Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-40706 State: PUBLISHED Published: 2025-01-24T15:20:36.596Z Last Updated: 2025-02-12T20:01:20.274Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: IBM Products: InfoSphere Information Server Problem Types: CWE-497 Description: IBM InfoSphere Information Server 11.7 could allow a remote user to obtain sensitive version information that could aid in further attacks against the system. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7169826
CVE ID: CVE-2024-40709 State: PUBLISHED Published: 2024-09-07T16:11:22.216Z Last Updated: 2024-12-04T15:01:02.058Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Veeam Products: Backup and Recovery Description: A missing authorization vulnerability allows a local low-privileged user on the machine to escalate their privileges to root level. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.veeam.com/kb4649
CVE ID: CVE-2024-40710 State: PUBLISHED Published: 2024-09-07T16:11:22.182Z Last Updated: 2024-09-09T16:28:11.865Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Veeam Products: Backup and Recovery Description: A series of related high-severity vulnerabilities, the most notable enabling remote code execution (RCE) as the service account and extraction of sensitive information (savedcredentials and passwords). Exploiting these vulnerabilities requires a user who has been assigned a low-privileged role within Veeam Backup & Replication. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.veeam.com/kb4649
CVE ID: CVE-2024-40711 State: PUBLISHED Published: 2024-09-07T16:11:22.213Z Last Updated: 2025-10-21T22:55:45.810Z Severity: CRITICAL (CVSS 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Veeam Products: Backup and Recovery Description: A deserialization of untrusted data vulnerability with a malicious payload can allow an unauthenticated remote code execution (RCE). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.veeam.com/kb4649
CVE ID: CVE-2024-40712 State: PUBLISHED Published: 2024-09-07T16:11:22.203Z Last Updated: 2024-09-09T15:18:23.506Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Veeam Products: Backup and Recovery Description: A path traversal vulnerability allows an attacker with a low-privileged account and local access to the system to perform local privilege escalation (LPE). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.veeam.com/kb4649
CVE ID: CVE-2024-40713 State: PUBLISHED Published: 2024-09-07T16:11:22.216Z Last Updated: 2024-09-09T14:22:01.961Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Veeam Products: Backup and Recovery Description: A vulnerability that allows a user who has been assigned a low-privileged role within Veeam Backup & Replication to alter Multi-Factor Authentication (MFA) settings and bypass MFA. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.veeam.com/kb4649
CVE ID: CVE-2024-40714 State: PUBLISHED Published: 2024-09-07T16:11:22.237Z Last Updated: 2024-09-09T14:03:17.836Z Severity: HIGH (CVSS 8.3 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H) Vendors: Veeam Products: Backup and Recovery Description: An improper certificate validation vulnerability in TLS certificate validation allows an attacker on the same network to intercept sensitive credentials during restore operations. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.veeam.com/kb4649
CVE ID: CVE-2024-40715 State: PUBLISHED Published: 2024-11-07T16:40:37.566Z Last Updated: 2025-03-25T16:53:22.623Z Severity: HIGH (CVSS 7.7 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L) Vendors: Veeam Products: Enterprise Manager Description: A vulnerability in Veeam Backup & Replication Enterprise Manager has been identified, which allows attackers to perform authentication bypass. Attackers must be able to perform Man-in-the-Middle (MITM) attack to exploit this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.veeam.com/kb4682
CVE ID: CVE-2024-40717 State: PUBLISHED Published: 2024-12-04T01:06:04.636Z Last Updated: 2025-03-13T17:40:27.483Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Veeam Products: Backup & Replication Description: A vulnerability in Veeam Backup & Replication allows a low-privileged user with certain roles to perform remote code execution (RCE) by updating existing jobs. These jobs can be configured to run pre- and post-scripts, which can be located on a network share and are executed with elevated privileges by default. The user can update a job and schedule it to run almost immediately, allowing arbitrary code execution on the server. Additional Analyst Notes
job and schedule it to run almost immediately, allowing arbitrary code execution on the server. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.veeam.com/kb4693
CVE ID: CVE-2024-40718 State: PUBLISHED Published: 2024-09-07T16:11:22.238Z Last Updated: 2024-09-09T13:59:32.964Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Veeam Products: Nutanix AHV, Nutanix KVM Description: A server side request forgery vulnerability allows a low-privileged user to perform local privilege escalation through exploiting an SSRF vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.veeam.com/kb4649
CVE ID: CVE-2024-40719 State: PUBLISHED Published: 2024-08-02T10:05:24.168Z Last Updated: 2024-08-02T15:30:54.622Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) Vendors: CHANGING Information Technology Products: TCBServiSign Windows Version Problem Types: CWE-326 Description: The encryption strength of the authorization keys in CHANGING Information Technology TCBServiSign Windows Version is insufficient. When a remote attacker tricks a victim into visiting a malicious website, TCBServiSign will treat that website as a legitimate server and interact with it. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-7964-5b2
t with it. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-7964-5b266-1.html - https://www.twcert.org.tw/en/cp-139-7970-e8ac5-2.html
CVE ID: CVE-2024-40720 State: PUBLISHED Published: 2024-08-02T10:10:16.249Z Last Updated: 2024-08-02T16:08:16.108Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: CHANGING Information Technology Products: TCBServiSign Windows Version Problem Types: CWE-20 Description: The specific API in TCBServiSign Windows Version from CHANGING Information Technology does not properly validate server-side input. When a user visits a spoofed website, unauthenticated remote attackers can modify the `HKEY_CURRENT_USER` registry to execute arbitrary commands. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-7965-8285d-1.html -
dditional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-7965-8285d-1.html - https://www.twcert.org.tw/en/cp-139-7971-d9584-2.html
CVE ID: CVE-2024-40721 State: PUBLISHED Published: 2024-08-02T10:14:39.889Z Last Updated: 2024-08-02T13:47:51.345Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: CHANGING Information Technology Products: TCBServiSign Windows Version Problem Types: CWE-20 Description: The specific API in TCBServiSign Windows Version from CHANGING Information Technology does not properly validate server-side input. When a user visits a spoofed website, unauthenticated remote attackers can cause the TCBServiSign to load a DLL from an arbitrary path. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-7966-8c6c3-1.html - https://ww
Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-7966-8c6c3-1.html - https://www.twcert.org.tw/en/cp-139-7972-01a6e-2.html
CVE ID: CVE-2024-40722 State: PUBLISHED Published: 2024-08-02T10:18:36.629Z Last Updated: 2024-08-02T14:02:50.759Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L) Vendors: CHANGING Information Technology Products: TCBServiSign Windows Version Problem Types: CWE-121 Description: The specific API in TCBServiSign Windows Version from CHANGING Information Technology does does not properly validate the length of server-side input. When a user visits a spoofed website, unauthenticated remote attackers can cause a stack-based buffer overflow in the TCBServiSign, temporarily disrupting its service. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.
iSign, temporarily disrupting its service. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-7967-9efdf-1.html - https://www.twcert.org.tw/en/cp-139-7973-e10c6-2.html
CVE ID: CVE-2024-40723 State: PUBLISHED Published: 2024-08-02T10:27:07.987Z Last Updated: 2024-08-02T16:05:52.255Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L) Vendors: CHANGING Information Technology Products: HWATAIServiSign Windows Version Problem Types: CWE-121 Description: The specific API in HWATAIServiSign Windows Version from CHANGING Information Technology does not properly validate the length of server-side inputs. When a user visits a spoofed website, unauthenticated remote attackers can cause a stack-based buffer overflow in the HWATAIServiSign, temporarily disrupting its service. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https:/
IServiSign, temporarily disrupting its service. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-7968-ce2ef-1.html - https://www.twcert.org.tw/en/cp-139-7974-0562f-2.html
CVE ID: CVE-2024-40724 State: PUBLISHED Published: 2024-07-19T07:38:28.057Z Last Updated: 2025-03-25T13:27:33.147Z Vendors: Open Asset Import Library Products: Assimp Problem Types: Heap-based buffer overflow Description: Heap-based buffer overflow vulnerability in Assimp versions prior to 5.4.2 allows a local attacker to execute arbitrary code by inputting a specially crafted file into the product. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/assimp/assimp/releases/tag/v5.4.2 - https://github.com/assimp/assimp/pull/5651/commits/614911bb3b1bfc3a1799ae2b3cca306270f3fb97 - https://jvn.jp/en/jp/JVN87710540/
CVE ID: CVE-2024-40725 State: PUBLISHED Published: 2024-07-18T09:32:43.929Z Last Updated: 2025-03-14T17:27:57.926Z Vendors: Apache Software Foundation Products: Apache HTTP Server Problem Types: CWE-668 Description: A partial fix for CVE-2024-39884 in the core of Apache HTTP Server 2.4.61 ignores some use of the legacy content-type based configuration of handlers. "AddType" and similar configuration, under some circumstances where files are requested indirectly, result in source code disclosure of local content. For example, PHP scripts may be served instead of interpreted. Users are recommended to upgrade to version 2.4.62, which fixes this issue. Additional Analyst Notes: - CISA ADP Vulnri
Users are recommended to upgrade to version 2.4.62, which fixes this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://httpd.apache.org/security/vulnerabilities_24.html
CVE ID: CVE-2024-40726 State: PUBLISHED Published: 2024-07-09T00:00:00 Last Updated: 2024-08-02T04:33:11.821Z Vendors: n/a Products: n/a Problem Types: n/a Description: A cross-site scripting (XSS) vulnerability in netbox v4.0.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name parameter at /dcim/power-ports/{id}/edit/. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/minhquan202/Vuln-Netbox
CVE ID: CVE-2024-40727 State: PUBLISHED Published: 2024-07-09T00:00:00 Last Updated: 2024-08-02T04:33:11.962Z Vendors: n/a Products: n/a Problem Types: n/a Description: A cross-site scripting (XSS) vulnerability in netbox v4.0.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name parameter at /dcim/console-server-ports/add/. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/minhquan202/Vuln-Netbox
CVE ID: CVE-2024-40728 State: PUBLISHED Published: 2024-07-09T00:00:00 Last Updated: 2024-08-02T04:33:11.967Z Vendors: n/a Products: n/a Problem Types: n/a Description: A cross-site scripting (XSS) vulnerability in netbox v4.0.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name parameter at /dcim/console-server-ports/{id}/edit/. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/minhquan202/Vuln-Netbox
CVE ID: CVE-2024-40729 State: PUBLISHED Published: 2024-07-09T00:00:00 Last Updated: 2024-08-02T04:33:11.884Z Vendors: n/a Products: n/a Problem Types: n/a Description: A cross-site scripting (XSS) vulnerability in netbox v4.0.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name parameter at /dcim/interfaces/add/. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/minhquan202/Vuln-Netbox
CVE ID: CVE-2024-40730 State: PUBLISHED Published: 2024-07-09T00:00:00 Last Updated: 2024-08-02T04:33:11.969Z Vendors: n/a Products: n/a Problem Types: n/a Description: A cross-site scripting (XSS) vulnerability in netbox v4.0.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name parameter at /dcim/interfaces/{id}/edit/. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/minhquan202/Vuln-Netbox
CVE ID: CVE-2024-40731 State: PUBLISHED Published: 2024-07-09T00:00:00 Last Updated: 2024-08-02T04:33:12.063Z Vendors: n/a Products: n/a Problem Types: n/a Description: A cross-site scripting (XSS) vulnerability in netbox v4.0.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name parameter at /dcim/rear-ports/{id}/edit/. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/minhquan202/Vuln-Netbox
CVE ID: CVE-2024-40732 State: PUBLISHED Published: 2024-07-09T00:00:00 Last Updated: 2024-08-02T04:33:12.032Z Vendors: n/a Products: n/a Problem Types: n/a Description: A cross-site scripting (XSS) vulnerability in netbox v4.0.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name parameter at /dcim/rear-ports/add/. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/minhquan202/Vuln-Netbox
CVE ID: CVE-2024-40733 State: PUBLISHED Published: 2024-07-09T00:00:00 Last Updated: 2024-08-02T04:33:11.829Z Vendors: n/a Products: n/a Problem Types: n/a Description: A cross-site scripting (XSS) vulnerability in netbox v4.0.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name parameter at /dcim/front-ports/{id}/edit/. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/minhquan202/Vuln-Netbox
CVE ID: CVE-2024-40734 State: PUBLISHED Published: 2024-07-09T00:00:00 Last Updated: 2024-08-02T04:33:11.990Z Vendors: n/a Products: n/a Problem Types: n/a Description: A cross-site scripting (XSS) vulnerability in netbox v4.0.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name parameter at /dcim/front-ports/add/. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/minhquan202/Vuln-Netbox
CVE ID: CVE-2024-40735 State: PUBLISHED Published: 2024-07-09T00:00:00 Last Updated: 2024-08-02T04:33:11.852Z Vendors: n/a Products: n/a Problem Types: n/a Description: A cross-site scripting (XSS) vulnerability in netbox v4.0.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name parameter at /dcim/power-outlets/{id}/edit/. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/minhquan202/Vuln-Netbox
CVE ID: CVE-2024-40736 State: PUBLISHED Published: 2024-07-09T00:00:00 Last Updated: 2024-08-02T04:33:11.896Z Vendors: n/a Products: n/a Problem Types: n/a Description: A cross-site scripting (XSS) vulnerability in netbox v4.0.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name parameter at /dcim/power-outlets/add. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/minhquan202/Vuln-Netbox
CVE ID: CVE-2024-40737 State: PUBLISHED Published: 2024-07-09T00:00:00.000Z Last Updated: 2025-03-14T14:40:14.920Z Vendors: n/a Products: n/a Problem Types: n/a Description: A cross-site scripting (XSS) vulnerability in netbox v4.0.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name parameter at /dcim/console-ports/add. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/minhquan202/Vuln-Netbox
CVE ID: CVE-2024-40738 State: PUBLISHED Published: 2024-07-09T00:00:00 Last Updated: 2024-08-02T04:33:11.978Z Vendors: n/a Products: n/a Problem Types: n/a Description: A cross-site scripting (XSS) vulnerability in netbox v4.0.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name parameter at /dcim/console-ports/{id}/edit/. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/minhquan202/Vuln-Netbox
CVE ID: CVE-2024-40739 State: PUBLISHED Published: 2024-07-09T00:00:00 Last Updated: 2024-08-02T04:33:11.893Z Vendors: n/a Products: n/a Problem Types: n/a Description: A cross-site scripting (XSS) vulnerability in netbox v4.0.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name parameter at /dcim/power-feeds/add. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/minhquan202/Vuln-Netbox
CVE ID: CVE-2024-40740 State: PUBLISHED Published: 2024-07-09T00:00:00 Last Updated: 2024-08-02T04:33:11.966Z Vendors: n/a Products: n/a Problem Types: n/a Description: A cross-site scripting (XSS) vulnerability in netbox v4.0.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name parameter at /dcim/power-feeds/{id}/edit/. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/minhquan202/Vuln-Netbox
CVE ID: CVE-2024-40741 State: PUBLISHED Published: 2024-07-09T00:00:00 Last Updated: 2024-08-02T04:33:11.987Z Vendors: n/a Products: n/a Problem Types: n/a Description: A cross-site scripting (XSS) vulnerability in netbox v4.0.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the circuit ID parameter at /circuits/circuits/{id}/edit/. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/minhquan202/Vuln-Netbox
CVE ID: CVE-2024-40742 State: PUBLISHED Published: 2024-07-09T00:00:00 Last Updated: 2024-08-02T04:33:11.894Z Vendors: n/a Products: n/a Problem Types: n/a Description: A cross-site scripting (XSS) vulnerability in netbox v4.0.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the circuit ID parameter at /circuits/circuits/add. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/minhquan202/Vuln-Netbox
CVE ID: CVE-2024-40743 State: PUBLISHED Published: 2024-08-20T16:03:45.461Z Last Updated: 2024-11-03T04:33:21.199Z Vendors: Joomla! Project Products: Joomla! CMS Problem Types: CWE-79 Description: The stripImages and stripIframes methods didn't properly process inputs, leading to XSS vectors. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://developer.joomla.org/security-centre/946-20240805-core-xss-vectors-in-outputfilter-strip-methods.html
CVE ID: CVE-2024-40744 State: PUBLISHED Published: 2024-12-04T15:01:50.739Z Last Updated: 2024-12-25T04:34:33.216Z Vendors: tassos.gr Products: Convert Forms component for Joomla Problem Types: CWE-434 Description: Unrestricted file upload via security bypass in Convert Forms component for Joomla in versions before 4.4.8. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.tassos.gr/joomla-extensions/convert-forms
CVE ID: CVE-2024-40745 State: PUBLISHED Published: 2024-12-04T15:02:05.517Z Last Updated: 2024-12-25T04:34:24.527Z Vendors: tassos.gr Products: Convert Forms component for Joomla Problem Types: CWE-79 Description: Reflected Cross site scripting vulnerability in Convert Forms component for Joomla in versions before 4.4.8. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.tassos.gr/joomla-extensions/convert-forms
CVE ID: CVE-2024-40746 State: PUBLISHED Published: 2024-10-21T16:16:32.627Z Last Updated: 2025-03-20T04:35:06.479Z Vendors: hikashop.com Products: HikaShop component for Joomla Problem Types: CWE-79 Description: A stored cross-site scripting (XSS) vulnerability in HikaShop Joomla Component < 5.1.1 allows remote attackers to execute arbitrary JavaScript in the web browser of a user, by including a malicious payload in the `description` parameter of any product. The `description `parameter is not sanitised in the backend. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.hikashop.com/
CVE ID: CVE-2024-40747 State: PUBLISHED Published: 2025-01-07T16:22:02.501Z Last Updated: 2025-01-07T16:57:51.461Z Vendors: Joomla! Project Products: Joomla! CMS Problem Types: CWE-79 Description: Various module chromes didn't properly process inputs, leading to XSS vectors. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://developer.joomla.org/security-centre/954-20250101-core-xss-vectors-in-module-chromes.html
CVE ID: CVE-2024-40748 State: PUBLISHED Published: 2025-01-07T16:22:00.896Z Last Updated: 2025-01-08T14:51:06.931Z Vendors: Joomla! Project Products: Joomla! CMS Problem Types: CWE-79 Description: Lack of output escaping in the id attribute of menu lists. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://developer.joomla.org/security-centre/955-20250102-core-xss-vector-in-the-id-attribute-of-menu-lists.html
CVE ID: CVE-2024-40749 State: PUBLISHED Published: 2025-01-07T16:22:12.593Z Last Updated: 2025-01-08T14:46:53.984Z Vendors: Joomla! Project Products: Joomla! CMS Problem Types: CWE-284 Description: Improper Access Controls allows access to protected views. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://developer.joomla.org/security-centre/956-20250103-core-read-acl-violation-in-multiple-core-views.html
CVE ID: CVE-2024-40750 State: PUBLISHED Published: 2024-07-09T00:00:00 Last Updated: 2024-11-22T18:57:15.426Z Vendors: n/a Products: n/a Problem Types: n/a Description: Linksys Velop Pro 6E 1.0.8 MX6200_1.0.8.215731 and 7 1.0.10.215314 devices send cleartext Wi-Fi passwords over the public Internet during app-based installation. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://stackdiary.com/linksys-velop-routers-send-wi-fi-passwords-in-plaintext-to-us-servers/ - https://news.ycombinator.com/item?id=40917312