Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-4576 State: PUBLISHED Published: 2024-06-13T06:31:41.034Z Last Updated: 2024-10-27T21:52:02.177Z Vendors: Tibco Products: EBX Description: The component listed above contains a vulnerability that allows an attacker to traverse directories and access sensitive files, leading to unauthorized disclosure of system configuration and potentially sensitive information. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://community.tibco.com/advisories/tibco-security-advisory-june-11-2024-tibco-ebx-cve-2024-4576-r215/
CVE ID: CVE-2024-4577 State: PUBLISHED Published: 2024-06-09T19:42:36.464Z Last Updated: 2025-10-21T23:05:16.089Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: PHP Group Products: PHP Problem Types: CWE-78 Description: In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, when using Apache and PHP-CGI on Windows, if the system is set up to use certain code pages, Windows may use "Best-Fit" behavior to replace characters in command line given to Win32 API functions. PHP CGI module may misinterpret those characters as PHP options, which may allow a malicious user to pass options to PHP binary being run, and thus reveal the source co
as PHP options, which may allow a malicious user to pass options to PHP binary being run, and thus reveal the source code of scripts, run arbitrary PHP code on the server, etc. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/php/php-src/security/advisories/GHSA-3qgc-jrrr-25jv - https://blog.orange.tw/2024/06/cve-2024-4577-yet-another-php-rce.html - https://devco.re/blog/2024/06/06/security-alert-cve-2024-4577-php-cgi-argument-injection-vulnerability-en/ - https://arstechnica.com/security/2024/06/php-vulnerability-allows-attackers-to-run-malicious-code-on-windows-servers/ - https://www.imperva.com/blog/imperva-protects-against-crit
-allows-attackers-to-run-malicious-code-on-windows-servers/ - https://www.imperva.com/blog/imperva-protects-against-critical-php-vulnerability-cve-2024-4577/ - https://github.com/11whoami99/CVE-2024-4577 - https://github.com/xcanwin/CVE-2024-4577-PHP-RCE - https://github.com/rapid7/metasploit-framework/pull/19247 - https://labs.watchtowr.com/no-way-php-strikes-again-cve-2024-4577/ - https://github.com/watchtowrlabs/CVE-2024-4577 - https://www.php.net/ChangeLog-8.php#8.1.29 - https://www.php.net/ChangeLog-8.php#8.2.20 - https://www.php.net/ChangeLog-8.php#8.3.8 - https://cert.be/en/advisory/warning-php-remote-code-execution-patch-immediately - https://isc.sans.edu/diary/30994 - http://www.ope
t.be/en/advisory/warning-php-remote-code-execution-patch-immediately - https://isc.sans.edu/diary/30994 - http://www.openwall.com/lists/oss-security/2024/06/07/1 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PKGTQUOA2NTZ3RXN22CSAUJPIRUYRB4B/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W45DBOH56NQDRTOM2DN2LNA2FZIMC3PK/ - https://security.netapp.com/advisory/ntap-20240621-0008/
CVE ID: CVE-2024-4578 State: PUBLISHED Published: 2024-06-27T18:31:06.468Z Last Updated: 2024-08-01T20:47:41.270Z Severity: HIGH (CVSS 8.4 CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: Arista Networks Products: Arista Wireless Access Points Problem Types: CWE-77 Description: This Advisory describes an issue that impacts Arista Wireless Access Points. Any entity with the ability to authenticate via SSH to an affected AP as the “config” user is able to cause a privilege escalation via spawning a bash shell. The SSH CLI session does not require high permissions to exploit this vulnerability, but the config password is required to establish the session. The spawned shell is able to obta
loit this vulnerability, but the config password is required to establish the session. The spawned shell is able to obtain root privileges. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.arista.com/en/support/advisories-notices/security-advisory/19844-security-advisory-0098
CVE ID: CVE-2024-4579 State: REJECTED Published: N/A Last Updated: 2024-05-09T16:39:41.394Z Description: No description available.
CVE ID: CVE-2024-4580 State: PUBLISHED Published: 2024-05-16T11:33:32.957Z Last Updated: 2024-08-01T20:47:40.703Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: litonice13 Products: Master Addons – Free Widgets, Hover Effects, Toggle, Conditions, Animations for Elementor Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Master Addons – Free Widgets, Hover Effects, Toggle, Conditions, Animations for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several parameters in versions up to, and including, 2.0.6.0 due to insufficient input sanitization and outpu
ipting via several parameters in versions up to, and including, 2.0.6.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/e3e3ac84-dd82-42b0-80b9-c876731170d5?source=cve - https://plugins.trac.wordpress.org/browser/master-addons/trunk/addons/ma-image-hover-effects/ma-image-hover-effects.php#L1546 - https://plugins.trac.wordpress.org/browser
addons/trunk/addons/ma-image-hover-effects/ma-image-hover-effects.php#L1546 - https://plugins.trac.wordpress.org/browser/master-addons/trunk/addons/ma-tabs/ma-tabs.php#L1068 - https://plugins.trac.wordpress.org/changeset/3087193/
CVE ID: CVE-2024-4581 State: PUBLISHED Published: 2024-06-04T08:31:21.415Z Last Updated: 2024-08-01T20:47:41.289Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: Revolution Slider Products: Slider Revolution Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Slider Revolution plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Add Layer widget in all versions up to, and including, 6.7.11 due to insufficient input sanitization and output escaping on the user supplied 'class', 'id', and 'title' attributes. This makes it possible for authenticated attackers,
scaping on the user supplied 'class', 'id', and 'title' attributes. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. NOTE: Successful exploitation of this vulnerability requires an Administrator to give Slider Creation privileges to Author-level users. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/a99b8eb9-1511-4ec0-98f4-c0e0c989fa28?source=cve - https://www.sliderrevolution.com/documentation/changelog/
CVE ID: CVE-2024-4582 State: PUBLISHED Published: 2024-05-07T11:00:05.363Z Last Updated: 2024-08-01T20:47:41.203Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: Faraday Products: GM8181, GM828x Problem Types: CWE-78 Description: A vulnerability classified as critical has been found in Faraday GM8181 and GM828x up to 20240429. Affected is an unknown function of the component NTP Service. The manipulation of the argument ntp_srv leads to os command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-263304. Additional
ed. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-263304. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.263304 - https://vuldb.com/?ctiid.263304 - https://vuldb.com/?submit.324393 - https://netsecfish.notion.site/Command-Injection-in-Faraday-Technology-GM828x-GM8181-DVR-1bc02d17ee5540a08273da2850e809c4?pvs=4 - https://file.notion.so/f/f/3f67e7ef-2ba8-446a-9721-f87d0baa1695/fa61d774-823d-4516-8ff3-73c310ff7801/command_injection_submit.py?id=6d18aced-daaa-4e52-a0e8-9d1c5e00acee&table=block&spaceId=3f67e7ef-2ba8-446a-9721-f87d0baa1695&expirationTimestamp=171514800
CVE ID: CVE-2024-4583 State: PUBLISHED Published: 2024-05-07T11:00:07.398Z Last Updated: 2024-08-01T20:47:40.531Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Faraday Products: GM8181, GM828x Problem Types: CWE-200 Description: A vulnerability classified as problematic was found in Faraday GM8181 and GM828x up to 20240429. Affected by this vulnerability is an unknown functionality of the component Request Handler. The manipulation leads to information disclosure. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. It is recommended to upgrade the affected component. The identifier VDB-263305 was assigned to t
public and may be used. It is recommended to upgrade the affected component. The identifier VDB-263305 was assigned to this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.263305 - https://vuldb.com/?ctiid.263305 - https://vuldb.com/?submit.324403 - https://netsecfish.notion.site/Unauthorized-Credential-Exposure-in-Faraday-Technology-Grain-Media-GM828x-GM8181-DVR-Devices-6a501c33e5d44beab7148074d2214b8f?pvs=4 - https://file.notion.so/f/f/3f67e7ef-2ba8-446a-9721-f87d0baa1695/193e9734-f9eb-44b0-bd85-92263d0e84ec/get_password_submit.py?id=8fd5a7e0-bc2d-4ef8-9037-d3c1b68a6be1&table=block&spaceId=3f67e7ef-2ba8-446a-972
5-92263d0e84ec/get_password_submit.py?id=8fd5a7e0-bc2d-4ef8-9037-d3c1b68a6be1&table=block&spaceId=3f67e7ef-2ba8-446a-9721-f87d0baa1695&expirationTimestamp=1715148000000&
CVE ID: CVE-2024-4584 State: PUBLISHED Published: 2024-05-07T11:31:04.327Z Last Updated: 2024-08-01T20:47:41.161Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Faraday Products: GM8181, GM828x Problem Types: CWE-200 Description: A vulnerability, which was classified as problematic, has been found in Faraday GM8181 and GM828x up to 20240429. Affected by this issue is some unknown functionality of the file /command_port.ini. The manipulation leads to information disclosure. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-263306 is the identifier assigned to this vulnerability. NOTE: The vendor was contac
to the public and may be used. VDB-263306 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.263306 - https://vuldb.com/?ctiid.263306 - https://vuldb.com/?submit.324404 - https://netsecfish.notion.site/Information-Disclosure-in-Faraday-Technology-Grain-Media-GM828x-GM8181-DVR-via-Unauthenticated-Acc-3d184791c8d7405ba9d6a49e7a5bd918?pvs=4
CVE ID: CVE-2024-4585 State: PUBLISHED Published: 2024-05-07T12:00:08.828Z Last Updated: 2024-08-01T20:47:40.895Z Severity: N/A (CVSS 5 AV:N/AC:L/Au:N/C:N/I:P/A:N) Vendors: n/a Products: DedeCMS Problem Types: CWE-352 Description: A vulnerability, which was classified as problematic, was found in DedeCMS 5.7. This affects an unknown part of the file /src/dede/member_type.php. The manipulation leads to cross-site request forgery. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-263307. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Add
nerability is VDB-263307. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.263307 - https://vuldb.com/?ctiid.263307 - https://vuldb.com/?submit.324953 - https://github.com/Hckwzh/cms/blob/main/16.md
CVE ID: CVE-2024-4586 State: PUBLISHED Published: 2024-05-07T12:31:04.648Z Last Updated: 2024-08-01T20:47:41.539Z Severity: N/A (CVSS 5 AV:N/AC:L/Au:N/C:N/I:P/A:N) Vendors: n/a Products: DedeCMS Problem Types: CWE-352 Description: A vulnerability has been found in DedeCMS 5.7 and classified as problematic. This vulnerability affects unknown code of the file /src/dede/shops_delivery.php. The manipulation leads to cross-site request forgery. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-263308. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional An
is VDB-263308. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.263308 - https://vuldb.com/?ctiid.263308 - https://vuldb.com/?submit.324954 - https://github.com/Hckwzh/cms/blob/main/17.md
CVE ID: CVE-2024-4587 State: PUBLISHED Published: 2024-05-07T12:31:06.308Z Last Updated: 2024-08-01T20:47:40.753Z Severity: N/A (CVSS 5 AV:N/AC:L/Au:N/C:N/I:P/A:N) Vendors: n/a Products: DedeCMS Problem Types: CWE-352 Description: A vulnerability was found in DedeCMS 5.7 and classified as problematic. This issue affects some unknown processing of the file /src/dede/tpl.php. The manipulation leads to cross-site request forgery. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-263309 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analy
lnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.263309 - https://vuldb.com/?ctiid.263309 - https://vuldb.com/?submit.324955 - https://github.com/Hckwzh/cms/blob/main/18.md
CVE ID: CVE-2024-4588 State: PUBLISHED Published: 2024-05-07T13:00:07.853Z Last Updated: 2024-08-01T20:47:41.133Z Severity: N/A (CVSS 5 AV:N/AC:L/Au:N/C:N/I:P/A:N) Vendors: n/a Products: DedeCMS Problem Types: CWE-352 Description: A vulnerability was found in DedeCMS 5.7. It has been classified as problematic. Affected is an unknown function of the file /src/dede/mytag_add.php. The manipulation leads to cross-site request forgery. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-263310 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Addit
to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.263310 - https://vuldb.com/?ctiid.263310 - https://vuldb.com/?submit.324956 - https://github.com/Hckwzh/cms/blob/main/19.md
CVE ID: CVE-2024-4589 State: PUBLISHED Published: 2024-05-07T13:00:09.699Z Last Updated: 2024-08-01T20:47:41.230Z Severity: N/A (CVSS 5 AV:N/AC:L/Au:N/C:N/I:P/A:N) Vendors: n/a Products: DedeCMS Problem Types: CWE-352 Description: A vulnerability was found in DedeCMS 5.7. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /src/dede/mytag_edit.php. The manipulation leads to cross-site request forgery. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-263311. NOTE: The vendor was contacted early about this disclosure but did not respon
ifier of this vulnerability is VDB-263311. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.263311 - https://vuldb.com/?ctiid.263311 - https://vuldb.com/?submit.324957 - https://github.com/Hckwzh/cms/blob/main/20.md
CVE ID: CVE-2024-4590 State: PUBLISHED Published: 2024-05-07T13:31:04.724Z Last Updated: 2024-08-01T20:47:41.087Z Severity: N/A (CVSS 5 AV:N/AC:L/Au:N/C:N/I:P/A:N) Vendors: n/a Products: DedeCMS Problem Types: CWE-352 Description: A vulnerability was found in DedeCMS 5.7. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /src/dede/sys_info.php. The manipulation leads to cross-site request forgery. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-263312. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Addition
ility is VDB-263312. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.263312 - https://vuldb.com/?ctiid.263312 - https://vuldb.com/?submit.324958 - https://github.com/Hckwzh/cms/blob/main/21.md
CVE ID: CVE-2024-4591 State: PUBLISHED Published: 2024-05-07T13:31:06.262Z Last Updated: 2024-08-01T20:47:41.313Z Severity: N/A (CVSS 5 AV:N/AC:L/Au:N/C:N/I:P/A:N) Vendors: n/a Products: DedeCMS Problem Types: CWE-352 Description: A vulnerability classified as problematic has been found in DedeCMS 5.7. This affects an unknown part of the file /src/dede/sys_group_add.php. The manipulation leads to cross-site request forgery. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-263313 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additiona
this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.263313 - https://vuldb.com/?ctiid.263313 - https://vuldb.com/?submit.324959 - https://github.com/Hckwzh/cms/blob/main/22.md
CVE ID: CVE-2024-4592 State: PUBLISHED Published: 2024-05-07T14:00:05.564Z Last Updated: 2024-08-01T20:47:41.252Z Severity: N/A (CVSS 5 AV:N/AC:L/Au:N/C:N/I:P/A:N) Vendors: n/a Products: DedeCMS Problem Types: CWE-352 Description: A vulnerability classified as problematic was found in DedeCMS 5.7. This vulnerability affects unknown code of the file /src/dede/sys_group_edit.php. The manipulation leads to cross-site request forgery. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-263314 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional An
vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.263314 - https://vuldb.com/?ctiid.263314 - https://vuldb.com/?submit.324960 - https://github.com/Hckwzh/cms/blob/main/23.md
CVE ID: CVE-2024-4593 State: PUBLISHED Published: 2024-05-07T14:00:07.531Z Last Updated: 2024-08-01T20:47:41.163Z Severity: N/A (CVSS 5 AV:N/AC:L/Au:N/C:N/I:P/A:N) Vendors: n/a Products: DedeCMS Problem Types: CWE-352 Description: A vulnerability, which was classified as problematic, has been found in DedeCMS 5.7. This issue affects some unknown processing of the file /src/dede/sys_multiserv.php. The manipulation leads to cross-site request forgery. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-263315. NOTE: The vendor was contacted early about this disclosure but did not respond in a
of this vulnerability is VDB-263315. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.263315 - https://vuldb.com/?ctiid.263315 - https://vuldb.com/?submit.324961 - https://github.com/Hckwzh/cms/blob/main/24.md
CVE ID: CVE-2024-4594 State: PUBLISHED Published: 2024-05-07T14:31:04.240Z Last Updated: 2024-08-01T20:47:41.314Z Severity: N/A (CVSS 5 AV:N/AC:L/Au:N/C:N/I:P/A:N) Vendors: n/a Products: DedeCMS Problem Types: CWE-352 Description: A vulnerability, which was classified as problematic, was found in DedeCMS 5.7. Affected is an unknown function of the file /src/dede/sys_safe.php. The manipulation leads to cross-site request forgery. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-263316. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analy
VDB-263316. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.263316 - https://vuldb.com/?ctiid.263316 - https://vuldb.com/?submit.324963 - https://github.com/Hckwzh/cms/blob/main/25.md
CVE ID: CVE-2024-4595 State: PUBLISHED Published: 2024-05-07T15:00:04.967Z Last Updated: 2024-08-01T20:47:41.429Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: n/a Products: SEMCMS Problem Types: CWE-89 Description: A vulnerability has been found in SEMCMS up to 4.8 and classified as critical. Affected by this vulnerability is the function locate of the file function.php. The manipulation leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-263317 was assigned to this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/
nerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.263317 - https://vuldb.com/?ctiid.263317 - https://vuldb.com/?submit.326715 - https://github.com/gatsby2003/Semcms/blob/main/semcms0-sqlinjection.md
CVE ID: CVE-2024-4596 State: PUBLISHED Published: 2024-05-07T15:31:04.459Z Last Updated: 2024-08-01T20:47:41.187Z Severity: LOW (CVSS 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: n/a Products: Kimai Problem Types: CWE-200 Description: A vulnerability was found in Kimai up to 2.15.0 and classified as problematic. Affected by this issue is some unknown functionality of the component Session Handler. The manipulation of the argument PHPSESSIONID leads to information disclosure. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. Upgrading to version 2.16.0 is able to address this issue. It is recommended to up
xploitation is known to be difficult. Upgrading to version 2.16.0 is able to address this issue. It is recommended to upgrade the affected component. VDB-263318 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.263318 - https://vuldb.com/?ctiid.263318 - https://vuldb.com/?submit.328639 - https://github.com/kimai/kimai/releases/tag/2.16.0