Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-53345 State: PUBLISHED Published: 2025-01-07T00:00:00 Last Updated: 2025-01-07T19:29:36.903Z Vendors: n/a Products: n/a Problem Types: n/a Description: An authenticated arbitrary file upload vulnerability in Car Rental Management System v1.0 to v1.3 allows attackers to execute arbitrary code via uploading a crafted file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://car.com - https://github.com/ShadowByte1/CVE-2024-53345
CVE ID: CVE-2024-53348 State: PUBLISHED Published: 2025-03-21T00:00:00.000Z Last Updated: 2025-03-24T18:04:15.441Z Vendors: n/a Products: n/a Problem Types: n/a Description: LoxiLB v.0.9.7 and before is vulnerable to Incorrect Access Control which allows attackers to obtain sensitive information and escalate privileges. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/loxilb-io/loxilb - https://gist.github.com/HouqiyuA/8c734c849c1a9b69ac96c46eba4acbcb
CVE ID: CVE-2024-53349 State: PUBLISHED Published: 2025-03-21T00:00:00.000Z Last Updated: 2025-03-24T18:06:35.847Z Vendors: n/a Products: n/a Problem Types: n/a Description: Insecure permissions in kuadrant v0.11.3 allow attackers to gain access to the service account's token, leading to escalation of privileges via the secretes component in the k8s cluster Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Kuadrant/kuadrant-operator - https://www.cncf.io/projects/kuadrant/ - https://gist.github.com/HouqiyuA/2a34c8f95dac7d9d8d7df7732403f383
CVE ID: CVE-2024-53350 State: PUBLISHED Published: 2025-03-21T00:00:00.000Z Last Updated: 2025-03-24T18:07:36.466Z Vendors: n/a Products: n/a Problem Types: n/a Description: Insecure permissions in kubeslice v1.3.1 allow attackers to gain access to the service account's token, leading to escalation of privileges. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/kubeslice/kubeslice - https://kubeslice.io/documentation/open-source/1.3.0 - https://gist.github.com/HouqiyuA/1cb964206e0d6bebd1c57a124c55fa03
CVE ID: CVE-2024-53351 State: PUBLISHED Published: 2025-03-21T00:00:00.000Z Last Updated: 2025-03-24T14:47:23.712Z Vendors: n/a Products: n/a Problem Types: n/a Description: Insecure permissions in pipecd v0.49 allow attackers to gain access to the service account's token, leading to escalation of privileges. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/pipe-cd/pipecd - https://pipecd.dev/ - https://gist.github.com/HouqiyuA/948a808b8bd48b17b37a4d5e0b6fb005
CVE ID: CVE-2024-53354 State: PUBLISHED Published: 2025-01-31T00:00:00.000Z Last Updated: 2025-02-07T16:09:29.365Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple SQL injection vulnerabilities in EasyVirt DCScope <= 8.6.0 and CO2Scope <= 1.3.0 allows remote authenticated attackers to execute arbitrary SQL commands via the (1) user parameter to /api/management/findfilterlist; the (2) user or (3) filter parameter to /api/audit/findmetawatcher; the (4) user parameter to /api/audit/findmetaalert; the (5) user parameter to /api/management/ds; the (6) user or (7) filter parameter to /api/audit/findmetarunalert; the (7) user parameter to /api/management/findtimeview; the (8) use
(7) filter parameter to /api/audit/findmetarunalert; the (7) user parameter to /api/management/findtimeview; the (8) user, (9) filter or (10) target parameter to /api/management/getihmsettings; the (11) user or (12) filter parameter to /api/management/elementstype; the (14) login, (15) user, (16) is_local, (17) is_ldap, or (18) is_openid parameter to /api/user/addalias; the (19) role parameter to /api/user/addrole; the (20) user or (21) filter parameter to /api/management/addtimeview; the (22) TIMEAGO, (23) IDENTIFIER, (24) USER, (25) NAME, or (26) COST parameter to /api/management/addtagcosts; the (27) USER, or (28) VM_COST parameter to /api/management/updategenericcpucost; the (29) VM, (30
nagement/addtagcosts; the (27) USER, or (28) VM_COST parameter to /api/management/updategenericcpucost; the (29) VM, (30) HOST, or (31) STORAGE parameter to /api/management/updatecostinfo; the (32) user, (33) filter, or (34) timeago parameter to /api/management/addfilter; the (35) user parameter to /api/report/getreporthistory. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Elymaro/CVE/blob/main/EasyVirt/CVE-2024-53354.md
CVE ID: CVE-2024-53355 State: PUBLISHED Published: 2025-01-31T00:00:00.000Z Last Updated: 2025-02-07T16:02:44.540Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple incorrect access control issues in EasyVirt DCScope <= 8.6.0 and CO2Scope <= 1.3.0 allows remote authenticated attackers, with low privileges, to (1) add an admin user via the /api/user/addalias route; (2) modifiy a user via the /api/user/updatealias route; (4) delete users via the /api/user/delalias route; (4) get users via the /api/user/aliases route; (5) add a root group via the /api/user/adduser route; (6) modifiy a group via the /api/user/updateuser route; (7) delete a group via the /api/user/deluser route;
duser route; (6) modifiy a group via the /api/user/updateuser route; (7) delete a group via the /api/user/deluser route; (8) get groups via the /api/user/users route; (9) add an admin role via the /api/user/addrole route; (10) modifiy a role via the /api/user/updaterole route; (11) delete a role via the /api/user/delrole route; (12) get roles via the /api/user/roles route. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Elymaro/CVE/blob/main/EasyVirt/CVE-2024-53355.md
CVE ID: CVE-2024-53356 State: PUBLISHED Published: 2025-01-31T00:00:00.000Z Last Updated: 2025-02-07T16:21:06.385Z Vendors: n/a Products: n/a Problem Types: n/a Description: Weak JWT Secret vulnerabilitiy in EasyVirt DCScope <= 8.6.0 and CO2Scope <= 1.3.0 allows remote attackers to generate JWT for privilege escalation. The HMAC secret used for generating tokens is hardcoded as "somerandomaccesstoken". A weak HMAC secret poses a risk because attackers can use the predictable secret to create valid JSON Web Tokens (JWTs), allowing them access to important information and actions within the application. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Elymaro
ions within the application. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Elymaro/CVE/blob/main/EasyVirt/CVE-2024-53356.md
CVE ID: CVE-2024-53357 State: PUBLISHED Published: 2025-01-31T00:00:00.000Z Last Updated: 2025-02-10T22:16:33.382Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple SQL injection vulnerabilities in EasyVirt DCScope <= 8.6.0 and CO2Scope <= 1.3.0 allows remote authenticated attackers, with low privileges, to (1) add an admin user via the /api/user/addalias route; (2) modifiy a user via the /api/user/updatealiasroute; (4) delete users via the /api/user/delalias route; (4) get users via the /api/user/aliases route; (5) add a root group via the /api/user/adduserroute; (6) modifiy a group via the /api/user/updateuser route; (7) delete a group via the /api/user/deluser route; (8)
erroute; (6) modifiy a group via the /api/user/updateuser route; (7) delete a group via the /api/user/deluser route; (8) get groups via the /api/user/usersroute; (9) add an admin role via the /api/user/addrole route; (10) modifiy a role via the /api/user/updaterole route; (11) delete a role via the /api/user/delrole route; (12) get roles via the /api/user/roles route. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Elymaro/CVE/blob/main/EasyVirt/CVE-2024-53357.md
CVE ID: CVE-2024-53359 State: PUBLISHED Published: 2025-05-20T00:00:00.000Z Last Updated: 2025-05-20T18:00:18.851Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in Zalo v23.09.01 allows attackers to obtain sensitive user information via a crafted GET request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.linkedin.com/in/le-anh-truong/ - https://github.com/crysalix4/CVE/tree/main/CVE-2024-53359
CVE ID: CVE-2024-53364 State: PUBLISHED Published: 2024-12-02T00:00:00 Last Updated: 2024-12-02T19:27:50.051Z Vendors: n/a Products: n/a Problem Types: n/a Description: A SQL injection vulnerability was found in PHPGURUKUL Vehicle Parking Management System v1.13 in /users/view-detail.php. This vulnerability affects the viewid parameter, where improper input sanitization allows attackers to inject malicious SQL queries. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://phpgurukul.com - https://github.com/SCR-athif/CVE/tree/main/CVE-2024-53364
CVE ID: CVE-2024-53365 State: PUBLISHED Published: 2024-11-26T00:00:00 Last Updated: 2024-11-26T19:38:40.406Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stored cross-site scripting (XSS) vulnerability was identified in PHPGURUKUL Vehicle Parking Management System v1.13 in /users/profile.php. This vulnerability allows authenticated users to inject malicious XSS scripts into the profile name field. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://phpgurukul.com - https://github.com/SCR-athif/CVE/tree/main/CVE-2024-53365
CVE ID: CVE-2024-53375 State: PUBLISHED Published: 2024-12-02T00:00:00 Last Updated: 2024-12-17T20:26:57.333894Z Vendors: n/a Products: n/a Problem Types: n/a Description: An Authenticated Remote Code Execution (RCE) vulnerability affects the TP-Link Archer router series. A vulnerability exists in the "tmp_get_sites" function of the HomeShield functionality provided by TP-Link. This vulnerability is still exploitable without the activation of the HomeShield functionality. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/ThottySploity/CVE-2024-53375 - https://thottysploity.github.io/posts/cve-2024-53375/
CVE ID: CVE-2024-53376 State: PUBLISHED Published: 2024-12-16T00:00:00 Last Updated: 2024-12-17T19:29:25.640Z Vendors: n/a Products: n/a Problem Types: n/a Description: CyberPanel before 2.3.8 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the phpSelection field to the websites/submitWebsiteCreation URI. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/ThottySploity/CVE-2024-53376 - https://thottysploity.github.io/posts/cve-2024-53376 - https://github.com/ThottySploity/CVE-2024-53376/blob/aa306187323bd1127d56803cb34cac8820b61484/cyberpanel.py#L70
CVE ID: CVE-2024-53379 State: PUBLISHED Published: 2025-01-23T00:00:00.000Z Last Updated: 2025-02-27T19:06:26.144Z Vendors: n/a Products: n/a Problem Types: n/a Description: Heap buffer overflow in the server site handshake implementation in Real Time Logic LLC's SharkSSL version (from 05/05/24) commit 64808a5e12c83b38f85c943dee0112e428dc2a43 allows a remote attacker to trigger a Denial-of-Service via a malformed Client-Hello message. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.telekom.com/resource/blob/1086326/e6e800ec1e4e675ca0d8fdafab86ea8c/dl-250122-cve-2024-53379-data.pdf
CVE ID: CVE-2024-53382 State: PUBLISHED Published: 2025-03-03T00:00:00.000Z Last Updated: 2025-03-03T21:53:33.210Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: PrismJS Products: Prism Problem Types: CWE-94 Description: Prism (aka PrismJS) through 1.29.0 allows DOM Clobbering (with resultant XSS for untrusted input that contains HTML but does not directly contain JavaScript), because document.currentScript lookup can be shadowed by attacker-injected HTML elements. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gist.github.com/jackfromeast/aeb128e44f05f95828a1a824708df660 - https://github.com/PrismJS/prism/blob/59e5a3471377057de1f4
st.github.com/jackfromeast/aeb128e44f05f95828a1a824708df660 - https://github.com/PrismJS/prism/blob/59e5a3471377057de1f401ba38337aca27b80e03/prism.js#L226-L259
CVE ID: CVE-2024-53384 State: PUBLISHED Published: 2025-03-03T00:00:00.000Z Last Updated: 2025-03-05T18:38:17.450Z Vendors: n/a Products: n/a Problem Types: n/a Description: A DOM Clobbering vulnerability in tsup v8.3.4 allows attackers to execute arbitrary code via a crafted script in the import.meta.url to document.currentScript in cjs_shims.js components Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gist.github.com/jackfromeast/36f98bf7542d11835c883c1d175d9b92
CVE ID: CVE-2024-53386 State: PUBLISHED Published: 2025-03-03T00:00:00.000Z Last Updated: 2025-03-03T21:55:00.596Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: Piqnt Products: Stage.js Problem Types: CWE-94 Description: Stage.js through 0.8.10 allows DOM Clobbering (with resultant XSS for untrusted input that contains HTML but does not directly contain JavaScript), because document.currentScript lookup can be shadowed by attacker-injected HTML elements. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gist.github.com/jackfromeast/31d56f1ad17673aabb6ab541e65a5534 - https://github.com/piqnt/stage.js/blob/919f6e94b14242f6e6994141a9e11
com/jackfromeast/31d56f1ad17673aabb6ab541e65a5534 - https://github.com/piqnt/stage.js/blob/919f6e94b14242f6e6994141a9e1188439d306d5/lib/core.js#L158-L159
CVE ID: CVE-2024-53387 State: PUBLISHED Published: 2025-03-03T00:00:00.000Z Last Updated: 2025-03-04T16:27:19.960Z Vendors: n/a Products: n/a Problem Types: n/a Description: A DOM Clobbering vulnerability in umeditor v1.2.3 allows attackers to execute arbitrary code via supplying a crafted HTML element. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gist.github.com/jackfromeast/d52c506113f33b8871d0e647411df894
CVE ID: CVE-2024-53388 State: PUBLISHED Published: 2025-03-03T00:00:00.000Z Last Updated: 2025-03-04T16:25:03.826Z Vendors: n/a Products: n/a Problem Types: n/a Description: A DOM Clobbering vulnerability in mavo v0.3.2 allows attackers to execute arbitrary code via supplying a crafted HTML element. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gist.github.com/jackfromeast/a61a5429a97985e7ff4c1d39e339d5d8
CVE ID: CVE-2024-53406 State: PUBLISHED Published: 2025-03-13T00:00:00.000Z Last Updated: 2025-03-19T18:42:46.005Z Vendors: n/a Products: n/a Problem Types: n/a Description: Espressif Esp idf v5.3.0 is vulnerable to Insecure Permissions resulting in Authentication bypass. In the reconnection phase, the device reuses the session key from a previous connection session, creating an opportunity for attackers to execute security bypass attacks. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/espressif/esp-idf - https://github.com/yangting111/BLE_TEST/blob/main/result/PoC/Esp/sk_reuse.md
CVE ID: CVE-2024-53407 State: PUBLISHED Published: 2025-01-15T00:00:00.000Z Last Updated: 2025-01-31T20:23:07.435Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Phiewer 4.1.0, a dylib injection leads to Command Execution which allow attackers to inject dylib file potentially leading to remote control and unauthorized access to sensitive user data. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/SyFi/CVE-2024-53407
CVE ID: CVE-2024-53408 State: PUBLISHED Published: 2025-02-27T00:00:00.000Z Last Updated: 2025-02-28T15:06:00.780Z Vendors: n/a Products: n/a Problem Types: n/a Description: AVE System Web Client v2.1.131.13992 was discovered to contain a cross-site scripting (XSS) vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cosmosofcyberspace.github.io/ave-system-cve.html
CVE ID: CVE-2024-53423 State: PUBLISHED Published: 2025-05-29T00:00:00.000Z Last Updated: 2025-05-29T18:28:53.386Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in Open Network Foundation ONOS v2.7.0 allows attackers to cause a Denial of Service (DoS) via supplying crafted packets. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wiki.onosproject.org/pages/viewpage.action?pageId=16122675 - https://gist.github.com/kjw6855/abeecc798d138b49537393e1fd3a5e96
CVE ID: CVE-2024-53425 State: PUBLISHED Published: 2024-11-21T00:00:00 Last Updated: 2024-11-26T17:51:40.031Z Vendors: n/a Products: n/a Problem Types: n/a Description: A heap-buffer-overflow vulnerability was discovered in the SkipSpacesAndLineEnd function in Assimp v5.4.3. This issue occurs when processing certain malformed MD5 model files, leading to an out-of-bounds read and potential application crash. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/assimp/assimp/issues/5860
CVE ID: CVE-2024-53426 State: PUBLISHED Published: 2024-11-21T00:00:00 Last Updated: 2024-11-26T17:59:58.602Z Vendors: n/a Products: n/a Problem Types: n/a Description: A heap-buffer-overflow vulnerability has been identified in ntopng 6.2 in the Flow::dissectMDNS function. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/ntop/ntopng/issues/8793
CVE ID: CVE-2024-53427 State: PUBLISHED Published: 2025-02-26T00:00:00.000Z Last Updated: 2025-03-28T16:39:39.470Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: jqlang Products: jq Problem Types: CWE-843 Description: decNumberCopy in decNumber.c in jq through 1.7.1 does not properly consider that NaN is interpreted as numeric, which has a resultant stack-based buffer overflow and out-of-bounds write, as demonstrated by use of --slurp with subtraction, such as a filter of .-. when the input has a certain form of digit string with NaN (e.g., "1 NaN123" immediately followed by many more digits). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - h
"1 NaN123" immediately followed by many more digits). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/jqlang/jq/issues/3196 - https://gist.github.com/Ekkosun/a83870ce7f3b7813b9b462a395e8ad92 - https://github.com/jqlang/jq/blob/71c2ab509a8628dbbad4bc7b3f98a64aa90d3297/src/decNumber/decNumber.c#L3375 - https://github.com/jqlang/jq/security/advisories/GHSA-x6c3-qv5r-7q22 - https://github.com/jqlang/jq/issues/3296
CVE ID: CVE-2024-53429 State: PUBLISHED Published: 2024-11-21T00:00:00 Last Updated: 2024-12-03T15:31:30.976Z Vendors: n/a Products: n/a Problem Types: n/a Description: Open62541 v1.4.6 is has an assertion failure in fuzz_binary_decode, which leads to a crash. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/open62541/open62541/issues/6825
CVE ID: CVE-2024-53432 State: PUBLISHED Published: 2024-11-21T00:00:00 Last Updated: 2024-12-04T15:36:47.876Z Vendors: n/a Products: n/a Problem Types: n/a Description: While parsing certain malformed PLY files, PCL version 1.14.1 crashes due to an uncaught std::out_of_range exception in PCLPointCloud2::at. This issue could potentially be exploited to cause a denial-of-service (DoS) attack when processing untrusted PLY files. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/PointCloudLibrary/pcl/issues/6162
CVE ID: CVE-2024-53438 State: PUBLISHED Published: 2024-11-22T00:00:00.000Z Last Updated: 2025-02-04T16:40:25.956Z Vendors: n/a Products: n/a Problem Types: n/a Description: EventAttendance.php in ChurchCRM 5.7.0 is vulnerable to SQL injection. An attacker can exploit this vulnerability by manipulating the 'Event' parameter, which is directly interpolated into the SQL query without proper sanitization or validation, allowing attackers to execute arbitrary SQL commands. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/ChurchCRM/CRM/issues/6988 - https://github.com/advisories/GHSA-gr5x-8j97-qq23
CVE ID: CVE-2024-53441 State: PUBLISHED Published: 2024-12-09T00:00:00 Last Updated: 2024-12-11T20:45:11.118Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in the index.js decryptCookie function of cookie-encrypter v1.0.1 allows attackers to execute a bit flipping attack. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gist.github.com/mathysEthical/f45f1503f87381090e38a33c50eec971 - https://mathys.reboux.pro/CVE/2024/53441
CVE ID: CVE-2024-53442 State: PUBLISHED Published: 2024-12-05T00:00:00 Last Updated: 2024-12-11T16:33:22.134Z Vendors: n/a Products: n/a Problem Types: n/a Description: whapa v1.59 is vulnerable to Command Injection via a crafted filename to the HTML reports component. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/B16f00t/whapa - https://1d8.github.io/cves/cve_2024_53442/
CVE ID: CVE-2024-53450 State: PUBLISHED Published: 2024-12-09T00:00:00 Last Updated: 2024-12-11T15:54:34.771Z Vendors: n/a Products: n/a Problem Types: n/a Description: RAGFlow 0.13.0 suffers from improper access control in document-hooks.ts, allowing unauthorized access to user documents. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/infiniflow/ragflow/blob/cec208051f6f5996fefc8f36b6b71231b1807533/web/src/hooks/document-hooks.ts#L23 - https://github.com/thanhtung4102/Unauthentication-in-Ragflow
CVE ID: CVE-2024-53457 State: PUBLISHED Published: 2024-12-05T00:00:00 Last Updated: 2024-12-10T17:11:38.291Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stored cross-site scripting (XSS) vulnerability in the Device Settings section of LibreNMS v24.9.0 to v24.10.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Display Name parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/tCu0n9/Stored-XSS-LibreNMS-Display-Name.git
CVE ID: CVE-2024-53458 State: PUBLISHED Published: 2025-03-05T00:00:00.000Z Last Updated: 2025-03-05T20:45:39.721Z Vendors: n/a Products: n/a Problem Types: n/a Description: Sysax Multi Server 6.99 is vulnerable to a denial of service (DoS) condition when processing specially crafted SSH packets. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://packetstormsecurity.com/files/182468/Sysax-Multi-Server-6.99-SSH-Denial-Of-Service.html
CVE ID: CVE-2024-53459 State: PUBLISHED Published: 2024-12-02T00:00:00 Last Updated: 2024-12-02T17:23:41.125Z Vendors: n/a Products: n/a Problem Types: n/a Description: Sysax Multi Server 6.99 is vulnerable to Cross Site Scripting (XSS) via the /scgi?sid parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://packetstormsecurity.com/files/182467/Sysax-Multi-Server-6.99-Cross-Site-Scripting.html
CVE ID: CVE-2024-53470 State: PUBLISHED Published: 2024-12-05T00:00:00 Last Updated: 2024-12-10T21:16:49.850Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple stored cross-site scripting (XSS) vulnerabilities in the component /configuracao/gateway_pagamento.php of WeGIA v3.2.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the id or name parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wegia.org - https://github.com/nilsonmori/WeGIA - https://github.com/nmmorette/vulnerability-research/blob/main/CVE-2024-53470/README.md
CVE ID: CVE-2024-53471 State: PUBLISHED Published: 2024-12-05T00:00:00 Last Updated: 2024-12-10T21:19:19.990Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple stored cross-site scripting (XSS) vulnerabilities in the component /configuracao/meio_pagamento.php of WeGIA v3.2.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the id or name parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/nilsonmori/WeGIA - https://github.com/nmmorette/vulnerability-research/blob/main/CVE-2024-53471/README.md
CVE ID: CVE-2024-53472 State: PUBLISHED Published: 2024-12-05T00:00:00 Last Updated: 2024-12-11T16:57:27.435Z Vendors: n/a Products: n/a Problem Types: n/a Description: WeGIA v3.2.0 was discovered to contain a Cross-Site Request Forgery (CSRF). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wegia.org - https://github.com/nilsonLazarin/WeGIA/ - https://github.com/nmmorette/vulnerability-research/tree/main/CVE-2024-53472