Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-38993 State: PUBLISHED Published: 2024-07-01T00:00:00 Last Updated: 2024-08-02T04:19:20.439Z Vendors: n/a Products: n/a Problem Types: n/a Description: rjrodger jsonic-next v2.12.1 was discovered to contain a prototype pollution via the function empty. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://gist.github.com/mestrtee/9a2b522d59c53f31f45c1edb96459693
CVE ID: CVE-2024-38994 State: PUBLISHED Published: 2024-07-01T00:00:00 Last Updated: 2024-08-02T04:19:20.389Z Vendors: n/a Products: n/a Problem Types: n/a Description: amoyjs amoy common v1.0.10 was discovered to contain a prototype pollution via the function extend. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://gist.github.com/mestrtee/02091aa86c6c14c29b9703642439dd03
CVE ID: CVE-2024-38996 State: PUBLISHED Published: 2024-07-01T00:00:00 Last Updated: 2024-08-02T04:19:20.621Z Vendors: n/a Products: n/a Problem Types: n/a Description: ag-grid-community v31.3.2 and ag-grid-enterprise v31.3.2 were discovered to contain a prototype pollution via the _.mergeDeep function. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://gist.github.com/mestrtee/c1590660750744f25e86ba1bf240844b - https://gist.github.com/mestrtee/f8037d492dab0d77bca719e05d31c08b - https://gist.github.com/mestrtee/18e
6ba1bf240844b - https://gist.github.com/mestrtee/f8037d492dab0d77bca719e05d31c08b - https://gist.github.com/mestrtee/18e8c27f3a6376e7cf082cfe1ca766fa
CVE ID: CVE-2024-38997 State: PUBLISHED Published: 2024-07-01T00:00:00 Last Updated: 2024-08-02T04:19:20.254Z Vendors: n/a Products: n/a Problem Types: n/a Description: adolph_dudu ratio-swiper v0.0.2 was discovered to contain a prototype pollution via the function extendDefaults. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://gist.github.com/mestrtee/840f5d160aab4151bd0451cfb822e6b5
CVE ID: CVE-2024-38998 State: REJECTED Published: 2024-07-01T00:00:00.000Z Last Updated: 2025-01-28T19:44:53.337Z Description: No description available.
CVE ID: CVE-2024-38999 State: PUBLISHED Published: 2024-07-01T00:00:00 Last Updated: 2024-08-02T04:19:20.589Z Vendors: n/a Products: n/a Problem Types: n/a Description: jrburke requirejs v2.3.6 was discovered to contain a prototype pollution via the function s.contexts._.configure. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://gist.github.com/mestrtee/9acae342285bd2998fa09ebcb1e6d30a
CVE ID: CVE-2024-39000 State: PUBLISHED Published: 2024-07-01T00:00:00 Last Updated: 2024-08-02T04:19:20.497Z Vendors: n/a Products: n/a Problem Types: n/a Description: adolph_dudu ratio-swiper v0.0.2 was discovered to contain a prototype pollution via the function parse. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://gist.github.com/mestrtee/840f5d160aab4151bd0451cfb822e6b5
CVE ID: CVE-2024-39001 State: PUBLISHED Published: 2024-07-01T00:00:00 Last Updated: 2024-08-02T04:19:20.486Z Vendors: n/a Products: n/a Problem Types: n/a Description: ag-grid-enterprise v31.3.2 was discovered to contain a prototype pollution via the component _ModuleSupport.jsonApply. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://gist.github.com/mestrtee/c1590660750744f25e86ba1bf240844b - https://gist.github.com/mestrtee/f8037d492dab0d77bca719e05d31c08b - https://gist.github.com/mestrtee/18e8c27f3a6376e7cf08
ttps://gist.github.com/mestrtee/f8037d492dab0d77bca719e05d31c08b - https://gist.github.com/mestrtee/18e8c27f3a6376e7cf082cfe1ca766fa
CVE ID: CVE-2024-39002 State: PUBLISHED Published: 2024-07-01T00:00:00 Last Updated: 2024-08-02T04:19:20.522Z Vendors: n/a Products: n/a Problem Types: n/a Description: rjrodger jsonic-next v2.12.1 was discovered to contain a prototype pollution via the function util.clone. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://gist.github.com/mestrtee/9a2b522d59c53f31f45c1edb96459693
CVE ID: CVE-2024-39003 State: PUBLISHED Published: 2024-07-01T00:00:00 Last Updated: 2024-08-02T04:19:20.562Z Vendors: n/a Products: n/a Problem Types: n/a Description: amoyjs amoy common v1.0.10 was discovered to contain a prototype pollution via the function setValue. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://gist.github.com/mestrtee/02091aa86c6c14c29b9703642439dd03
CVE ID: CVE-2024-39008 State: PUBLISHED Published: 2024-07-01T00:00:00 Last Updated: 2024-08-02T04:19:20.564Z Vendors: n/a Products: n/a Problem Types: n/a Description: robinweser fast-loops v1.1.3 was discovered to contain a prototype pollution via the function objectMergeDeep. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://gist.github.com/mestrtee/f09a507c8d59fbbb7fd40880cd9b87ed
CVE ID: CVE-2024-39010 State: PUBLISHED Published: 2024-07-30T00:00:00 Last Updated: 2024-08-02T04:19:20.551Z Vendors: n/a Products: n/a Problem Types: n/a Description: chase-moskal snapstate v0.0.9 was discovered to contain a prototype pollution via the function attemptNestedProperty. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://gist.github.com/mestrtee/af7a746df91ab5e944bd7a186816c262
CVE ID: CVE-2024-39011 State: PUBLISHED Published: 2024-07-30T00:00:00 Last Updated: 2024-08-02T04:19:20.626Z Vendors: n/a Products: n/a Problem Types: n/a Description: Prototype Pollution in chargeover redoc v2.0.9-rc.69 allows attackers to execute arbitrary code or cause a Denial of Service (DoS) and cause other impacts via the function mergeObjects. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://gist.github.com/mestrtee/693ef1c8b0a5ff1ae19f253381711f3e
CVE ID: CVE-2024-39012 State: PUBLISHED Published: 2024-07-30T00:00:00 Last Updated: 2024-10-22T20:07:53.191Z Vendors: n/a Products: n/a Problem Types: n/a Description: ais-ltd strategyen v0.4.0 was discovered to contain a prototype pollution via the function mergeObjects. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gist.github.com/mestrtee/acfbd724a4b73bfb5d030575b653453c
CVE ID: CVE-2024-39013 State: PUBLISHED Published: 2024-07-01T00:00:00 Last Updated: 2024-08-21T17:43:51.177Z Vendors: n/a Products: n/a Problem Types: n/a Description: 2o3t-utility v0.1.2 was discovered to contain a prototype pollution via the function extend. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gist.github.com/mestrtee/a2be744675af5ece3240c19fd04fc5e1
CVE ID: CVE-2024-39014 State: PUBLISHED Published: 2024-07-01T00:00:00 Last Updated: 2024-08-21T17:46:10.362Z Vendors: n/a Products: n/a Problem Types: n/a Description: ahilfoley cahil/utils v2.3.2 was discovered to contain a prototype pollution via the function set. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gist.github.com/mestrtee/0501db31c1a6864a169e47097f26ac57
CVE ID: CVE-2024-39015 State: PUBLISHED Published: 2024-07-01T00:00:00 Last Updated: 2024-08-02T04:19:20.481Z Vendors: n/a Products: n/a Problem Types: n/a Description: cafebazaar hod v0.4.14 was discovered to contain a prototype pollution via the function request. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://gist.github.com/mestrtee/7ab061d9eb901cc89652e7666ca3ef52
CVE ID: CVE-2024-39016 State: PUBLISHED Published: 2024-07-01T00:00:00 Last Updated: 2024-08-02T04:19:20.561Z Vendors: n/a Products: n/a Problem Types: n/a Description: che3vinci c3/utils-1 1.0.131 was discovered to contain a prototype pollution via the function assign. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://gist.github.com/mestrtee/865a957857a096221fe6f8b258b282ac
CVE ID: CVE-2024-39017 State: PUBLISHED Published: 2024-07-01T00:00:00 Last Updated: 2024-08-02T04:19:20.493Z Vendors: n/a Products: n/a Problem Types: n/a Description: agreejs shared v0.0.1 was discovered to contain a prototype pollution via the function mergeInternalComponents. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://gist.github.com/mestrtee/039e3e337642e6bb7f36aeddfde41b8b
CVE ID: CVE-2024-39018 State: PUBLISHED Published: 2024-07-01T00:00:00 Last Updated: 2024-08-02T04:19:20.598Z Vendors: n/a Products: n/a Problem Types: n/a Description: harvey-woo cat5th/key-serializer v0.2.5 was discovered to contain a prototype pollution via the function "query". This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://gist.github.com/mestrtee/be75c60307b2292884cc03cebd361f3f
CVE ID: CVE-2024-39019 State: PUBLISHED Published: 2024-07-05T00:00:00 Last Updated: 2024-08-02T04:19:20.485Z Vendors: n/a Products: n/a Problem Types: n/a Description: idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/idcProData_deal.php?mudi=del Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/da271133/cms2/blob/main/44/csrf.md
CVE ID: CVE-2024-39020 State: PUBLISHED Published: 2024-07-05T00:00:00 Last Updated: 2024-08-02T04:19:20.509Z Vendors: n/a Products: n/a Problem Types: n/a Description: idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/vpsApiData_deal.php?mudi=rev&nohrefStr=close Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/da271133/cms2/blob/main/46/csrf.md
CVE ID: CVE-2024-39021 State: PUBLISHED Published: 2024-07-05T00:00:00 Last Updated: 2024-08-19T15:33:03.541Z Vendors: n/a Products: n/a Problem Types: n/a Description: idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/vpsApiData_deal.php?mudi=del Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/da271133/cms2/blob/main/45/csrf.md
CVE ID: CVE-2024-39022 State: PUBLISHED Published: 2024-07-05T00:00:00 Last Updated: 2024-08-02T04:19:20.582Z Vendors: n/a Products: n/a Problem Types: n/a Description: idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/infoSys_deal.php?mudi=deal Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/da271133/cms2/blob/main/47/csrf.md
CVE ID: CVE-2024-39023 State: PUBLISHED Published: 2024-07-05T00:00:00 Last Updated: 2024-08-02T04:19:20.496Z Vendors: n/a Products: n/a Problem Types: n/a Description: idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via admin/info_deal.php?mudi=add&nohrefStr=close Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/da271133/cms2/blob/main/48/csrf.md
CVE ID: CVE-2024-39025 State: PUBLISHED Published: 2024-12-27T00:00:00 Last Updated: 2024-12-31T18:33:26.451Z Vendors: n/a Products: n/a Problem Types: n/a Description: Incorrect access control in the /users endpoint of Cpacker MemGPT v0.3.17 allows attackers to access sensitive data. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/letta-ai/letta/releases/tag/0.3.17 - https://medium.com/@cnetsec/a-vulnerability-cve-2024-39025-has-been-identified-in-lettaai-memgpt-v0-3-17-146cb38bb6db
CVE ID: CVE-2024-39027 State: PUBLISHED Published: 2024-07-05T00:00:00.000Z Last Updated: 2025-03-20T18:53:22.591Z Vendors: n/a Products: n/a Problem Types: n/a Description: SeaCMS v12.9 has an unauthorized SQL injection vulnerability. The vulnerability is caused by the SQL injection through the cid parameter at /js/player/dmplayer/dmku/index.php?ac=edit, which can cause sensitive database information to be leaked. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/seacms-net/CMS/issues/17
CVE ID: CVE-2024-39028 State: PUBLISHED Published: 2024-07-05T00:00:00 Last Updated: 2024-08-02T04:19:20.630Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in SeaCMS <=12.9 which allows remote attackers to execute arbitrary code via admin_ping.php. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/pysnow1/vul_discovery/blob/main/SeaCMS/SeaCMS%20v12.9%20admin_ping.php%20RCE.md
CVE ID: CVE-2024-39031 State: PUBLISHED Published: 2024-07-09T00:00:00 Last Updated: 2024-08-02T04:19:20.560Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Silverpeas Core <= 6.3.5, in Mes Agendas, a user can create new events and add them to their calendar. Additionally, users can invite others from the same domain, including administrators, to these events. A standard user can inject an XSS payload into the "Titre" and "Description" fields when creating an event and then add the administrator or any user to the event. When the invited user (victim) views their own profile, the payload will be executed on their side, even if they do not click on the event. Additional Analyst
heir own profile, the payload will be executed on their side, even if they do not click on the event. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.github.com/Silverpeas/Silverpeas-Core/pull/1346 - https://github.com/toneemarqus/CVE-2024-39031
CVE ID: CVE-2024-39033 State: PUBLISHED Published: 2025-02-06T00:00:00.000Z Last Updated: 2025-02-06T21:24:17.774Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Newgensoft OmniDocs 11.0_SP1_03_006, Insecure Direct Object Reference (IDOR) in the getuserproperty function allows user's configuration and PII to be stolen. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://pastebin.com/SHExsfh6
CVE ID: CVE-2024-39036 State: PUBLISHED Published: 2024-07-16T00:00:00 Last Updated: 2024-08-12T17:23:53.734Z Vendors: n/a Products: n/a Problem Types: n/a Description: SeaCMS v12.9 is vulnerable to Arbitrary File Read via admin_safe.php. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/seacms-net/CMS/issues/18
CVE ID: CVE-2024-39063 State: PUBLISHED Published: 2024-07-09T00:00:00 Last Updated: 2024-08-02T04:19:20.617Z Vendors: n/a Products: n/a Problem Types: n/a Description: Lime Survey <= 6.5.12 is vulnerable to Cross Site Request Forgery (CSRF). The YII_CSRF_TOKEN is only checked when passed in the body of POST requests, but the same check isn't performed in the equivalent GET requests. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/sysentr0py/CVEs/tree/main/CVE-2024-39063
CVE ID: CVE-2024-39069 State: PUBLISHED Published: 2024-07-09T00:00:00 Last Updated: 2024-08-02T04:19:20.573Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in ifood Order Manager v3.35.5 'Gestor de Peddios.exe' allows attackers to execute arbitrary code via a DLL hijacking attack. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://youtu.be/oMIobV2M0T8 - https://github.com/AungSoePaing/CVE-2024-39069
CVE ID: CVE-2024-39071 State: PUBLISHED Published: 2024-07-09T00:00:00 Last Updated: 2024-08-12T16:39:15.169Z Vendors: n/a Products: n/a Problem Types: n/a Description: Fujian Kelixun <=7.6.6.4391 is vulnerable to SQL Injection in send_event.php. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://gist.github.com/Y5neKO/561a038dab8584c1448aad3013b9c2c7
CVE ID: CVE-2024-39072 State: PUBLISHED Published: 2024-07-09T00:00:00 Last Updated: 2024-08-02T04:19:20.527Z Vendors: n/a Products: n/a Problem Types: n/a Description: AMTT Hotel Broadband Operation System (HiBOS) v3.0.3.151204 is vulnerable to SQL injection via manager/conference/calendar_remind.php. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://gist.github.com/Y5neKO/4c15581606c118aa2172afd3b8b74328
CVE ID: CVE-2024-39081 State: PUBLISHED Published: 2024-09-18T00:00:00.000Z Last Updated: 2025-03-17T14:33:15.832Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in SMART TYRE CAR & BIKE v4.2.0 allows attackers to perform a man-in-the-middle attack via Bluetooth communications. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Amirasaiyad/BLE-TPMS/blob/main/README.md - https://github.com/Amirasaiyad/BLE-TPMS/blob/main/Treel_BLE_TPMS_Penetration_Testing_Report.pdf
CVE ID: CVE-2024-39090 State: PUBLISHED Published: 2024-07-18T00:00:00 Last Updated: 2024-08-02T04:19:20.503Z Vendors: n/a Products: n/a Problem Types: n/a Description: The PHPGurukul Online Shopping Portal Project version 2.0 contains a vulnerability that allows Cross-Site Request Forgery (CSRF) to lead to Stored Cross-Site Scripting (XSS). An attacker can exploit this vulnerability to execute arbitrary JavaScript code in the context of a user's session, potentially leading to account takeover. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/arijitdirghanji/My-CVEs/blob/main/CVE-2024-39090.md
CVE ID: CVE-2024-39091 State: PUBLISHED Published: 2024-08-12T00:00:00 Last Updated: 2024-08-13T20:18:09.699Z Vendors: n/a Products: n/a Problem Types: n/a Description: An OS command injection vulnerability in the ccm_debug component of MIPC Camera firmware prior to v5.4.1.240424171021 allows attackers within the same network to execute arbitrary code via a crafted HTML request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://joerngermany.github.io/mipc_vulnerability/
CVE ID: CVE-2024-39094 State: PUBLISHED Published: 2024-08-20T00:00:00.000Z Last Updated: 2025-03-13T15:55:56.891Z Vendors: n/a Products: n/a Problem Types: n/a Description: Friendica 2024.03 is vulnerable to Cross Site Scripting (XSS) in settings/profile via the homepage, xmpp, and matrix parameters. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/friendica/friendica/issues/14220 - https://friendi.ca/2024/08/17/friendica-2024-08-released/ - https://github.com/friendica/friendica/releases/tag/2024.08
CVE ID: CVE-2024-39097 State: PUBLISHED Published: 2024-08-26T00:00:00.000Z Last Updated: 2025-10-30T23:33:03.525Z Vendors: n/a Products: n/a Problem Types: n/a Description: There is an Open Redirect vulnerability in Gnuboard v6.0.4 and below via the `url` parameter in login path. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/gnuboard/g6/issues/582 - https://gist.github.com/Letm3through/1c7a422aa93b587fe63254e06b7f2977 - https://github.com/gnuboard/g6/issues/557
CVE ID: CVE-2024-39118 State: PUBLISHED Published: 2024-07-09T00:00:00.000Z Last Updated: 2025-08-27T21:20:37.693Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AC:L/AV:L/A:N/C:N/I:H/PR:N/S:U/UI:R) Vendors: n/a Products: n/a Problem Types: n/a Description: Mommy Heather Advanced Backups up to v3.5.3 allows attackers to write arbitrary files via restoring a crafted back up. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://gist.github.com/apple502j/193358682885fe1a6708309ce934e4ed - https://github.com/MommyHeather/AdvancedBackups/commit/1545f499f73bf434ed292c31121fdda8042ff5d6
CVE ID: CVE-2024-39119 State: PUBLISHED Published: 2024-07-02T00:00:00 Last Updated: 2024-08-02T04:19:20.626Z Vendors: n/a Products: n/a Problem Types: n/a Description: idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via admin/info_deal.php?mudi=rev&nohrefStr=close. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/2477231995/cms/blob/main/1.md
CVE ID: CVE-2024-39123 State: PUBLISHED Published: 2024-07-19T00:00:00 Last Updated: 2024-08-02T04:19:20.524Z Vendors: n/a Products: n/a Problem Types: n/a Description: In janeczku Calibre-Web 0.6.0 to 0.6.21, the edit_book_comments function is vulnerable to Cross Site Scripting (XSS) due to improper sanitization performed by the clean_string function. The vulnerability arises from the way the clean_string function handles HTML sanitization. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/pentesttoolscom/vulnerability-research/tree/master/CVE-2024-39123
CVE ID: CVE-2024-39124 State: PUBLISHED Published: 2024-07-17T00:00:00 Last Updated: 2024-10-27T21:29:25.310Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Roundup before 2.4.0, classhelpers (_generic.help.html) allow XSS. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.roundup-tracker.org/ - https://www.roundup-tracker.org/docs/security.html#cve-announcements
CVE ID: CVE-2024-39125 State: PUBLISHED Published: 2024-07-17T00:00:00.000Z Last Updated: 2025-03-19T17:44:28.859Z Vendors: n/a Products: n/a Problem Types: n/a Description: Roundup before 2.4.0 allows XSS via a SCRIPT element in an HTTP Referer header. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.roundup-tracker.org - https://www.roundup-tracker.org/docs/security.html#cve-announcements