Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-42639 State: PUBLISHED Published: 2024-08-16T00:00:00.000Z Last Updated: 2025-03-20T13:33:38.169Z Vendors: n/a Products: n/a Problem Types: n/a Description: H3C GR1100-P v100R009 was discovered to use a hardcoded password in /etc/shadow, which allows attackers to log in as root. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://palm-vertebra-fe9.notion.site/H3C-GR1100-PV100R009-was-discovered-to-contain-a-hardcoded-824141daa44f4c52a914860c6e4a7684 - https://www.h3c.com/cn/d_202308/1912371_30005_0.htm
CVE ID: CVE-2024-42640 State: PUBLISHED Published: 2024-10-11T00:00:00 Last Updated: 2024-10-15T16:15:15.198Z Vendors: n/a Products: n/a Problem Types: n/a Description: angular-base64-upload prior to v0.1.21 is vulnerable to unauthenticated remote code execution via demo/server.php. Exploiting this vulnerability allows an attacker to upload arbitrary content to the server, which can subsequently be accessed through demo/uploads. This leads to the execution of previously uploaded content and enables the attacker to achieve code execution on the server. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. Additional Analyst Notes: - CISA ADP Vulnrichme
ty only affects products that are no longer supported by the maintainer. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/adonespitogo/angular-base64-upload - https://www.zyenra.com/blog/unauthenticated-rce-in-angular-base64-upload.html
CVE ID: CVE-2024-42642 State: PUBLISHED Published: 2024-09-04T00:00:00 Last Updated: 2024-10-24T17:02:17.449Z Vendors: n/a Products: n/a Problem Types: n/a Description: Micron Crucial MX500 Series Solid State Drives M3CR046 is vulnerable to Buffer Overflow, which can be triggered by sending specially crafted ATA packets from the host to the drive controller. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://microncrucial.com - https://github.com/VL4DR/CVE-2024-42642/tree/main
CVE ID: CVE-2024-42643 State: PUBLISHED Published: 2024-10-22T00:00:00 Last Updated: 2024-10-23T17:56:11.101Z Vendors: n/a Products: n/a Problem Types: n/a Description: Integer Overflow in fast_ping.c in SmartDNS Release46 allows remote attackers to cause a Denial of Service via misaligned memory access. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/pymumu/smartdns/issues/1779
CVE ID: CVE-2024-42644 State: PUBLISHED Published: 2025-07-29T00:00:00.000Z Last Updated: 2025-07-30T15:10:45.401Z Vendors: n/a Products: n/a Problem Types: n/a Description: FlashMQ v1.14.0 was discovered to contain an assertion failure in the function PublishCopyFactory::getNewPublish, which occurs when the QoS value of the publish object is greater than 0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/halfgaar/FlashMQ - https://www.flashmq.org/2024/06/17/flashmq-1-15-1-released/ - https://github.com/songxpu/bug_report/blob/master/MQTT/FlashMQ/cve-2024-42644.md
CVE ID: CVE-2024-42645 State: PUBLISHED Published: 2025-07-29T00:00:00.000Z Last Updated: 2025-07-30T15:09:24.517Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in FlashMQ v1.14.0 allows attackers to cause an assertion failure via sending a crafted retain message, leading to a Denial of Service (DoS). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/halfgaar/FlashMQ - https://www.flashmq.org/2024/06/17/flashmq-1-15-1-released/ - https://github.com/songxpu/bug_report/blob/master/MQTT/FlashMQ/CVE-2024-42645.md
CVE ID: CVE-2024-42646 State: PUBLISHED Published: 2025-07-14T00:00:00.000Z Last Updated: 2025-07-16T18:36:32.773Z Vendors: n/a Products: n/a Problem Types: n/a Description: A segmentation fault in NanoMQ v0.21.10 allows attackers to cause a Denial of Service (DoS) via crafted messages. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/nanomq/nanomq - https://github.com/songxpu/bug_report/blob/master/MQTT/NanoMQ/CVE-2024-42646.md
CVE ID: CVE-2024-42648 State: PUBLISHED Published: 2025-07-14T00:00:00.000Z Last Updated: 2025-07-16T18:37:10.747Z Vendors: n/a Products: n/a Problem Types: n/a Description: NanoMQ v0.22.10 was discovered to contain a heap overflow which allows attackers to cause a Denial of Service (DoS) via a crafted CONNECT message. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/nanomq/nanomq - https://github.com/songxpu/bug_report/blob/master/MQTT/NanoMQ/CVE-2024-42648.md
CVE ID: CVE-2024-42649 State: PUBLISHED Published: 2025-07-14T00:00:00.000Z Last Updated: 2025-07-16T18:12:17.274Z Vendors: n/a Products: n/a Problem Types: n/a Description: NanoMQ v0.22.10 was discovered to contain a memory leak which allows attackers to cause a Denial of Service (DoS) via a crafted PUBLISH message. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/nanomq/nanomq - https://github.com/songxpu/bug_report/blob/master/MQTT/NanoMQ/CVE-2024-42649.md
CVE ID: CVE-2024-42650 State: PUBLISHED Published: 2025-07-15T00:00:00.000Z Last Updated: 2025-07-15T20:41:30.722Z Vendors: n/a Products: n/a Problem Types: n/a Description: NanoMQ 0.17.5 was discovered to contain a segmentation fault via the component /nanomq/pub_handler.c. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted PUBLISH message. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/nanomq/nanomq - https://github.com/emqx/nanomq/issues/1168 - https://github.com/nanomq/nanomq/pull/1170
CVE ID: CVE-2024-42651 State: PUBLISHED Published: 2025-07-29T00:00:00.000Z Last Updated: 2025-07-29T18:37:09.983Z Vendors: n/a Products: n/a Problem Types: n/a Description: NanoMQ v0.17.9 was discovered to contain a heap use-after-free vulnerability via the component sub_Ctx_handle. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted SUBSCRIBE message. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/nanomq/nanomq - https://github.com/nanomq/nanomq/issues/1217 - https://github.com/songxpu/bug_report/blob/master/MQTT/NanoMQ/CVE-2024-42651.md
CVE ID: CVE-2024-42655 State: PUBLISHED Published: 2025-07-29T00:00:00.000Z Last Updated: 2025-07-29T18:38:58.222Z Vendors: n/a Products: n/a Problem Types: n/a Description: An access control issue in NanoMQ v0.21.10 allows attackers to bypass security restrictions and access sensitive system topic messages using MQTT wildcard characters. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/nanomq/nanomq - https://github.com/nanomq/nanomq/issues/1782#issuecomment-2171025812 - https://github.com/songxpu/bug_report/blob/master/MQTT/NanoMQ/CVE-2024-42655.md
CVE ID: CVE-2024-42657 State: PUBLISHED Published: 2024-08-19T00:00:00 Last Updated: 2024-08-20T14:38:56.625Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in wishnet Nepstech Wifi Router NTPL-XPON1GFEVN v1.0 allows a remote attacker to obtain sensitive information via the lack of encryption during login process Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.linkedin.com/in/subhodeep-baroi-397629252/ - https://x.com/sudo_subho - https://github.com/sudo-subho/CVE-2024-42657
CVE ID: CVE-2024-42658 State: PUBLISHED Published: 2024-08-19T00:00:00 Last Updated: 2024-08-19T17:41:26.442Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in wishnet Nepstech Wifi Router NTPL-XPON1GFEVN v1.0 allows a remote attacker to obtain sensitive information via the cookie's parameter Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.linkedin.com/in/subhodeep-baroi-397629252/ - https://x.com/sudo_subho - https://github.com/sudo-subho/CVE-2024-42658
CVE ID: CVE-2024-42662 State: PUBLISHED Published: 2024-08-20T00:00:00.000Z Last Updated: 2025-03-14T14:08:28.251Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in apollocongif apollo v.2.2.0 allows a remote attacker to obtain sensitive information via a crafted request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/len0m0/Apolloinfo/blob/main/README.md - https://gist.github.com/len0m0/f0886d579de6c075506ab543e054dc7d
CVE ID: CVE-2024-42671 State: PUBLISHED Published: 2025-01-31T00:00:00.000Z Last Updated: 2025-03-19T20:44:15.425Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Host Header Poisoning Open Redirect issue in slabiak Appointment Scheduler v.1.0.5 allows a remote attacker to redirect users to a malicious website, leading to potential credential theft, malware distribution, or other malicious activities. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/abbisQQ/Appointment-Scheduler-Host-Header-Poisoning-Open-Redirect/blob/main/README.md - https://github.com/slabiak/AppointmentScheduler/issues/53
CVE ID: CVE-2024-42675 State: REJECTED Published: N/A Last Updated: 2024-08-19T08:20:47.288849 Description: No description available.
CVE ID: CVE-2024-42676 State: PUBLISHED Published: 2024-08-15T00:00:00 Last Updated: 2024-11-18T18:26:52.953546 Vendors: n/a Products: n/a Problem Types: n/a Description: File Upload vulnerability in Huizhi enterprise resource management system v.1.0 and before allows a remote attacker to execute arbitrary code via the /nssys/common/Upload. Aspx? Action=DNPageAjaxPostBack component Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/WarmBrew/web_vul/blob/main/HZ-cve/HZupload.md - https://github.com/WarmBrew/web_vul/blob/main/CVES/CVE-2024-42676.md
CVE ID: CVE-2024-42677 State: PUBLISHED Published: 2024-08-15T00:00:00 Last Updated: 2024-11-18T16:32:22.030292 Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in Huizhi enterprise resource management system v.1.0 and before allows a local attacker to obtain sensitive information via the /nssys/common/filehandle. Aspx component Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/WarmBrew/web_vul/blob/main/HZ-cve/HZlfi.md - https://github.com/WarmBrew/web_vul/blob/main/CVES/CVE-2024-42677.md
CVE ID: CVE-2024-42678 State: PUBLISHED Published: 2024-08-15T00:00:00 Last Updated: 2024-11-18T17:53:43.838983 Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting vulnerability in Super easy enterprise management system v.1.0.0 and before allows a local attacker to execute arbitrary code via a crafted script to the /WebSet/DlgGridSet.html component. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/WarmBrew/web_vul/blob/main/CYGLXT/CYxss.md - https://github.com/WarmBrew/web_vul/blob/main/CVES/CVE-2024-42678.md
CVE ID: CVE-2024-42679 State: PUBLISHED Published: 2024-08-15T00:00:00 Last Updated: 2024-09-06T16:30:30.356Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL Injection vulnerability in Super easy enterprise management system v.1.0.0 and before allows a local attacker to execute arbitrary code via a crafted script to the/ajax/Login.ashx component. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/WarmBrew/web_vul/blob/main/CYGLXT/CYsqli.md
CVE ID: CVE-2024-42680 State: PUBLISHED Published: 2024-08-15T00:00:00.000Z Last Updated: 2025-03-25T16:30:44.622Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in Super easy enterprise management system v.1.0.0 and before allows a local attacker to obtain the server absolute path by entering a single quotation mark. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/WarmBrew/web_vul/blob/main/CYGLXT/CYinfo.md - https://github.com/WarmBrew/web_vul/blob/main/CVES/CVE-2024-42680.md
CVE ID: CVE-2024-42681 State: PUBLISHED Published: 2024-08-15T00:00:00 Last Updated: 2024-08-19T18:40:14.939Z Vendors: n/a Products: n/a Problem Types: n/a Description: Insecure Permissions vulnerability in xxl-job v.2.4.1 allows a remote attacker to execute arbitrary code via the Sub-Task ID component. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/xuxueli/xxl-job/issues/3516
CVE ID: CVE-2024-42697 State: PUBLISHED Published: 2024-09-20T00:00:00 Last Updated: 2024-09-20T17:53:35.608Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting vulnerability in Leotheme Leo Product Search Module v.2.1.6 and earlier allows a remote attacker to execute arbitrary code via the q parameter of the product search function. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/JustDinooo/CVEs/blob/main/CVE-2024-42697/poc.txt
CVE ID: CVE-2024-42698 State: PUBLISHED Published: 2024-08-28T00:00:00.000Z Last Updated: 2025-03-18T18:35:49.801Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AC:L/AV:N/A:N/C:N/I:L/PR:L/S:U/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: Roughly Enough Items (REI) v.16.0.729 and before contains an Improper Validation of Specified Index, Position, or Offset in Input vulnerability. The specific issue is a failure to validate slot index and decrement stack count in the Roughly Enough Items (REI) mod for Minecraft, which allows in-game item duplication. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gist.github.com/apple502j/7b1af0082449c9bfbf910e9a25ef3595 - h
yst Notes: - CISA ADP Vulnrichment: References: - https://gist.github.com/apple502j/7b1af0082449c9bfbf910e9a25ef3595 - https://github.com/shedaniel/RoughlyEnoughItems/commit/e80ca84f1affb91d2388ddb298bfc6b141828cad
CVE ID: CVE-2024-42699 State: PUBLISHED Published: 2025-04-21T00:00:00.000Z Last Updated: 2025-04-21T16:06:19.068Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting vulnerability in Create/Modify article function in Alkacon OpenCMS 17.0 allows remote attacker to inject javascript payload via image title sub-field in the image field Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Sidd545-cr/CVE/blob/main/CVE-2024-42699%20-%20Stored%20XSS%20in%20image%20title.pdf
CVE ID: CVE-2024-42733 State: PUBLISHED Published: 2025-03-07T00:00:00.000Z Last Updated: 2025-03-10T16:42:10.451Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in Docmosis Tornado v.2.9.7 and before allows a remote attacker to execute arbitrary code via a crafted script to the UNC path input Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Docmosis/tornado-docker/issues/14 - https://github.com/Marsman1996/pocs/blob/master/redox/CVE-2024-57492/README.md
CVE ID: CVE-2024-42736 State: PUBLISHED Published: 2024-08-13T00:00:00 Last Updated: 2024-08-13T15:58:35.373Z Vendors: n/a Products: n/a Problem Types: n/a Description: In TOTOLINK X5000r v9.1.0cu.2350_b20230313, the file /cgi-bin/cstecgi.cgi contains an OS command injection vulnerability in addBlacklist. Authenticated Attackers can send malicious packet to execute arbitrary commands. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/HouseFuzz/reports/blob/main/totolink/x5000r/addBlacklist/addBlacklist.md
CVE ID: CVE-2024-42737 State: PUBLISHED Published: 2024-08-13T00:00:00 Last Updated: 2024-08-13T17:50:28.132Z Vendors: n/a Products: n/a Problem Types: n/a Description: In TOTOLINK X5000r v9.1.0cu.2350_b20230313, the file /cgi-bin/cstecgi.cgi contains an OS command injection vulnerability in delBlacklist. Authenticated Attackers can send malicious packet to execute arbitrary commands. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/HouseFuzz/reports/blob/main/totolink/x5000r/delBlacklist/delBlacklist.md
CVE ID: CVE-2024-42738 State: PUBLISHED Published: 2024-08-13T00:00:00 Last Updated: 2024-08-14T15:00:53.166Z Vendors: n/a Products: n/a Problem Types: n/a Description: In TOTOLINK X5000r v9.1.0cu.2350_b20230313, the file /cgi-bin/cstecgi.cgi contains an OS command injection vulnerability in setDmzCfg. Authenticated Attackers can send malicious packet to execute arbitrary commands. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/HouseFuzz/reports/blob/main/totolink/x5000r/setDmzCfg/setDmzCfg.md
CVE ID: CVE-2024-42739 State: PUBLISHED Published: 2024-08-13T00:00:00 Last Updated: 2024-08-14T14:45:59.649Z Vendors: n/a Products: n/a Problem Types: n/a Description: In TOTOLINK X5000r v9.1.0cu.2350_b20230313, the file /cgi-bin/cstecgi.cgi contains an OS command injection vulnerability in setAccessDeviceCfg. Authenticated Attackers can send malicious packet to execute arbitrary commands. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/HouseFuzz/reports/blob/main/totolink/x5000r/setAccessDeviceCfg/setAccessDeviceCfg.md
CVE ID: CVE-2024-42740 State: PUBLISHED Published: 2024-08-13T00:00:00 Last Updated: 2024-08-13T14:53:52.908Z Vendors: n/a Products: n/a Problem Types: n/a Description: In TOTOLINK X5000r v9.1.0cu.2350_b20230313, the file /cgi-bin/cstecgi.cgi contains an OS command injection vulnerability in setLedCfg. Authenticated Attackers can send malicious packet to execute arbitrary commands. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/HouseFuzz/reports/blob/main/totolink/x5000r/setLedCfg/setLedCfg.md
CVE ID: CVE-2024-42741 State: PUBLISHED Published: 2024-08-12T00:00:00 Last Updated: 2024-08-13T16:12:50.071Z Vendors: n/a Products: n/a Problem Types: n/a Description: In TOTOLINK X5000r v9.1.0cu.2350_b20230313, the file /cgi-bin/cstecgi.cgi contains an OS command injection vulnerability in setL2tpServerCfg. Authenticated Attackers can send malicious packet to execute arbitrary commands. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/HouseFuzz/reports/blob/main/totolink/x5000r/setL2tpServerCfg/setL2tpServerCfg.md
CVE ID: CVE-2024-42742 State: PUBLISHED Published: 2024-08-12T00:00:00 Last Updated: 2024-08-13T19:57:21.139Z Vendors: n/a Products: n/a Problem Types: n/a Description: In TOTOLINK X5000r v9.1.0cu.2350_b20230313, the file /cgi-bin/cstecgi.cgi contains an OS command injection vulnerability in setUrlFilterRules. Authenticated Attackers can send malicious packet to execute arbitrary commands. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/HouseFuzz/reports/blob/main/totolink/x5000r/setUrlFilterRules/setUrlFilterRules.md
CVE ID: CVE-2024-42743 State: PUBLISHED Published: 2024-08-12T00:00:00 Last Updated: 2024-08-13T18:35:18.554Z Vendors: n/a Products: n/a Problem Types: n/a Description: In TOTOLINK X5000r v9.1.0cu.2350_b20230313, the file /cgi-bin/cstecgi.cgi contains an OS command injection vulnerability in setSyslogCfg . Authenticated Attackers can send malicious packet to execute arbitrary commands. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/HouseFuzz/reports/blob/main/totolink/x5000r/setSyslogCfg/setSyslogCfg.md
CVE ID: CVE-2024-42744 State: PUBLISHED Published: 2024-08-12T00:00:00 Last Updated: 2024-08-15T14:49:27.259Z Vendors: n/a Products: n/a Problem Types: n/a Description: In TOTOLINK X5000r v9.1.0cu.2350_b20230313, the file /cgi-bin/cstecgi.cgi contains an OS command injection vulnerability in setModifyVpnUser. Authenticated Attackers can send malicious packet to execute arbitrary commands. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/HouseFuzz/reports/blob/main/totolink/x5000r/setModifyVpnUser/setModifyVpnUser.md
CVE ID: CVE-2024-42745 State: PUBLISHED Published: 2024-08-12T00:00:00 Last Updated: 2024-08-13T14:12:44.180Z Vendors: n/a Products: n/a Problem Types: n/a Description: In TOTOLINK X5000r v9.1.0cu.2350_b20230313, the file /cgi-bin/cstecgi.cgi contains an OS command injection vulnerability in setUPnPCfg. Authenticated Attackers can send malicious packet to execute arbitrary commands. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/HouseFuzz/reports/blob/main/totolink/x5000r/setUPnPCfg/setUPnPCfg.md
CVE ID: CVE-2024-42747 State: PUBLISHED Published: 2024-08-12T00:00:00 Last Updated: 2024-08-13T16:14:00.576Z Vendors: n/a Products: n/a Problem Types: n/a Description: In TOTOLINK X5000r v9.1.0cu.2350_b20230313, the file /cgi-bin/cstecgi.cgi contains an OS command injection vulnerability in setWanIeCfg. Authenticated Attackers can send malicious packet to execute arbitrary commands. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/HouseFuzz/reports/blob/main/totolink/x5000r/setWanIeCfg/setWanIeCfg.md
CVE ID: CVE-2024-42748 State: PUBLISHED Published: 2024-08-12T00:00:00 Last Updated: 2024-08-13T14:30:52.666Z Vendors: n/a Products: n/a Problem Types: n/a Description: In TOTOLINK X5000r v9.1.0cu.2350_b20230313, the file /cgi-bin/cstecgi.cgi contains an OS command injection vulnerability in setWiFiWpsCfg. Authenticated Attackers can send malicious packet to execute arbitrary commands. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/HouseFuzz/reports/blob/main/totolink/x5000r/setWiFiWpsCfg/setWiFiWpsCfg.md
CVE ID: CVE-2024-42749 State: PUBLISHED Published: 2025-11-14T00:00:00.000Z Last Updated: 2025-11-14T16:58:28.195Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting vulnerability in Alto CMS v.1.1.13 allows a local attacker to execute arbitrary code via a crafted script. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/altocms/altocms - https://github.com/leexsoyoung/CVEs/blob/main/CVE-2024-42749.md
CVE ID: CVE-2024-42756 State: PUBLISHED Published: 2024-08-23T00:00:00 Last Updated: 2024-08-27T14:47:10.891Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in Netgear DGN1000WW v.1.1.00.45 allows a remote attacker to execute arbitrary code via the Diagnostics page Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.netgear.com/about/security/ - https://github.com/Nop3z/CVE/blob/main/Netgear/Netgear%20DGN1000%20RCE/Netgear%20DGN1000%20RCE.md
CVE ID: CVE-2024-42757 State: PUBLISHED Published: 2024-08-15T00:00:00 Last Updated: 2024-08-20T14:56:25.777Z Vendors: n/a Products: n/a Problem Types: n/a Description: Command injection vulnerability in Asus RT-N15U 3.0.0.4.376_3754 allows a remote attacker to execute arbitrary code via the netstat function page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Nop3z/CVE/blob/main/Asus/FW_RT_N15U_30043763754/FW_RT_N15U_30043763754%20RCE.md
CVE ID: CVE-2024-42758 State: PUBLISHED Published: 2024-08-16T00:00:00 Last Updated: 2024-08-19T17:34:38.788Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Cross-site Scripting (XSS) vulnerability exists in version v2024-01-05 of the indexmenu plugin when is used and enabled in Dokuwiki (Open Source Wiki Engine). A malicious attacker can input XSS payloads for example when creating or editing existing page, to trigger the XSS on Dokuwiki, which is then stored in .txt file (due to nature of how Dokuwiki is designed), which presents stored XSS. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/dokuwiki/dokuwiki - https://github.com/samuelet/inde
st Notes: - CISA ADP Vulnrichment: References: - https://github.com/dokuwiki/dokuwiki - https://github.com/samuelet/indexmenu - https://github.com/samuelet/indexmenu/issues/317 - https://github.com/1s1ldur/CVE-2024-42758/blob/main/README.md
CVE ID: CVE-2024-42759 State: PUBLISHED Published: 2024-09-09T00:00:00 Last Updated: 2024-09-10T15:57:11.460Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in Ellevo v.6.2.0.38160 allows a remote attacker to escalate privileges via the /api/usuario/cadastrodesuplente endpoint. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://ellevo.com/ - https://csflabs.github.io/cve/2024/09/06/cve-2024-42759-approval-of-your-own-ticket-with-BFLA.html