorized users can access and manipulate endpoints intended exclusively for administrative use. This issue specifically affects teacher/edit/{id}. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://drive.google.com/file/d/14Or6QIpOeLEqdFm1mwxdE_NNCOwMmcFc/view - https://www.getastra.com/blog/vulnerability/improper-access-control-in-school-management-system-unifiedtransform/
CVE ID: CVE-2024-53580 State: PUBLISHED Published: 2024-12-18T00:00:00.000Z Last Updated: 2025-11-03T20:48:15.168Z Vendors: n/a Products: n/a Problem Types: n/a Description: iperf v3.17.1 was discovered to contain a segmentation violation via the iperf_exchange_parameters() function. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://gist.github.com/neolead/663badf2ebefefa6fe4303695e7aa7a3 - https://github.com/esnet/iperf/releases/tag/3.18
CVE ID: CVE-2024-53582 State: PUBLISHED Published: 2025-01-31T00:00:00.000Z Last Updated: 2025-03-24T16:27:40.139Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue found in the Copy and View functions in the File Manager component of OpenPanel v0.3.4 allows attackers to execute a directory traversal via a crafted HTTP request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://packetstorm.news/files/id/188913/ - https://openpanel.com/docs/changelog/0.3.5/#%EF%B8%8F-security-fixes
CVE ID: CVE-2024-53584 State: PUBLISHED Published: 2025-01-31T00:00:00.000Z Last Updated: 2025-03-18T18:43:24.465Z Vendors: n/a Products: n/a Problem Types: n/a Description: OpenPanel v0.3.4 was discovered to contain an OS command injection vulnerability via the timezone parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://openpanel.com/docs/changelog/0.3.5/#%EF%B8%8F-security-fixes - https://packetstorm.news/files/id/188915/
CVE ID: CVE-2024-53586 State: PUBLISHED Published: 2025-02-06T00:00:00.000Z Last Updated: 2025-02-11T14:42:52.988Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in the relPath parameter of WebFileSys version 2.31.0 allows attackers to perform directory traversal via a crafted HTTP request. By injecting traversal payloads into the parameter, attackers can manipulate file paths and gain unauthorized access to sensitive files, potentially exposing data outside the intended directory. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://packetstorm.news/files/id/189017
CVE ID: CVE-2024-53588 State: PUBLISHED Published: 2025-01-23T00:00:00.000Z Last Updated: 2025-01-24T21:23:26.156Z Vendors: n/a Products: n/a Problem Types: n/a Description: A DLL hijacking vulnerability in iTop VPN v16.0 allows attackers to execute arbitrary code via placing a crafted DLL file into the path \ProgramData\iTop VPN\Downloader\vpn6. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/JonathanLauener/iTop-privesc
CVE ID: CVE-2024-53589 State: PUBLISHED Published: 2024-12-05T00:00:00.000Z Last Updated: 2025-03-14T10:03:05.601Z Vendors: n/a Products: n/a Problem Types: n/a Description: GNU objdump 2.43 is vulnerable to Buffer Overflow in the BFD (Binary File Descriptor) library's handling of tekhex format files. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.gnu.org/software/binutils/ - https://bushido-sec.com/index.php/2024/12/05/binutils-objdump-tekhex-buffer-overflow/
CVE ID: CVE-2024-53591 State: PUBLISHED Published: 2025-04-18T00:00:00.000Z Last Updated: 2025-04-21T02:57:42.548Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in the login page of Seclore v3.27.5.0 allows attackers to bypass authentication via a brute force attack. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/aljoharasubaie/CVE-2024-53591
CVE ID: CVE-2024-53597 State: PUBLISHED Published: 2024-11-25T00:00:00 Last Updated: 2024-11-27T20:35:38.031Z Vendors: n/a Products: n/a Problem Types: n/a Description: masterstack_imgcap v0.0.1 was discovered to contain a SQL injection vulnerability via the endpoint /submit. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://masterstackimgcap.com - https://github.com/NoPurposeInLife/vulnerability_research/tree/main/CVE-2024-53597
CVE ID: CVE-2024-53599 State: PUBLISHED Published: 2024-11-25T00:00:00 Last Updated: 2024-11-25T20:16:35.702Z Vendors: n/a Products: n/a Problem Types: n/a Description: A cross-site scripting (XSS) vulnerability in the /scroll.php endpoint of LafeLabs Chaos v0.0.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/NoPurposeInLife/vulnerability_research/tree/main/CVE-2024-53599