Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-6447 State: PUBLISHED Published: 2024-07-10T23:32:13.951Z Last Updated: 2024-08-01T21:41:03.481Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) Vendors: fullservices Products: FULL – Cliente Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The FULL – Cliente plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the license plan parameter in all versions up to, and including, 3.1.12 due to insufficient input sanitization and output escaping as well as missing authorization and capability checks on the related functions. This makes it possible for unauthenticated atta
as missing authorization and capability checks on the related functions. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that will execute whenever an administrative user accesses wp-admin dashboard Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/2f3ad1e0-1ae3-44cd-aa2a-dbb3a1b531f9?source=cve - https://plugins.trac.wordpress.org/browser/full-customer/tags/3.1.12/app/api/Connection.php#L43 - https://plugins.trac.wordpress.org/browser/full-customer/tags/3.1.12/app/controller/inc/License.php#L55 - https://plugins.trac.wordpress.org/browser/full-customer/tags/
customer/tags/3.1.12/app/controller/inc/License.php#L55 - https://plugins.trac.wordpress.org/browser/full-customer/tags/3.1.12/app/controller/actions.php#L125
CVE ID: CVE-2024-6448 State: PUBLISHED Published: 2024-08-28T03:27:28.062Z Last Updated: 2024-08-28T13:42:06.740Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: mollieintegration Products: Mollie Payments for WooCommerce Problem Types: CWE-200 Description: The Mollie Payments for WooCommerce plugin for WordPress is vulnerable to information exposure in all versions up to, and including, 7.7.0. This is due to the error reporting being enabled by default in multiple plugin files. This makes it possible for unauthenticated attackers to obtain the full path to instances, which they may be able to use in combination with other vulnerabilities or to simplify reco
the full path to instances, which they may be able to use in combination with other vulnerabilities or to simplify reconnaissance work. On its own, this information is of very limited use. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/0c98026c-28a9-4c69-9f34-4c3bd4f75d85?source=cve - https://plugins.trac.wordpress.org/browser/mollie-payments-for-woocommerce/tags/7.5.5/vendor/mollie/mollie-api-php/examples/initialize.php#L5 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3142176%40mollie-payments-for-woocommerce&new=3142176%40mollie-payments-for-woocommerce&sfp_email=&sfph_mail=
CVE ID: CVE-2024-6449 State: PUBLISHED Published: 2024-08-28T11:49:42.295Z Last Updated: 2025-01-09T17:39:36.743Z Vendors: HyperView Products: Geoportal Toolkit Problem Types: CWE-942 Description: HyperView Geoportal Toolkit in versions lower than 8.5.0 does not restrict cross-domain requests when fetching remote content pointed by one of GET request parameters. An unauthenticated remote attacker can prepare links, which upon opening will load scripts from a remote location controlled by the attacker and execute them in the user space. By manipulating this parameter it is also possible to enumerate some of the devices in Local Area Network in which the server resides. Additional Analyst Note
lso possible to enumerate some of the devices in Local Area Network in which the server resides. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert.pl/en/posts/2024/08/CVE-2024-6449 - https://cert.pl/posts/2024/08/CVE-2024-6449
CVE ID: CVE-2024-6450 State: PUBLISHED Published: 2024-08-28T11:50:20.929Z Last Updated: 2025-01-09T17:38:27.480Z Vendors: HyperView Products: Geoportal Toolkit Problem Types: CWE-79 Description: HyperView Geoportal Toolkit in versions lower than 8.5.0 is vulnerable to Reflected Cross-Site Scripting (XSS). An unauthenticated attacker might trick somebody into using a crafted URL, which will cause a script to be run in user's browser. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert.pl/en/posts/2024/08/CVE-2024-6449 - https://cert.pl/posts/2024/08/CVE-2024-6449
CVE ID: CVE-2024-6451 State: PUBLISHED Published: 2024-08-19T06:00:05.024Z Last Updated: 2024-08-19T17:10:21.720Z Vendors: Unknown Products: AI Engine Problem Types: CWE-94 Improper Control of Generation of Code ('Code Injection') Description: AI Engine < 2.4.3 is susceptible to remote-code-execution (RCE) via Log Poisoning. The AI Engine WordPress plugin before 2.5.1 fails to validate the file extension of "logs_path", allowing Administrators to change log filetypes from .log to .php. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/fc06d413-a227-470c-a5b7-cdab57aeab34/
CVE ID: CVE-2024-6452 State: PUBLISHED Published: 2024-07-02T20:00:05.322Z Last Updated: 2024-08-01T21:41:03.400Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: linlinjava Products: litemall Problem Types: CWE-89 Description: A vulnerability classified as critical was found in linlinjava litemall up to 1.8.0. Affected by this vulnerability is an unknown functionality of the file AdminGoodscontroller.java. The manipulation of the argument goodsId/goodsSn/name leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-270235. Additional Analyst Notes: - CISA ADP
ic and may be used. The associated identifier of this vulnerability is VDB-270235. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.270235 - https://vuldb.com/?ctiid.270235 - https://vuldb.com/?submit.367635 - https://github.com/linlinjava/litemall/issues/548
CVE ID: CVE-2024-6453 State: PUBLISHED Published: 2024-07-02T21:31:03.611Z Last Updated: 2024-08-01T21:41:03.406Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: itsourcecode Products: Farm Management System Problem Types: CWE-89 Description: A vulnerability was found in itsourcecode Farm Management System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /quarantine.php?id=3. The manipulation of the argument pigno/breed/reason leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-270241 was assigned to this vulnerability. NOTE: Orig
s been disclosed to the public and may be used. The identifier VDB-270241 was assigned to this vulnerability. NOTE: Original submission mentioned parameter pigno only but the VulDB data analysis team determined two additional parameters to be affected as well. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.270241 - https://vuldb.com/?ctiid.270241 - https://vuldb.com/?submit.367626 - https://github.com/7u7777/cve/issues/3
CVE ID: CVE-2024-6455 State: PUBLISHED Published: 2024-07-18T20:32:37.651Z Last Updated: 2024-08-09T19:11:27.770Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: xpeedstudio Products: ElementsKit Elementor addons Problem Types: CWE-200 Description: The ElementsKit Elementor addons plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 3.2.0 due to a missing capability checks on ekit_widgetarea_content function. This makes it possible for unauthenticated attackers to view any item created in Elementor, such as posts, pages and templates including drafts, pending and private items. Additional Analyst Notes: - CISA ADP
r, such as posts, pages and templates including drafts, pending and private items. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/7c336530-09b2-4ead-923f-f1a6266e3e8e?source=cve - https://plugins.trac.wordpress.org/browser/elementskit-lite/tags/3.2.0/modules/controls/widget-area-utils.php#L15
CVE ID: CVE-2024-6456 State: PUBLISHED Published: 2024-08-15T20:10:58.586Z Last Updated: 2024-08-16T13:32:49.662Z Vendors: AVEVA Products: Historian Web Server Problem Types: CWE-89 Description: AVEVA Historian Server has a vulnerability, if exploited, could allow a malicious SQL command to execute under the privileges of an interactive Historian REST Interface user who had been socially engineered by a miscreant into opening a specially crafted URL. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-24-228-10
CVE ID: CVE-2024-6457 State: PUBLISHED Published: 2024-07-16T11:00:58.729Z Last Updated: 2024-08-01T21:41:03.359Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: realmag777 Products: HUSKY – Products Filter Professional for WooCommerce Problem Types: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Description: The HUSKY – Products Filter Professional for WooCommerce plugin for WordPress is vulnerable to time-based SQL Injection via the ‘woof_author’ parameter in all versions up to, and including, 1.3.6 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing S
, 1.3.6 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/ecfdf7b1-9bb8-4c1d-a00a-ca1e44440cab?source=cve - https://plugins.trac.wordpress.org/browser/woocommerce-products-filter/trunk/ext/by_author/index.php#L102 - https://plugins.trac.wordpress.org/changeset/3116888/
CVE ID: CVE-2024-6458 State: PUBLISHED Published: 2024-07-27T08:36:37.479Z Last Updated: 2024-08-01T21:41:03.376Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: wcproducttable Products: WooCommerce Product Table Lite Problem Types: CWE-862 Description: The WooCommerce Product Table Lite plugin for WordPress is vulnerable to unauthorized post title modification due to a missing capability check on the wcpt_presets__duplicate_preset_to_table function in all versions up to, and including, 3.5.1. This makes it possible for authenticated attackers with subscriber access and above to change titles of arbitrary posts. Missing sanitization can lead to Stored Cross-
ers with subscriber access and above to change titles of arbitrary posts. Missing sanitization can lead to Stored Cross-Site Scripting when viewed by an admin via the WooCommerce Product Table. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/e06fb465-4c72-49a8-af35-ff6d629ff9a0?source=cve - https://plugins.trac.wordpress.org/browser/wc-product-table-lite/trunk/presets/presets.php#L120 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3125858%40wc-product-table-lite&new=3125858%40wc-product-table-lite&sfp_email=&sfph_mail=
CVE ID: CVE-2024-6459 State: PUBLISHED Published: 2024-08-17T06:00:02.718Z Last Updated: 2024-09-13T14:04:34.741Z Vendors: Unknown Products: News Element Elementor Blog Magazine Problem Types: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Description: The News Element Elementor Blog Magazine WordPress plugin before 1.0.6 is vulnerable to Local File Inclusion via the template parameter. This makes it possible for unauthenticated attacker to include and execute PHP files on the server, allowing the execution of any PHP code in those files. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/330359fa-d085-4923
es. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/330359fa-d085-4923-b5a8-c0e2e5267247/
CVE ID: CVE-2024-6460 State: PUBLISHED Published: 2024-08-16T06:00:02.447Z Last Updated: 2024-09-13T14:06:36.456Z Vendors: Unknown Products: Grow by Tradedoubler Problem Types: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Description: The Grow by Tradedoubler WordPress plugin through 2.0.21 is vulnerable to Local File Inclusion via the component parameter. This makes it possible for attackers to include and execute PHP files on the server, allowing the execution of any PHP code in those files. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/ba2f53e0-30be-4f37-91bc-5fa151f1eee7/
CVE ID: CVE-2024-6461 State: REJECTED Published: N/A Last Updated: 2024-07-03T20:36:30.787Z Description: No description available.
CVE ID: CVE-2024-6462 State: PUBLISHED Published: 2025-05-15T20:07:07.214Z Last Updated: 2025-05-20T19:24:50.177Z Vendors: Unknown Products: DL Yandex Metrika Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The DL Yandex Metrika WordPress plugin through 1.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/0880fa33-3efa-4f50-83c8-4c90cb805eb9/
CVE ID: CVE-2024-6463 State: REJECTED Published: N/A Last Updated: 2024-07-03T20:44:50.604Z Description: No description available.
CVE ID: CVE-2024-6464 State: REJECTED Published: N/A Last Updated: 2024-07-03T20:44:56.821Z Description: No description available.
CVE ID: CVE-2024-6465 State: PUBLISHED Published: 2024-07-13T11:19:02.491Z Last Updated: 2024-08-01T21:41:03.427Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: rico-macchi Products: WP Links Page Problem Types: CWE-862 Missing Authorization Description: The WP Links Page plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'wplf_ajax_update_screenshots' function in all versions up to, and including, 4.9.5. This makes it possible for authenticated attackers, with Subscriber-level access and above, to regenerate the link's thumbnail image. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Pro
access and above, to regenerate the link's thumbnail image. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/2b59d281-d5c8-455a-8aa8-b03847bdd45f?source=cve - https://plugins.trac.wordpress.org/browser/wp-links-page/trunk/wp-links-page-free.php#L172 - https://plugins.trac.wordpress.org/changeset/3116973/
CVE ID: CVE-2024-6466 State: PUBLISHED Published: 2025-01-21T10:03:24.544Z Last Updated: 2025-01-21T19:43:54.175Z Vendors: NEC Corporation Products: WebSAM DeploymentManager Problem Types: CWE-1021 Description: NEC Corporation's WebSAM DeploymentManager v6.0 to v6.80 allows an attacker to reset configurations or restart products via network with X-FRAME-OPTIONS is not specified. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://jpn.nec.com/security-info/secinfo/nv15-019_en.html
CVE ID: CVE-2024-6467 State: PUBLISHED Published: 2024-07-17T06:45:11.571Z Last Updated: 2024-08-01T21:41:03.419Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: reputeinfosystems Products: Appointment Booking Calendar Plugin and Online Scheduling Plugin – BookingPress Problem Types: CWE-73 External Control of File Name or Path Description: The BookingPress – Appointment Booking Calendar Plugin and Online Scheduling Plugin plugin for WordPress is vulnerable to Arbitrary File Read to Arbitrary File Creation in all versions up to, and including, 1.1.5 via the 'bookingpress_save_lite_wizard_settings_func' function. This makes it possible for authenticated attacke
, 1.1.5 via the 'bookingpress_save_lite_wizard_settings_func' function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to create arbitrary files that contain the content of files on the server, allowing the execution of any PHP code in those files or the exposure of sensitive information. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/d0177510-cd7d-4cc5-96c3-78433aa0e3f6?source=cve - https://plugins.trac.wordpress.org/changeset/3116857/bookingpress-appointment-booking/trunk/core/classes/class.bookingpress.php
CVE ID: CVE-2024-6468 State: PUBLISHED Published: 2024-07-11T20:40:12.298Z Last Updated: 2024-08-01T21:41:03.514Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: HashiCorp Products: Vault, Vault Enterprise Problem Types: CWE-703 Description: Vault and Vault Enterprise did not properly handle requests originating from unauthorized IP addresses when the TCP listener option, proxy_protocol_behavior, was set to deny_unauthorized. When receiving a request from a source IP address that was not listed in proxy_protocol_authorized_addrs, the Vault API server would shut down and no longer respond to any HTTP requests, potentially resulting in denial of service. While t
I server would shut down and no longer respond to any HTTP requests, potentially resulting in denial of service. While this bug also affected versions of Vault up to 1.17.1 and 1.16.5, a separate regression in those release series did not allow Vault operators to configure the deny_unauthorized option, thus not allowing the conditions for the denial of service to occur. Fixed in Vault and Vault Enterprise 1.17.2, 1.16.6, and 1.15.12. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://discuss.hashicorp.com/t/hcsec-2024-14-vault-vulnerable-to-denial-of-service-when-setting-a-proxy-protocol-behavior/68518
CVE ID: CVE-2024-6469 State: PUBLISHED Published: 2024-07-03T10:31:03.590Z Last Updated: 2024-08-01T21:41:03.421Z Severity: N/A (CVSS 3.3 AV:N/AC:L/Au:M/C:N/I:P/A:N) Vendors: n/a Products: playSMS Problem Types: CWE-74 Description: A vulnerability was found in playSMS 1.4.3. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /index.php?app=main&inc=feature_firewall&op=firewall_list of the component Template Handler. The manipulation of the argument IP address with the input {{`id`} leads to injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-270277 was assigne
e launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-270277 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.270277 - https://vuldb.com/?ctiid.270277 - https://vuldb.com/?submit.363730
CVE ID: CVE-2024-6470 State: PUBLISHED Published: 2024-07-03T12:31:03.496Z Last Updated: 2024-08-01T21:41:03.407Z Severity: N/A (CVSS 3.3 AV:N/AC:L/Au:M/C:N/I:P/A:N) Vendors: n/a Products: playSMS Problem Types: CWE-74 Description: A vulnerability was found in playSMS 1.4.3. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /index.php?app=main&inc=feature_inboxgroup&op=list of the component Template Handler. The manipulation of the argument Receiver Number with the input {{`id`}} leads to injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-270278 is the identifier assigned to this v
remotely. The exploit has been disclosed to the public and may be used. VDB-270278 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.270278 - https://vuldb.com/?ctiid.270278 - https://vuldb.com/?submit.363733
CVE ID: CVE-2024-6471 State: PUBLISHED Published: 2024-07-03T13:31:07.394Z Last Updated: 2024-08-01T21:41:03.513Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: SourceCodester Products: Online Tours & Travels Management Problem Types: CWE-89 Description: A vulnerability classified as critical has been found in SourceCodester Online Tours & Travels Management 1.0. This affects an unknown part of the file sms_setting.php. The manipulation of the argument uname leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-270279. Additional Analyst Notes:
to the public and may be used. The associated identifier of this vulnerability is VDB-270279. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.270279 - https://vuldb.com/?ctiid.270279 - https://vuldb.com/?submit.367953 - https://blog.csdn.net/ENTICE1208/article/details/140141934
CVE ID: CVE-2024-6472 State: PUBLISHED Published: 2024-08-05T12:55:39.199Z Last Updated: 2024-08-05T14:32:48.640Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: The Document Foundation Products: LibreOffice Problem Types: CWE-295 Description: Certificate Validation user interface in LibreOffice allows potential vulnerability. Signed macros are scripts that have been digitally signed by the developer using a cryptographic signature. When a document with a signed macro is opened a warning is displayed by LibreOffice before the macro is executed. Previously if verification failed the user could fail to understand the failure and choose to enable the macros anywa
d. Previously if verification failed the user could fail to understand the failure and choose to enable the macros anyway. This issue affects LibreOffice: from 24.2 before 24.2.5. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.libreoffice.org/about-us/security/advisories/CVE-2024-6472
CVE ID: CVE-2024-6473 State: PUBLISHED Published: 2024-09-03T10:35:59.145Z Last Updated: 2024-09-03T13:55:15.844Z Vendors: Yandex Products: Browser Problem Types: CWE-426 Description: Yandex Browser for Desktop before 24.7.1.380 has a DLL Hijacking Vulnerability because an untrusted search path is used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://yandex.com/bugbounty/i/hall-of-fame-browser/
CVE ID: CVE-2024-6474 State: REJECTED Published: N/A Last Updated: 2025-07-05T22:16:34.129Z Description: No description available.
CVE ID: CVE-2024-6475 State: REJECTED Published: N/A Last Updated: 2025-07-05T22:16:34.289Z Description: No description available.
CVE ID: CVE-2024-6476 State: PUBLISHED Published: 2024-11-26T07:00:46.615Z Last Updated: 2024-11-26T14:09:25.935Z Severity: MEDIUM (CVSS 4.2 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:L) Vendors: Axis Communications AB Products: AXIS Camera Station Pro, AXIS Camera Station Problem Types: CWE-276 Description: Gee-netics, member of the AXIS Camera Station Pro Bug Bounty Program has found that it is possible for a non-admin user to gain system privileges by redirecting a file deletion upon service restart. Axis has released patched versions for the highlighted flaw. Please refer to the Axis security advisory for more information and solution. Additional Analyst Notes: - CISA ADP Vulnrichment: R