Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
x-proxy-manager/commit/99cce7e2b0da2978411cedd7cac5fffbe15bc46 - https://github.com/NginxProxyManager/nginx-proxy-manager/compare/v2.11.2...v2.11.3 - https://github.com/NginxProxyManager/nginx-proxy-manager/issues/3662
CVE ID: CVE-2024-39936 State: PUBLISHED Published: 2024-07-04T00:00:00.000Z Last Updated: 2025-03-19T20:03:04.838Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AC:L/AV:N/A:N/C:H/I:N/PR:N/S:C/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in HTTP2 in Qt before 5.15.18, 6.x before 6.2.13, 6.3.x through 6.5.x before 6.5.7, and 6.6.x through 6.7.x before 6.7.3. Code to make security-relevant decisions about an established connection may execute too early, because the encrypted() signal has not yet been emitted and processed.. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://codereview.qt-project.org/c/qt/qtbase/+/571
tes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://codereview.qt-project.org/c/qt/qtbase/+/571601
CVE ID: CVE-2024-39937 State: PUBLISHED Published: 2024-07-04T00:00:00.000Z Last Updated: 2025-11-10T16:06:21.555Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AC:L/AV:N/A:N/C:H/I:N/PR:N/S:C/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: supOS 5.0 allows api/image/download?fileName=../ directory traversal for reading files. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.supos.com/supOSindex - https://github.com/bytehunter-rat/supOS-BUG/blob/main/supOSDirectoryTraversal.md - https://cloud.supos.com/announcement/detail?id=1985637965817671680
CVE ID: CVE-2024-39943 State: PUBLISHED Published: 2024-07-04T00:00:00 Last Updated: 2024-08-02T04:33:11.602Z Severity: CRITICAL (CVSS 9.9 CVSS:3.1/AC:L/AV:N/A:H/C:H/I:H/PR:L/S:C/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: rejetto HFS (aka HTTP File Server) 3 before 0.52.10 on Linux, UNIX, and macOS allows OS command execution by remote authenticated users (if they have Upload permissions). This occurs because a shell is used to execute df (i.e., with execSync instead of spawnSync in child_process in Node.js). Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.rejetto.com/wiki/index.php/HFS:_Working_with_uploads - https:
chment: - CVE Program Container: References: - https://www.rejetto.com/wiki/index.php/HFS:_Working_with_uploads - https://github.com/rejetto/hfs/commit/305381bd36eee074fb238b64302a252668daad1d - https://github.com/rejetto/hfs/compare/v0.52.9...v0.52.10
CVE ID: CVE-2024-39944 State: PUBLISHED Published: 2024-07-31T03:13:03.509Z Last Updated: 2025-09-30T03:33:00.394Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Dahua Products: IPC-HX8XXX and NVR4XXX Problem Types: CWE-770 Description: A vulnerability has been found in Dahua products.Attackers can send carefully crafted data packets to the interface with vulnerabilities, causing the device to crash. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.dahuasecurity.com/aboutUs/trustedCenter/details/768
CVE ID: CVE-2024-39945 State: PUBLISHED Published: 2024-07-31T03:16:31.944Z Last Updated: 2025-03-27T15:26:10.371Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H) Vendors: Dahua Products: NVR4XXX Description: A vulnerability has been found in Dahua products. After obtaining the administrator's username and password, the attacker can send a carefully crafted data packet to the interface with vulnerabilities, causing the device to crash. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.dahuasecurity.com/aboutUs/trustedCenter/details/768
CVE ID: CVE-2024-39946 State: PUBLISHED Published: 2024-07-31T03:20:01.329Z Last Updated: 2024-10-27T21:49:19.833Z Severity: MEDIUM (CVSS 6 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:L) Vendors: Dahua Products: NVR4XXX Description: A vulnerability has been found in Dahua products.After obtaining the administrator's username and password, the attacker can send a carefully crafted data packet to the interface with vulnerabilities, causing device initialization. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.dahuasecurity.com/aboutUs/trustedCenter/details/768
CVE ID: CVE-2024-39947 State: PUBLISHED Published: 2024-07-31T03:22:09.786Z Last Updated: 2024-10-27T21:48:18.607Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: Dahua Products: NVR4XXX Description: A vulnerability has been found in Dahua products.After obtaining the ordinary user's username and password, the attacker can send a carefully crafted data packet to the interface with vulnerabilities, causing the device to crash. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.dahuasecurity.com/aboutUs/trustedCenter/details/768
CVE ID: CVE-2024-39948 State: PUBLISHED Published: 2024-07-31T03:40:29.258Z Last Updated: 2025-09-30T03:36:16.235Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Dahua Products: NVR4XXX Problem Types: CWE-476 Description: A vulnerability has been found in Dahua products. Attackers can send carefully crafted data packets to the interface with vulnerabilities, causing the device to crash. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.dahuasecurity.com/aboutUs/trustedCenter/details/768
CVE ID: CVE-2024-39949 State: PUBLISHED Published: 2024-07-31T03:42:39.981Z Last Updated: 2025-09-30T03:36:51.320Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Dahua Products: NVR4XXX Problem Types: CWE-617 Description: A vulnerability has been found in Dahua products. Attackers can send carefully crafted data packets to the interface with vulnerabilities, causing the device to crash. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.dahuasecurity.com/aboutUs/trustedCenter/details/768
CVE ID: CVE-2024-39950 State: PUBLISHED Published: 2024-07-31T03:45:12.977Z Last Updated: 2025-09-30T03:39:46.118Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L) Vendors: Dahua Products: NVR4XXX and IPC-HX8XXX Problem Types: CWE-121 Description: A vulnerability has been found in Dahua products. Attackers can send carefully crafted data packets to the interface with vulnerabilities to initiate device initialization. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.dahuasecurity.com/aboutUs/trustedCenter/details/768
CVE ID: CVE-2024-39954 State: PUBLISHED Published: 2025-08-20T08:56:41.560Z Last Updated: 2025-08-20T13:20:27.851Z Vendors: Apache Software Foundation Products: Apache EventMesh Runtime Problem Types: CWE-918 Description: CWE-918 Server-Side Request Forgery (SSRF) in eventmesh-runtime module in WebhookUtil.java on windows\linux\mac os e.g. allows the attacker can abuse functionality on the server to read or update internal resources. Users are recommended to upgrade to version 1.12.0 or use the master branch , which fixes this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://lists.apache.org/thread/v6c96zygqx8xc2k3n2d59mgnm5txhkon
CVE ID: CVE-2024-39962 State: PUBLISHED Published: 2024-07-19T00:00:00 Last Updated: 2024-08-02T04:33:11.548Z Vendors: n/a Products: n/a Problem Types: n/a Description: D-Link DIR-823X AX3000 Dual-Band Gigabit Wireless Router v21_D240126 was discovered to contain a remote code execution (RCE) vulnerability in the ntp_zone_val parameter at /goform/set_ntp. This vulnerability is exploited via a crafted HTTP request. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://gist.github.com/Swind1er/40c33f1b1549028677cb4e2e5ef69109
CVE ID: CVE-2024-39963 State: PUBLISHED Published: 2024-07-19T00:00:00 Last Updated: 2024-08-02T04:33:11.517Z Vendors: n/a Products: n/a Problem Types: n/a Description: AX3000 Dual-Band Gigabit Wi-Fi 6 Router AX9 V22.03.01.46 and AX3000 Dual-Band Gigabit Wi-Fi 6 Router AX12 V1.0 V22.03.01.46 were discovered to contain an authenticated remote command execution (RCE) vulnerability via the macFilterType parameter at /goform/setMacFilterCfg. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://gist.github.com/Swind1er/c8e4369c7fdfd750c8ad01a276105c57
CVE ID: CVE-2024-39967 State: PUBLISHED Published: 2025-01-15T00:00:00.000Z Last Updated: 2025-02-03T14:52:05.443Z Vendors: n/a Products: n/a Problem Types: n/a Description: Insecure permissions in Aginode GigaSwitch v5 allows attackers to access sensitive information via using the SCP command. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://blog.hackvens.fr/advisories/CVE-2024-39967-CVE-2024-39219-GigaSwitch.html
CVE ID: CVE-2024-3000 State: PUBLISHED Published: 2024-03-27T21:31:04.286Z Last Updated: 2024-08-23T18:31:02.969Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: code-projects Products: Online Book System Problem Types: CWE-89 Description: A vulnerability classified as critical was found in code-projects Online Book System 1.0. This vulnerability affects unknown code of the file /index.php. The manipulation of the argument username/password/login_username/login_password leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-258202 is the identifier assigned to this vulnerability. Additional Analyst Notes: -
to the public and may be used. VDB-258202 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.258202 - https://vuldb.com/?ctiid.258202 - https://vuldb.com/?submit.305052 - https://github.com/BurakSevben/CVEs/blob/main/Online%20Book%20System/Online%20Book%20System%20-%20Authentication%20Bypass.md
CVE ID: CVE-2024-3001 State: PUBLISHED Published: 2024-03-27T21:31:05.664Z Last Updated: 2024-08-08T20:27:21.124Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: code-projects Products: Online Book System Problem Types: CWE-89 Description: A vulnerability, which was classified as critical, has been found in code-projects Online Book System 1.0. This issue affects some unknown processing of the file /Product.php. The manipulation of the argument value leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-258203. Additional Analyst Notes: - CVE Program Conta
ay be used. The associated identifier of this vulnerability is VDB-258203. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.258203 - https://vuldb.com/?ctiid.258203 - https://vuldb.com/?submit.305055 - https://github.com/BurakSevben/CVEs/blob/main/Online%20Book%20System/Online%20Book%20System-%20SQL%20Injection%20-%203.md
CVE ID: CVE-2024-3002 State: PUBLISHED Published: 2024-03-27T22:00:05.365Z Last Updated: 2024-08-22T19:31:39.647Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: code-projects Products: Online Book System Problem Types: CWE-89 Description: A vulnerability, which was classified as critical, was found in code-projects Online Book System 1.0. Affected is an unknown function of the file /description.php. The manipulation of the argument ID leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-258204. Additional Analyst Notes: - CVE Program Container: - CISA ADP V
sed. The identifier of this vulnerability is VDB-258204. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.258204 - https://vuldb.com/?ctiid.258204 - https://vuldb.com/?submit.305056 - https://github.com/BurakSevben/CVEs/blob/main/Online%20Book%20System/Online%20Book%20System-%20SQL%20Injection%20-%204.md
CVE ID: CVE-2024-3003 State: PUBLISHED Published: 2024-03-27T22:00:06.795Z Last Updated: 2024-08-22T19:13:07.203Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: code-projects Products: Online Book System Problem Types: CWE-89 Description: A vulnerability has been found in code-projects Online Book System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /cart.php. The manipulation of the argument quantity/remove leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-258205 was assigned to this vulnerability. Additional Analyst Notes: - CVE
e public and may be used. The identifier VDB-258205 was assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.258205 - https://vuldb.com/?ctiid.258205 - https://vuldb.com/?submit.305057 - https://github.com/BurakSevben/CVEs/blob/main/Online%20Book%20System/Online%20Book%20System-%20SQL%20Injection%20-%205.md
CVE ID: CVE-2024-3004 State: PUBLISHED Published: 2024-03-27T22:31:03.985Z Last Updated: 2024-08-12T13:35:15.948Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: code-projects Products: Online Book System Problem Types: CWE-79 Description: A vulnerability was found in code-projects Online Book System 1.0 and classified as problematic. Affected by this issue is some unknown functionality of the file /Product.php. The manipulation of the argument value leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-258206 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CVE Program Con
nd may be used. VDB-258206 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.258206 - https://vuldb.com/?ctiid.258206 - https://vuldb.com/?submit.305059 - https://github.com/BurakSevben/CVEs/blob/main/Online%20Book%20System/Online%20Book%20System%20-%20Cross-Site-Scripting.md
CVE ID: CVE-2024-3005 State: PUBLISHED Published: 2024-05-02T11:02:24.231Z Last Updated: 2024-08-01T19:32:42.528Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: choijun Products: LA-Studio Element Kit for Elementor Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The LA-Studio Element Kit for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's LaStudioKit Post Author widget in all versions up to, and including, 1.3.7.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated a
ufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/544db0d5-1760-4229-8429-d2391e328304?source=cve - https://plugins.trac.wordpress.org/changeset/3079793/lastudio-element-kit
CVE ID: CVE-2024-3006 State: PUBLISHED Published: 2024-03-27T22:31:05.391Z Last Updated: 2024-08-21T13:43:54.545Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C) Vendors: Tenda Products: FH1205 Problem Types: CWE-121 Description: A vulnerability classified as critical was found in Tenda FH1205 2.0.0.7(775). This vulnerability affects the function fromSetRouteStatic of the file /goform/fromRouteStatic. The manipulation of the argument entrys leads to stack-based buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-258292. NOTE: The vendor was contacted early about this disclosure but
sed. The identifier of this vulnerability is VDB-258292. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.258292 - https://vuldb.com/?ctiid.258292 - https://vuldb.com/?submit.301485 - https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/FH/FH1205/fromRouteStatic.md
CVE ID: CVE-2024-3007 State: PUBLISHED Published: 2024-03-27T23:00:05.599Z Last Updated: 2024-08-12T13:34:36.150Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C) Vendors: Tenda Products: FH1205 Problem Types: CWE-121 Description: A vulnerability, which was classified as critical, has been found in Tenda FH1205 2.0.0.7(775). This issue affects the function fromNatStaticSetting of the file /goform/NatStaticSetting. The manipulation of the argument page leads to stack-based buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-258293 was assigned to this vulnerability. NOTE: The vendor was contacted early about
d may be used. The identifier VDB-258293 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.258293 - https://vuldb.com/?ctiid.258293 - https://vuldb.com/?submit.301486 - https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/FH/FH1205/fromNatStaticSetting.md
CVE ID: CVE-2024-3008 State: PUBLISHED Published: 2024-03-27T23:00:06.978Z Last Updated: 2025-04-08T20:46:28.261Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C) Vendors: Tenda Products: FH1205 Problem Types: CWE-121 Description: A vulnerability, which was classified as critical, was found in Tenda FH1205 2.0.0.7(775). Affected is the function formexeCommand of the file /goform/execCommand. The manipulation of the argument cmdinput leads to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-258294 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclos
ed. VDB-258294 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.258294 - https://vuldb.com/?ctiid.258294 - https://vuldb.com/?submit.301487 - https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/FH/FH1205/formexeCommand.md
CVE ID: CVE-2024-3009 State: PUBLISHED Published: 2024-03-27T23:31:03.733Z Last Updated: 2024-08-27T20:18:48.485Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: Tenda Products: FH1205 Problem Types: CWE-77 Description: A vulnerability has been found in Tenda FH1205 2.0.0.7(775) and classified as critical. Affected by this vulnerability is the function formWriteFacMac of the file /goform/WriteFacMac. The manipulation of the argument mac leads to command injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-258295. NOTE: The vendor was contacted early about this disclosu
The associated identifier of this vulnerability is VDB-258295. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.258295 - https://vuldb.com/?ctiid.258295 - https://vuldb.com/?submit.301488 - https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/FH/FH1205/formWriteFacMac.md
CVE ID: CVE-2024-3010 State: PUBLISHED Published: 2024-03-27T23:31:05.075Z Last Updated: 2024-08-23T18:30:19.870Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C) Vendors: Tenda Products: FH1205 Problem Types: CWE-121 Description: A vulnerability was found in Tenda FH1205 2.0.0.7(775) and classified as critical. Affected by this issue is the function formSetCfm of the file /goform/setcfm. The manipulation of the argument funcpara1 leads to stack-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-258296. NOTE: The vendor was contacted early about this disclosure but did not resp
ntifier of this vulnerability is VDB-258296. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.258296 - https://vuldb.com/?ctiid.258296 - https://vuldb.com/?submit.301489 - https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/FH/FH1205/formSetCfm.md
CVE ID: CVE-2024-3011 State: PUBLISHED Published: 2024-03-28T00:00:05.446Z Last Updated: 2024-08-01T19:32:42.583Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C) Vendors: Tenda Products: FH1205 Problem Types: CWE-121 Description: A vulnerability was found in Tenda FH1205 2.0.0.7(775). It has been classified as critical. This affects the function formQuickIndex of the file /goform/QuickIndex. The manipulation of the argument PPPOEPassword leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-258297 was assigned to this vulnerability. NOTE: The vendor was contacted early about thi
ay be used. The identifier VDB-258297 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.258297 - https://vuldb.com/?ctiid.258297 - https://vuldb.com/?submit.301490 - https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/FH/FH1205/formQuickIndex.md
CVE ID: CVE-2024-3012 State: PUBLISHED Published: 2024-03-28T00:00:06.995Z Last Updated: 2024-08-12T18:02:42.168Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C) Vendors: Tenda Products: FH1205 Problem Types: CWE-121 Description: A vulnerability was found in Tenda FH1205 2.0.0.7(775). It has been declared as critical. This vulnerability affects the function GetParentControlInfo of the file /goform/GetParentControlInfo. The manipulation of the argument mac leads to stack-based buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-258298 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early ab
ic and may be used. VDB-258298 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.258298 - https://vuldb.com/?ctiid.258298 - https://vuldb.com/?submit.301491 - https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/FH/FH1205/GetParentControlInfo.md
CVE ID: CVE-2024-3013 State: PUBLISHED Published: 2024-03-28T00:31:04.101Z Last Updated: 2025-10-15T13:18:50.593Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:OF/RC:C) Vendors: Teledyne FLIR Products: AX8 Problem Types: CWE-285, CWE-266 Description: A flaw has been found in Teledyne FLIR AX8 up to 1.46.16. The impacted element is an unknown function of the file /tools/test_login.php?action=register of the component User Registration. Executing manipulation can lead to improper authorization. The attack may be performed from remote. The exploit has been published and may be used. Upgrading to version 1.49.16 is sufficient to resolve this issue. Upgrading the affected component