Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-7202 State: PUBLISHED Published: 2024-07-29T03:11:27.355Z Last Updated: 2024-08-01T21:52:31.217Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Simopro Technology Products: WinMatrix3 Problem Types: CWE-89 Description: The query functionality of WinMatrix3 Web package from Simopro Technology lacks proper validation of user input, allowing unauthenticated remote attackers to inject SQL commands to read, modify, and delete database contents. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.twcert.org.tw/tw/cp-132-7962-dd216-1.html - https://www.twcert.org.tw/en/cp-139-7963-44648-2.html
CVE ID: CVE-2024-7203 State: PUBLISHED Published: 2024-09-03T01:36:32.110Z Last Updated: 2024-09-03T13:55:28.588Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Zyxel Products: ATP series firmware, USG FLEX series firmware Problem Types: CWE-78 Description: A post-authentication command injection vulnerability in Zyxel ATP series firmware versions from V4.60 through V5.38 and USG FLEX series firmware versions from V4.60 through V5.38 could allow an authenticated attacker with administrator privileges to execute some operating system (OS) commands on an affected device by executing a crafted CLI command. Additional Analyst Notes: - CISA ADP Vulnrichment: Refer
mands on an affected device by executing a crafted CLI command. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-multiple-vulnerabilities-in-firewalls-09-03-2024
CVE ID: CVE-2024-7204 State: PUBLISHED Published: 2024-08-02T10:31:38.785Z Last Updated: 2024-08-07T16:14:18.960Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: Ai3 Products: QbiBot Problem Types: CWE-79 Description: Ai3 QbiBot does not properly filter user input, allowing unauthenticated remote attackers to insert JavaScript code into the chat box. Once the recipient views the message, they will be subject to a Stored XSS attack. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-7969-7827e-1.html - https://www.twcert.org.tw/en/cp-139-7975-3e810-2.html
CVE ID: CVE-2024-7205 State: PUBLISHED Published: 2024-07-31T05:51:03.427Z Last Updated: 2024-07-31T14:56:35.429Z Vendors: CoolKit Products: eWeLink Cloud Service Problem Types: CWE-201 Description: When the device is shared, the homepage module are before 2.19.0 in eWeLink Cloud Service allows Secondary user to take over devices as primary user via sharing unnecessary device-sensitive information. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://ewelink.cc/security-advisory-240730/
CVE ID: CVE-2024-7206 State: PUBLISHED Published: 2024-10-08T06:14:12.144Z Last Updated: 2024-10-08T18:40:56.566Z Vendors: eWeLink Products: Zigbee Bridge Pro Problem Types: CWE-295, CWE-798 Description: SSL Pinning Bypass in eWeLink Some hardware products allows local ATTACKER to Decrypt TLS communication and Extract secrets to clone the device via Flash the modified firmware Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://ewelink.cc/security-advisory-firmware-extraction-and-hardware-ssl-pinning-bypass/
CVE ID: CVE-2024-7207 State: REJECTED Published: 2024-09-19T22:17:51.582Z Last Updated: 2024-09-30T19:03:20.448Z Description: No description available.
CVE ID: CVE-2024-7208 State: PUBLISHED Published: 2024-07-30T17:01:44.595Z Last Updated: 2024-10-29T18:51:18.686Z Vendors: HostGator Products: HostGator Problem Types: CWE-290 Authentication Bypass by Spoofing Description: A vulnerability in multi-tenant hosting allows an authenticated sender to spoof the identity of a shared, hosted domain, thus bypass security measures provided by DMARC (or SPF or DKIM) policies. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://kb.cert.org/vuls/id/244112
CVE ID: CVE-2024-7209 State: PUBLISHED Published: 2024-07-30T17:01:05.273Z Last Updated: 2025-02-13T17:58:02.727Z Vendors: NetWin, Bird Products: NetWin, Fastmail Problem Types: CWE-290 Authentication Bypass by Spoofing Description: A vulnerability exists in the use of shared SPF records in multi-tenant hosting providers, allowing attackers to use network authorization to be abused to spoof the email identify of the sender. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://kb.cert.org/vuls/id/244112 - https://www.kb.cert.org/vuls/id/244112
CVE ID: CVE-2024-7211 State: PUBLISHED Published: 2024-08-01T16:49:47.597Z Last Updated: 2025-06-18T18:41:03.926Z Severity: MEDIUM (CVSS 4.7 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N) Vendors: 1E Products: 1E Platform Problem Types: URL Redirection to Untrusted Site ('Open Redirect') Description: The 1E Platform's component utilized the third-party Duende Identity Server, which suffered from an open redirect vulnerability, permitting an attacker to control the redirection path of end users. Note: 1E Platform's component utilizing the third-party Duende Identity Server has been updated with the patch that includes the fix. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - ht
s been updated with the patch that includes the fix. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.teamviewer.com/en/resources/trust-center/security-bulletins/1e-2024-2001/
CVE ID: CVE-2024-7212 State: PUBLISHED Published: 2024-07-30T01:31:04.510Z Last Updated: 2024-08-01T21:52:31.058Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C) Vendors: TOTOLINK Products: A7000R Problem Types: CWE-120 Description: A vulnerability, which was classified as critical, has been found in TOTOLINK A7000R 9.1.0u.6268_B20220504. This issue affects the function loginauth of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument password leads to buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-272783. NOTE: The vendor was contacted early about this di
used. The associated identifier of this vulnerability is VDB-272783. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.272783 - https://vuldb.com/?ctiid.272783 - https://vuldb.com/?submit.378312 - https://github.com/abcdefg-png/IoT-vulnerable/blob/main/TOTOLINK/A7000R/loginauth_password.md
CVE ID: CVE-2024-7213 State: PUBLISHED Published: 2024-07-30T02:31:04.063Z Last Updated: 2024-08-01T21:52:31.549Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C) Vendors: TOTOLINK Products: A7000R Problem Types: CWE-120 Description: A vulnerability, which was classified as critical, was found in TOTOLINK A7000R 9.1.0u.6268_B20220504. Affected is the function setWizardCfg of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument ssid leads to buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-272784. NOTE: The vendor was contacted early about this disclosure but did
. The identifier of this vulnerability is VDB-272784. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.272784 - https://vuldb.com/?ctiid.272784 - https://vuldb.com/?submit.378313 - https://github.com/abcdefg-png/IoT-vulnerable/blob/main/TOTOLINK/A7000R/setWizardCfg.md
CVE ID: CVE-2024-7214 State: PUBLISHED Published: 2024-07-30T03:00:08.298Z Last Updated: 2024-08-01T21:52:31.506Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: TOTOLINK Products: LR350 Problem Types: CWE-77 Description: A vulnerability has been found in TOTOLINK LR350 9.3.5u.6369_B20220309 and classified as critical. Affected by this vulnerability is the function setWanCfg of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument hostName leads to command injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-272785 was assigned to this vulnerability. NOTE: The vendor was contacted early about t
may be used. The identifier VDB-272785 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.272785 - https://vuldb.com/?ctiid.272785 - https://vuldb.com/?submit.378319 - https://github.com/abcdefg-png/IoT-vulnerable/blob/main/TOTOLINK/LR350/setWanCfg.md
CVE ID: CVE-2024-7215 State: PUBLISHED Published: 2024-07-30T03:31:03.942Z Last Updated: 2024-08-01T21:52:31.460Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: TOTOLINK Products: LR1200 Problem Types: CWE-77 Description: A vulnerability was found in TOTOLINK LR1200 9.3.1cu.2832 and classified as critical. Affected by this issue is the function NTPSyncWithHost of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument host_time leads to command injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-272786 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure
VDB-272786 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.272786 - https://vuldb.com/?ctiid.272786 - https://vuldb.com/?submit.378330 - https://github.com/abcdefg-png/IoT-vulnerable/blob/main/TOTOLINK/LR1200/NTPSyncWithHost.md
CVE ID: CVE-2024-7216 State: PUBLISHED Published: 2024-07-30T04:00:05.592Z Last Updated: 2024-08-01T21:52:31.490Z Severity: LOW (CVSS 2.6 CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: TOTOLINK Products: LR1200 Problem Types: CWE-259 Description: A vulnerability was found in TOTOLINK LR1200 9.3.1cu.2832. It has been classified as problematic. This affects an unknown part of the file /etc/shadow.sample. The manipulation leads to use of hard-coded password. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-272787. NOTE: The vendor wa
closed to the public and may be used. The associated identifier of this vulnerability is VDB-272787. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.272787 - https://vuldb.com/?ctiid.272787 - https://vuldb.com/?submit.378331 - https://github.com/abcdefg-png/IoT-vulnerable/blob/main/TOTOLINK/LR1200/shadow.md
CVE ID: CVE-2024-7217 State: PUBLISHED Published: 2024-07-30T04:31:04.864Z Last Updated: 2024-08-01T21:52:31.497Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: TOTOLINK Products: CA300-PoE Problem Types: CWE-120 Description: A vulnerability was found in TOTOLINK CA300-PoE 6.2c.884. It has been declared as critical. This vulnerability affects the function loginauth of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument password leads to buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-272788. NOTE: The vendor was contacted early about this disclosure but d
ed. The identifier of this vulnerability is VDB-272788. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.272788 - https://vuldb.com/?ctiid.272788 - https://vuldb.com/?submit.378333 - https://github.com/abcdefg-png/IoT-vulnerable/blob/main/TOTOLINK/CA300-PoE/loginauth_password.md
CVE ID: CVE-2024-7218 State: PUBLISHED Published: 2024-07-30T05:00:07.128Z Last Updated: 2025-09-01T09:59:14.078Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:ND/RC:UR) Vendors: SourceCodester, Campcodes Products: School Log Management System Problem Types: CWE-79, CWE-94 Description: A flaw has been found in SourceCodester/Campcodes School Log Management System 1.0. Affected is an unknown function of the file /admin/ajax.php?action=save_student. Executing manipulation of the argument Name can lead to cross site scripting. The attack may be performed from remote. The exploit has been published and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Cont
e. The exploit has been published and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.272789 - https://vuldb.com/?ctiid.272789 - https://vuldb.com/?submit.380425 - https://gist.github.com/topsky979/86480890cc621c240c86e95a3de9ecc4
CVE ID: CVE-2024-7219 State: PUBLISHED Published: 2024-07-30T05:31:03.591Z Last Updated: 2025-09-01T09:59:21.550Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: SourceCodester, Campcodes Products: School Log Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability has been found in SourceCodester/Campcodes School Log Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/ajax.php?action=login. The manipulation of the argument Username leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - C
nitiate the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.272790 - https://vuldb.com/?ctiid.272790 - https://vuldb.com/?submit.380426 - https://gist.github.com/topsky979/03c7fe20c80455b4884ae9e6c3f3d978
CVE ID: CVE-2024-7220 State: PUBLISHED Published: 2024-07-30T06:00:08.260Z Last Updated: 2025-09-01T09:59:16.592Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: SourceCodester, Campcodes Products: School Log Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in SourceCodester/Campcodes School Log Management System 1.0. Affected by this issue is some unknown functionality of the file /admin/print_barcode.php. The manipulation of the argument tbl results in sql injection. It is possible to launch the attack remotely. The exploit has been made public and could be used. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Pr
emotely. The exploit has been made public and could be used. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.272791 - https://vuldb.com/?ctiid.272791 - https://vuldb.com/?submit.380427 - https://gist.github.com/topsky979/5cd0b6a43815a0615b8493cde5c4dacf
CVE ID: CVE-2024-7221 State: PUBLISHED Published: 2024-07-30T06:31:04.652Z Last Updated: 2025-09-01T09:59:19.057Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: SourceCodester, Campcodes Products: School Log Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability was determined in SourceCodester/Campcodes School Log Management System 1.0. This affects an unknown part of the file /admin/manage_user.php. This manipulation of the argument ID causes sql injection. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: Referen
licly disclosed and may be utilized. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.272792 - https://vuldb.com/?ctiid.272792 - https://vuldb.com/?submit.380428 - https://gist.github.com/topsky979/1e98c4d1a3ba1ed73aab46d360c1c4b8
CVE ID: CVE-2024-7222 State: PUBLISHED Published: 2024-07-30T07:00:07.146Z Last Updated: 2024-08-01T21:52:31.491Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: SourceCodester Products: Lot Reservation Management System Problem Types: CWE-89 Description: A vulnerability, which was classified as critical, was found in SourceCodester Lot Reservation Management System 1.0. Affected is an unknown function of the file /home.php. The manipulation of the argument type leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-272802 is the identifier assigned to this vulnerability. Additional Analyst Notes: -
to the public and may be used. VDB-272802 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.272802 - https://vuldb.com/?ctiid.272802 - https://vuldb.com/?submit.380469 - https://gist.github.com/topsky979/9f3d490a2bfdb5794dffc2f4aed72250
CVE ID: CVE-2024-7223 State: PUBLISHED Published: 2024-07-30T07:31:04.128Z Last Updated: 2024-08-01T21:52:30.970Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: SourceCodester Products: Lot Reservation Management System Problem Types: CWE-89 Description: A vulnerability has been found in SourceCodester Lot Reservation Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /view_model.php. The manipulation of the argument id leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-272803. Additi
has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-272803. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.272803 - https://vuldb.com/?ctiid.272803 - https://vuldb.com/?submit.380470 - https://gist.github.com/topsky979/4c28743586769e73fe37007ed92cc1a7
CVE ID: CVE-2024-7224 State: PUBLISHED Published: 2024-07-30T08:00:06.861Z Last Updated: 2024-08-01T21:52:31.423Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: SourceCodester Products: Lot Reservation Management System Problem Types: CWE-89 Description: A vulnerability was found in SourceCodester Lot Reservation Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /lot_details.php. The manipulation of the argument id leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-272804. Additional Analyst Notes: -
disclosed to the public and may be used. The identifier of this vulnerability is VDB-272804. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.272804 - https://vuldb.com/?ctiid.272804 - https://vuldb.com/?submit.380471 - https://gist.github.com/topsky979/76bc2c8ce4871ad8bb60c52e47c4fb5b
CVE ID: CVE-2024-7225 State: PUBLISHED Published: 2024-07-30T08:31:04.227Z Last Updated: 2024-08-01T21:52:31.388Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: SourceCodester Products: Insurance Management System Problem Types: CWE-79 Description: A vulnerability was found in SourceCodester Insurance Management System 1.0. It has been classified as problematic. This affects an unknown part of the file /Script/admin/core/update_policy of the component Edit Insurance Policy Page. The manipulation of the argument pname leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-27280
to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-272805 was assigned to this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.272805 - https://vuldb.com/?ctiid.272805 - https://vuldb.com/?submit.380967 - https://github.com/Xu-Mingming/cve/blob/main/xss2.md
CVE ID: CVE-2024-7226 State: PUBLISHED Published: 2024-07-30T09:00:08.175Z Last Updated: 2024-08-01T21:52:31.483Z Severity: N/A (CVSS 5 AV:N/AC:L/Au:N/C:N/I:P/A:N) Vendors: SourceCodester Products: Medicine Tracker System Problem Types: CWE-352 Description: A vulnerability was found in SourceCodester Medicine Tracker System 1.0. It has been declared as problematic. This vulnerability affects unknown code of the file /classes/Users.php?f=save_user of the component Password Change Handler. The manipulation leads to cross-site request forgery. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-272806 is the identifier assigned to this vulnera
ely. The exploit has been disclosed to the public and may be used. VDB-272806 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.272806 - https://vuldb.com/?ctiid.272806 - https://vuldb.com/?submit.380981 - https://github.com/Xu-Mingming/cve/blob/main/CSRF2.md
CVE ID: CVE-2024-7227 State: PUBLISHED Published: 2024-11-22T21:11:51.625Z Last Updated: 2024-11-25T16:55:56.660Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Avast Products: Free Antivirus Problem Types: CWE-59 Description: Avast Free Antivirus AvastSvc Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Avast Free Antivirus. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the Avast Service. By creating a symbolic link, an attacker can abuse t
s vulnerability. The specific flaw exists within the Avast Service. By creating a symbolic link, an attacker can abuse the service to delete a file. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-22272. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-24-1003/
CVE ID: CVE-2024-7228 State: PUBLISHED Published: 2024-11-22T21:11:37.314Z Last Updated: 2024-11-23T01:26:25.282Z Severity: MEDIUM (CVSS 6.1 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H) Vendors: Avast Products: Free Antivirus Problem Types: CWE-59 Description: Avast Free Antivirus Link Following Denial-of-Service Vulnerability. This vulnerability allows local attackers to create a denial-of-service condition on affected installations of Avast Free Antivirus. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the Avast Service. By creating a symbolic link, an attacker can abuse
is vulnerability. The specific flaw exists within the Avast Service. By creating a symbolic link, an attacker can abuse the service to create a folder. An attacker can leverage this vulnerability to create a denial-of-service condition on the system. Was ZDI-CAN-22806. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-24-999/