Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-44307 State: PUBLISHED Published: 2024-11-19T23:43:48.424Z Last Updated: 2024-11-20T15:27:49.507Z Vendors: Apple Products: macOS Problem Types: An app may be able to execute arbitrary code with kernel privileges Description: A buffer overflow issue was addressed with improved memory handling. This issue is fixed in macOS Sonoma 14.6. An app may be able to execute arbitrary code with kernel privileges. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.apple.com/en-us/120911
CVE ID: CVE-2024-44308 State: PUBLISHED Published: 2024-11-19T23:43:50.135Z Last Updated: 2025-11-03T22:13:32.370Z Vendors: Apple Products: Safari, macOS, iOS and iPadOS, visionOS Problem Types: Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited on Intel-based Mac systems. Description: The issue was addressed with improved checks. This issue is fixed in Safari 18.1.1, iOS 17.7.2 and iPadOS 17.7.2, macOS Sequoia 15.1.1, iOS 18.1.1 and iPadOS 18.1.1, visionOS 2.1.1. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue m
ssing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited on Intel-based Mac systems. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://support.apple.com/en-us/121756 - https://support.apple.com/en-us/121753 - https://support.apple.com/en-us/121752 - https://support.apple.com/en-us/121755 - https://support.apple.com/en-us/121754
CVE ID: CVE-2024-44309 State: PUBLISHED Published: 2024-11-19T23:43:55.493Z Last Updated: 2025-11-03T22:13:35.289Z Vendors: Apple Products: Safari, macOS, iOS and iPadOS, visionOS Problem Types: Processing maliciously crafted web content may lead to a cross site scripting attack. Apple is aware of a report that this issue may have been actively exploited on Intel-based Mac systems. Description: A cookie management issue was addressed with improved state management. This issue is fixed in Safari 18.1.1, iOS 17.7.2 and iPadOS 17.7.2, macOS Sequoia 15.1.1, iOS 18.1.1 and iPadOS 18.1.1, visionOS 2.1.1. Processing maliciously crafted web content may lead to a cross site scripting attack. Apple is
S 18.1.1, visionOS 2.1.1. Processing maliciously crafted web content may lead to a cross site scripting attack. Apple is aware of a report that this issue may have been actively exploited on Intel-based Mac systems. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://support.apple.com/en-us/121756 - https://support.apple.com/en-us/121753 - https://support.apple.com/en-us/121752 - https://support.apple.com/en-us/121755 - https://support.apple.com/en-us/121754
CVE ID: CVE-2024-44313 State: PUBLISHED Published: 2025-03-18T00:00:00.000Z Last Updated: 2025-03-25T18:16:50.241Z Vendors: n/a Products: n/a Problem Types: n/a Description: TastyIgniter 3.7.6 contains an Incorrect Access Control vulnerability in the invoice() function within Orders.php which allows unauthorized users to access and generate invoices due to missing permission checks. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/tastyigniter/TastyIgniter/blob/3.x/app/admin/controllers/Orders.php - https://medium.com/@cnetsec/cve-2024-44313-incorrect-access-control-in-tastyigniter-3-7-6-01a73c548b74
CVE ID: CVE-2024-44314 State: PUBLISHED Published: 2025-03-18T00:00:00.000Z Last Updated: 2025-03-21T15:00:15.296Z Vendors: n/a Products: n/a Problem Types: n/a Description: TastyIgniter 3.7.6 contains an Incorrect Access Control vulnerability in the Orders Management System, allowing unauthorized users to update order statuses. The issue occurs in the index_onUpdateStatus() function within Orders.php, which fails to verify if the user has permission to modify an order's status. This flaw can be exploited remotely, leading to unauthorized order manipulation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/tastyigniter/TastyIgniter/blob/3.x/app/admin/contro
yst Notes: - CISA ADP Vulnrichment: References: - https://github.com/tastyigniter/TastyIgniter/blob/3.x/app/admin/controllers/Orders.php - https://medium.com/@cnetsec/cve-2024-44314-incorrect-access-control-in-function-updateorder-fc5f2b1b0467
CVE ID: CVE-2024-44331 State: PUBLISHED Published: 2024-10-22T00:00:00 Last Updated: 2024-10-23T17:53:36.023Z Vendors: n/a Products: n/a Problem Types: n/a Description: Incorrect Access Control in GStreamer RTSP server 1.25.0 in gst-rtsp-server/rtsp-media.c allows remote attackers to cause a denial of service via a series of specially crafted hexstream requests. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/dqp10515/security/tree/main/gst-rtsp-server_bug/bug1 - https://gist.github.com/dqp10515/c6a8879bebe92d8c74f7c52667fd3400
CVE ID: CVE-2024-44333 State: PUBLISHED Published: 2024-09-09T00:00:00 Last Updated: 2024-09-09T20:43:23.400Z Vendors: n/a Products: n/a Problem Types: n/a Description: D-Link DI-7003GV2 v24.04.18D1, DI-7100G+V2 v24.04.18D1, DI-7100GV2 v24.04.18D1, DI-7200GV2 v24.04.18E1, DI-7300G+V2 v24.04.18D1, and DI-7400G+V2 v24.04.18D1 are vulnerable to Remote Command Execution. An attacker can achieve arbitrary command execution by sending a carefully crafted malicious string to the CGI function responsible for handling usb_paswd.asp. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.dlink.com/en/security-bulletin/ - https://gist.github.com/Swind1er/c8656b32058e28e64f92d100c9
References: - https://www.dlink.com/en/security-bulletin/ - https://gist.github.com/Swind1er/c8656b32058e28e64f92d100c92ca12c
CVE ID: CVE-2024-44334 State: PUBLISHED Published: 2024-09-09T00:00:00 Last Updated: 2024-09-09T19:28:56.670Z Vendors: n/a Products: n/a Problem Types: n/a Description: D-Link DI-7003GV2 v24.04.18D1, DI-7100G+V2 v24.04.18D1, DI-7100GV2 v24.04.18D1, DI-7200GV2 v24.04.18E1, DI-7300G+V2 v24.04.18D1, and DI-7400G+V2 v24.04.18D1 are vulnerable to Remote Command Execution due to insufficient parameter filtering in the CGI handling function of upgrade_filter.asp. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.dlink.com/en/security-bulletin/ - https://gist.github.com/Swind1er/563789899a7a4b9c261045a15efea952
CVE ID: CVE-2024-44335 State: PUBLISHED Published: 2024-09-09T00:00:00 Last Updated: 2024-09-09T19:14:19.577Z Vendors: n/a Products: n/a Problem Types: n/a Description: D-Link DI-7003G v19.12.24A1, DI-7003GV2 v24.04.18D1, DI-7100G+V2 v24.04.18D1, DI-7100GV2 v24.04.18D1, DI-7200GV2 v24.04.18E1, DI-7300G+V2 v24.04.18D1, and DI-7400G+V2 v24.04.18D1 are vulnerable to Remote Command Execution (RCE) via version_upgrade.asp. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.dlink.com/en/security-bulletin/ - https://gist.github.com/Swind1er/029fb2a9dab916f926fab40cc059223f
CVE ID: CVE-2024-44336 State: PUBLISHED Published: 2025-02-11T00:00:00.000Z Last Updated: 2025-02-13T14:15:42.103Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in AnkiDroid Android Application v2.17.6 allows attackers to retrieve internal files from the /data/data/com.ichi2.anki/ directory and save it into publicly available storage. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/blackbeard666/security-research/tree/main/CVE-2024-44336
CVE ID: CVE-2024-44337 State: PUBLISHED Published: 2024-10-15T00:00:00 Last Updated: 2024-11-14T16:11:29.351Z Vendors: n/a Products: n/a Problem Types: n/a Description: The package `github.com/gomarkdown/markdown` is a Go library for parsing Markdown text and rendering as HTML. Prior to pseudoversion `v0.0.0-20240729232818-a2a9c4f`, which corresponds with commit `a2a9c4f76ef5a5c32108e36f7c47f8d310322252`, there was a logical problem in the paragraph function of the parser/block.go file, which allowed a remote attacker to cause a denial of service (DoS) condition by providing a tailor-made input that caused an infinite loop, causing the program to hang and consume resources indefinitely. Subm
g a tailor-made input that caused an infinite loop, causing the program to hang and consume resources indefinitely. Submit `a2a9c4f76ef5a5c32108e36f7c47f8d310322252` contains fixes to this problem. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/gomarkdown/markdown/commit/a2a9c4f76ef5a5c32108e36f7c47f8d310322252 - https://github.com/Brinmon/CVE-2024-44337
CVE ID: CVE-2024-44340 State: PUBLISHED Published: 2024-08-27T00:00:00 Last Updated: 2024-08-27T17:18:15.060Z Vendors: n/a Products: n/a Problem Types: n/a Description: D-Link DIR-846W A1 FW100A43 was discovered to contain a remote command execution (RCE) vulnerability via keys smartqos_express_devices and smartqos_normal_devices in SetSmartQoSSettings. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.dlink.com/en/security-bulletin/ - http://www.dlink.com.cn/techsupport/ProductInfo.aspx?m=DIR-846W - https://github.com/yali-1002/some-poc/blob/main/CVE-2024-44340
CVE ID: CVE-2024-44341 State: PUBLISHED Published: 2024-08-27T00:00:00 Last Updated: 2024-08-27T17:15:18.361Z Vendors: n/a Products: n/a Problem Types: n/a Description: D-Link DIR-846W A1 FW100A43 was discovered to contain a remote command execution (RCE) vulnerability via the lan(0)_dhcps_staticlist parameter. This vulnerability is exploited via a crafted POST request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.dlink.com/en/security-bulletin/ - http://www.dlink.com.cn/techsupport/ProductInfo.aspx?m=DIR-846W - https://github.com/yali-1002/some-poc/blob/main/CVE-2024-44341
CVE ID: CVE-2024-44342 State: PUBLISHED Published: 2024-08-27T00:00:00 Last Updated: 2024-08-27T17:13:14.082Z Vendors: n/a Products: n/a Problem Types: n/a Description: D-Link DIR-846W A1 FW100A43 was discovered to contain a remote command execution (RCE) vulnerability via the wl(0).(0)_ssid parameter. This vulnerability is exploited via a crafted POST request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.dlink.com/en/security-bulletin/ - http://www.dlink.com.cn/techsupport/ProductInfo.aspx?m=DIR-846W - https://github.com/yali-1002/some-poc/blob/main/CVE-2024-44342
CVE ID: CVE-2024-44349 State: PUBLISHED Published: 2024-10-08T00:00:00 Last Updated: 2024-10-10T12:51:44.483206 Vendors: n/a Products: n/a Problem Types: n/a Description: A SQL injection vulnerability in login portal in AnteeoWMS before v4.7.34 allows unauthenticated attackers to execute arbitrary SQL commands via the username parameter and disclosure of some data in the underlying DB. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cybergon.com/ - https://blog.cybergon.com/posts/cve-2024-44349/ - https://github.com/AndreaF17/PoC-CVE-2024-44349
CVE ID: CVE-2024-44373 State: PUBLISHED Published: 2025-08-19T00:00:00.000Z Last Updated: 2025-08-19T19:44:28.801Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Path Traversal vulnerability in AllSky v2023.05.01_04 allows an unauthenticated attacker to create a webshell and remote code execution via the path, content parameter to /includes/save_file.php. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/AllskyTeam/allsky - https://github.com/AllskyTeam/allsky/blob/master/html/includes/save_file.php - https://lean-strand-cb6.notion.site/CVE-2024-44373-21efbd400a6c80f4a5abf5d5eb9b068c
CVE ID: CVE-2024-44375 State: PUBLISHED Published: 2024-09-09T00:00:00.000Z Last Updated: 2025-03-17T14:06:50.174Z Vendors: n/a Products: n/a Problem Types: n/a Description: D-Link DI-8100 v16.07.26A1 has a stack overflow vulnerability in the dbsrv_asp function. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.dlink.com/en/security-bulletin/ - https://github.com/Nop3z/CVE/blob/main/dlink/DI-8100/Dlink-di8100-dbsrv_asp-overflow.md
CVE ID: CVE-2024-44381 State: PUBLISHED Published: 2024-08-23T00:00:00 Last Updated: 2024-08-23T17:52:04.156Z Vendors: n/a Products: n/a Problem Types: n/a Description: D-Link DI_8004W 16.07.26A1 contains a command execution vulnerability in jhttpd msp_info_htm function. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.dlink.com/en/security-bulletin/ - https://github.com/GroundCTL2MajorTom/pocs/blob/main/dlink_DI8004W.md
CVE ID: CVE-2024-44382 State: PUBLISHED Published: 2024-08-23T00:00:00 Last Updated: 2024-08-23T17:30:03.222Z Vendors: n/a Products: n/a Problem Types: n/a Description: D-Link DI_8004W 16.07.26A1 contains a command execution vulnerability in the jhttpd upgrade_filter_asp function. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.dlink.com/en/security-bulletin/ - https://github.com/GroundCTL2MajorTom/pocs/blob/main/dlink_DI8004W.md
CVE ID: CVE-2024-44383 State: PUBLISHED Published: 2024-09-04T00:00:00 Last Updated: 2024-09-04T14:06:48.988Z Vendors: n/a Products: n/a Problem Types: n/a Description: WAYOS FBM-291W v19.09.11 is vulnerable to Command Execution via msp_info_htm. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/GroundCTL2MajorTom/pocs/blob/main/wayos_%20FBM_291W.md
CVE ID: CVE-2024-44386 State: PUBLISHED Published: 2024-08-23T00:00:00 Last Updated: 2024-08-23T18:48:47.900Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda FH1206 V1.2.0.8(8155)_EN contains a Buffer Overflow vulnerability via the function fromSetIpBind. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/GroundCTL2MajorTom/pocs/blob/main/tenda_FH1206_buffer_overflow2.md
CVE ID: CVE-2024-44387 State: PUBLISHED Published: 2024-08-23T00:00:00 Last Updated: 2024-08-23T17:00:19.365Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda FH1206 V1.2.0.8(8155)_EN contains a Buffer Overflow vulnerability via the functino formWrlExtraGet. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/GroundCTL2MajorTom/pocs/blob/main/tenda_FH1206_buffer_overflow1.md
CVE ID: CVE-2024-44390 State: PUBLISHED Published: 2024-08-23T00:00:00 Last Updated: 2024-08-23T16:53:52.431Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda FH1206 V1.2.0.8(8155)_EN contains a Buffer Overflow vulnerability via the function formWrlsafeset. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/GroundCTL2MajorTom/pocs/blob/main/tenda_FH1206_buffer_overflow8.md
CVE ID: CVE-2024-44400 State: PUBLISHED Published: 2024-09-04T00:00:00 Last Updated: 2024-10-11T16:33:23.401724 Vendors: n/a Products: n/a Problem Types: n/a Description: A vulnerability was discovered in DI_8400-16.07.26A1, which has been classified as critical. This issue affects the upgrade_filter_asp function in the upgrade_filter.asp file. Manipulation of the path parameter can lead to command injection. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/lonelylonglong/openfile-/blob/main/D-link_DI_8400-16.07.26A1_Command_Injection.md/D-link_DI_8400-16.07.26A1_Command_Injection.md - https://github.com/lonelylonglong/openfile-/blob/main/D-link_DI_8400-16.
-link_DI_8400-16.07.26A1_Command_Injection.md - https://github.com/lonelylonglong/openfile-/blob/main/D-link_DI_8400-16.07.26A1_Command_Injection.md/CVE-2024-44400
CVE ID: CVE-2024-44401 State: PUBLISHED Published: 2024-09-06T00:00:00 Last Updated: 2024-09-06T20:15:52.972Z Vendors: n/a Products: n/a Problem Types: n/a Description: D-Link DI-8100G 17.12.20A1 is vulnerable to Command Injection via sub47A60C function in the upgrade_filter.asp file Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/lonelylonglong/openfile-/blob/main/D-link_DI_8100GA1_Command_Injection.md/D-link_DI_8100GA1_Command_Injection.md - https://github.com/lonelylonglong/openfile-/blob/main/D-link_DI_8100GA1_Command_Injection.md/CVE-2024-44401
CVE ID: CVE-2024-44402 State: PUBLISHED Published: 2024-09-06T00:00:00 Last Updated: 2024-09-06T20:22:20.510Z Vendors: n/a Products: n/a Problem Types: n/a Description: D-Link DI-8100G 17.12.20A1 is vulnerable to Command Injection via msp_info.htm. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/lonelylonglong/openfile-/blob/main/msp.md/msp.md - https://github.com/lonelylonglong/openfile-/blob/main/msp.md/CVE-2024-44402
CVE ID: CVE-2024-44408 State: PUBLISHED Published: 2024-09-06T00:00:00 Last Updated: 2024-09-06T20:27:23.513Z Vendors: n/a Products: n/a Problem Types: n/a Description: D-Link DIR-823G v1.0.2B05_20181207 is vulnerable to Information Disclosure. The device allows unauthorized configuration file downloads, and the downloaded configuration files contain plaintext user passwords. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/lonelylonglong/openfile-/blob/main/DIR-823G.md/DIR-823G.md - https://github.com/lonelylonglong/openfile-/blob/main/DIR-823G.md/CVE-2024-44408
CVE ID: CVE-2024-44410 State: PUBLISHED Published: 2024-09-09T00:00:00 Last Updated: 2024-09-10T14:13:18.642Z Vendors: n/a Products: n/a Problem Types: n/a Description: D-Link DI-8300 v16.07.26A1 is vulnerable to command injection via the upgrade_filter_asp function. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.dlink.com/en/security-bulletin/ - https://github.com/LYaoBoL/IOTsec/blob/main/D-Link/DI-8300A1/DI-8300A1.md - https://github.com/LYaoBoL/IOTsec/blob/main/D-Link/DI-8300A1/CVE-2024-44410
CVE ID: CVE-2024-44411 State: PUBLISHED Published: 2024-09-09T00:00:00 Last Updated: 2024-09-10T14:10:53.212Z Vendors: n/a Products: n/a Problem Types: n/a Description: D-Link DI-8300 v16.07.26A1 is vulnerable to command injection via the msp_info_htm function. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.dlink.com/en/security-bulletin/ - https://github.com/LYaoBoL/IOTsec/blob/main/D-Link/DI-8300A1/DI-8300A1-2.md - https://github.com/LYaoBoL/IOTsec/blob/main/D-Link/DI-8300A1/CVE-2024-44411
CVE ID: CVE-2024-44413 State: PUBLISHED Published: 2024-10-11T00:00:00 Last Updated: 2024-10-15T20:46:45.226Z Vendors: n/a Products: n/a Problem Types: n/a Description: A vulnerability was discovered in DI_8200-16.07.26A1, which has been classified as critical. This issue affects the upgrade_filter_asp function in the upgrade_filter.asp file. Manipulation of the path parameter can lead to command injection. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/IotChan/cve/blob/main/dlink/di-8300/di-8200.md - https://github.com/IotChan/cve/blob/main/dlink/di-8300/CVE-2024-44413
CVE ID: CVE-2024-44414 State: PUBLISHED Published: 2024-10-11T00:00:00 Last Updated: 2024-10-11T18:20:19.745Z Vendors: n/a Products: n/a Problem Types: n/a Description: A vulnerability was discovered in FBM_292W-21.03.10V, which has been classified as critical. This issue affects the sub_4901E0 function in the msp_info.htm file. Manipulation of the path parameter can lead to command injection. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/IotChan/cve/blob/main/wayos/FBM_292W/wayos%20FBM_292W.md - https://github.com/IotChan/cve/blob/main/wayos/FBM_292W/CVE-2024-44414
CVE ID: CVE-2024-44415 State: PUBLISHED Published: 2024-10-11T00:00:00 Last Updated: 2024-10-15T20:43:03.154Z Vendors: n/a Products: n/a Problem Types: n/a Description: A vulnerability was discovered in DI_8200-16.07.26A1, There is a buffer overflow in the dbsrv_asp function; The strcpy function is executed without checking the length of the string, leading to a buffer overflow. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/IotChan/cve/blob/main/dlink/DI-8200/Dlink%20DI-8200.md - https://github.com/IotChan/cve/blob/main/dlink/DI-8200/CVE-2024-44415
CVE ID: CVE-2024-44430 State: PUBLISHED Published: 2024-09-13T00:00:00 Last Updated: 2024-09-16T15:33:43.463Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL Injection vulnerability in Best Free Law Office Management Software-v1.0 allows an attacker to execute arbitrary code and obtain sensitive information via a crafted payload to the kortex_lite/control/register_case.php interface Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://blog.csdn.net/samwbs/article/details/140954482 - https://github.com/samwbs/kortexcve/blob/main/xss_register_case/XSS_register_case.md
CVE ID: CVE-2024-44439 State: PUBLISHED Published: 2024-10-04T00:00:00 Last Updated: 2024-10-08T15:59:32.957Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in Shanghai Zhouma Network Technology CO., Ltd IMS Intelligent Manufacturing Collaborative Internet of Things System v.1.9.1 allows a remote attacker to escalate privileges via the open port. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.notion.so/f7da442e0f8a40fc846eea495dcdd329?pvs=4 - https://smiling-lemonade-122.notion.site/f7da442e0f8a40fc846eea495dcdd329
CVE ID: CVE-2024-44445 State: REJECTED Published: 2024-09-16T00:00:00 Last Updated: 2024-11-21T21:13:28.546072 Description: No description available.
CVE ID: CVE-2024-44449 State: PUBLISHED Published: 2025-02-03T00:00:00.000Z Last Updated: 2025-03-19T17:48:15.878Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting vulnerability in Quorum onQ OS v.6.0.0.5.2064 allows a remote attacker to obtain sensitive information via the msg parameter in the Login page. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://quorum.com/about/ - https://seclists.org/fulldisclosure/2025/Jan/23
CVE ID: CVE-2024-44450 State: PUBLISHED Published: 2025-01-07T00:00:00 Last Updated: 2025-01-07T19:01:51.243Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple functions are vulnerable to Authorization Bypass in AIMS eCrew. The issue was fixed in version JUN23 #190. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gist.github.com/BottleOfScotch/85e4c6e1d90060ddebd80b8384d59346
CVE ID: CVE-2024-44459 State: PUBLISHED Published: 2024-09-12T00:00:00 Last Updated: 2024-10-30T19:04:18.493Z Vendors: n/a Products: n/a Problem Types: n/a Description: A memory allocation issue in vernemq v2.0.1 allows attackers to cause a Denial of Service (DoS) via excessive memory consumption. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/zzh-newlearner/MQTT_Crash/blob/main/Vernemq_crash.md
CVE ID: CVE-2024-44460 State: PUBLISHED Published: 2024-09-12T00:00:00 Last Updated: 2024-10-30T19:01:57.575Z Vendors: n/a Products: n/a Problem Types: n/a Description: An invalid read size in Nanomq v0.21.9 allows attackers to cause a Denial of Service (DoS). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/zzh-newlearner/MQTT_Crash/blob/main/Nanomq_invalid_read.md
CVE ID: CVE-2024-44466 State: PUBLISHED Published: 2024-09-11T00:00:00 Last Updated: 2024-09-11T17:33:25.923Z Vendors: n/a Products: n/a Problem Types: n/a Description: COMFAST CF-XR11 V2.7.2 has a command injection vulnerability in function sub_424CB4. Attackers can send POST request messages to /usr/bin/webmgnt and inject commands into parameter iface. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/CurryRaid/iot_vul/tree/main/comfast
CVE ID: CVE-2024-44540 State: PUBLISHED Published: 2024-09-23T00:00:00 Last Updated: 2024-09-23T20:47:41.240Z Vendors: n/a Products: n/a Problem Types: n/a Description: Ubiquiti AirMax firmware version firmware version 8 allows attackers with physical access to gain a privileged command shell via the UART Debugging Port. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.linkedin.com/pulse/bypass-de-login-en-airmax-ubiquiti-usando-uart-paso-tillerias-ley-hk1gf/