Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-7798 State: PUBLISHED Published: 2024-08-14T23:00:08.149Z Last Updated: 2024-09-03T18:13:36.434Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: SourceCodester Products: Simple Online Bidding System Problem Types: CWE-89 Description: A vulnerability was found in SourceCodester Simple Online Bidding System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /simple-online-bidding-system/bidding/admin/ajax.php?action=login2. The manipulation of the argument username leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst N
The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.274651 - https://vuldb.com/?ctiid.274651 - https://vuldb.com/?submit.390297 - https://github.com/Wsstiger/cve/blob/main/Sourcecoster_sql2.md
CVE ID: CVE-2024-7799 State: PUBLISHED Published: 2024-08-14T23:31:03.816Z Last Updated: 2024-08-15T13:57:04.925Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: SourceCodester Products: Simple Online Bidding System Problem Types: CWE-285 Description: A vulnerability was found in SourceCodester Simple Online Bidding System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /simple-online-bidding-system/bidding/admin/users.php. The manipulation leads to improper authorization. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP
be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.274652 - https://vuldb.com/?ctiid.274652 - https://vuldb.com/?submit.390302 - https://github.com/Wsstiger/cve/blob/main/Sourcecoster_unauthorized.md
CVE ID: CVE-2024-7800 State: PUBLISHED Published: 2024-08-14T23:31:05.647Z Last Updated: 2024-08-15T14:31:47.481Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: SourceCodester Products: Simple Online Bidding System Problem Types: CWE-89 Description: A vulnerability classified as critical has been found in SourceCodester Simple Online Bidding System 1.0. This affects an unknown part of the file /simple-online-bidding-system/bidding/admin/ajax.php?action=delete_product. The manipulation of the argument id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnri
tack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.274653 - https://vuldb.com/?ctiid.274653 - https://vuldb.com/?submit.390773 - https://github.com/Wsstiger/cve/blob/main/Sourcecoster_sql3.md
CVE ID: CVE-2024-7801 State: PUBLISHED Published: 2024-10-04T19:38:08.280Z Last Updated: 2024-10-04T22:16:19.492Z Vendors: Microchip Products: TimeProvider 4100 Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Microchip TimeProvider 4100 (Data plot modules) allows SQL Injection.This issue affects TimeProvider 4100: from 1.0 before 2.4.7. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.microchip.com/en-us/solutions/technologies/embedded-security/how-to-report-potential-product-security-vulnerabilities/timeprovider-4100-grandmaster-unathenticated-sql-injection - https://www.grup
potential-product-security-vulnerabilities/timeprovider-4100-grandmaster-unathenticated-sql-injection - https://www.gruppotim.it/it/footer/red-team.html
CVE ID: CVE-2024-7803 State: PUBLISHED Published: 2025-05-23T12:31:21.008Z Last Updated: 2025-05-27T14:40:07.374Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: GitLab Products: GitLab Problem Types: CWE-770 Description: An issue has been discovered in GitLab CE/EE affecting all versions from 11.6 before 17.10.7, 17.11 before 17.11.3, and 18.0 before 18.0.1. A Discord webhook integration may cause DoS. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/479168 - https://hackerone.com/reports/2648631
CVE ID: CVE-2024-7804 State: REJECTED Published: 2025-03-20T10:11:37.165Z Last Updated: 2025-04-01T16:46:40.738Z Description: No description available.
CVE ID: CVE-2024-7805 State: REJECTED Published: N/A Last Updated: 2024-09-11T13:34:25.148Z Description: No description available.
CVE ID: CVE-2024-7806 State: PUBLISHED Published: 2025-03-20T10:11:05.970Z Last Updated: 2025-03-20T15:21:35.392Z Severity: HIGH (CVSS 8 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: open-webui Products: open-webui/open-webui Problem Types: CWE-352 Description: A vulnerability in open-webui/open-webui versions <= 0.3.8 allows remote code execution by non-admin users via Cross-Site Request Forgery (CSRF). The application uses cookies with the SameSite attribute set to lax for authentication and lacks CSRF tokens. This allows an attacker to craft a malicious HTML that, when accessed by a victim, can modify the Python code of an existing pipeline and execute arbitrary code with the vic
t, when accessed by a victim, can modify the Python code of an existing pipeline and execute arbitrary code with the victim's privileges. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/9350a68d-5f33-4b3d-988b-81e778160ab8
CVE ID: CVE-2024-7807 State: PUBLISHED Published: 2024-10-29T12:48:16.107Z Last Updated: 2025-01-09T17:13:30.519Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: gaizhenbiao Products: gaizhenbiao/chuanhuchatgpt Problem Types: CWE-770 Description: A vulnerability in gaizhenbiao/chuanhuchatgpt version 20240628 allows for a Denial of Service (DOS) attack. When uploading a file, if an attacker appends a large number of characters to the end of a multipart boundary, the system will continuously process each character, rendering ChuanhuChatGPT inaccessible. This uncontrolled resource consumption can lead to prolonged unavailability of the service, disrupting operati
cessible. This uncontrolled resource consumption can lead to prolonged unavailability of the service, disrupting operations and causing potential data inaccessibility and loss of productivity. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/db67276d-36ee-4487-9165-b621c67ef8a3 - https://github.com/gaizhenbiao/chuanhuchatgpt/commit/919222d285d73b9dcd71fb34de379eef8c90d175
CVE ID: CVE-2024-7808 State: PUBLISHED Published: 2024-08-15T00:31:04.344Z Last Updated: 2024-08-15T13:49:24.274Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: code-projects Products: Job Portal Problem Types: CWE-89 Description: A vulnerability was found in code-projects Job Portal 1.0. It has been classified as critical. Affected is an unknown function of the file logindbc.php. The manipulation of the argument email leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.274704 - https://vuldb.com/?ctiid.274704 - h
Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.274704 - https://vuldb.com/?ctiid.274704 - https://vuldb.com/?submit.390329 - https://github.com/XYgit-99/cve/issues/1
CVE ID: CVE-2024-7809 State: PUBLISHED Published: 2024-08-15T01:31:03.857Z Last Updated: 2024-08-19T19:25:39.102Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: SourceCodester Products: Online Graduate Tracer System Problem Types: CWE-548 Description: A vulnerability was found in SourceCodester Online Graduate Tracer System 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /tracking/nbproject/. The manipulation leads to exposure of information through directory listing. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: -
ack can be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.274705 - https://vuldb.com/?ctiid.274705 - https://vuldb.com/?submit.390781 - https://github.com/Wsstiger/cve/blob/main/Tracer_mu.md
CVE ID: CVE-2024-7810 State: PUBLISHED Published: 2024-08-15T02:00:05.833Z Last Updated: 2024-08-20T14:59:54.811Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: SourceCodester Products: Online Graduate Tracer System Problem Types: CWE-89 Description: A vulnerability was found in SourceCodester Online Graduate Tracer System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /tracking/admin/view_itprofile.php. The manipulation of the argument id leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: -
loit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.274706 - https://vuldb.com/?ctiid.274706 - https://vuldb.com/?submit.390782 - https://github.com/Wsstiger/cve/blob/main/Tracer_sql.md
CVE ID: CVE-2024-7811 State: PUBLISHED Published: 2024-08-15T02:31:04.076Z Last Updated: 2024-08-15T14:10:32.663Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: SourceCodester Products: Daily Expenses Monitoring App Problem Types: CWE-89 Description: A vulnerability classified as critical has been found in SourceCodester Daily Expenses Monitoring App 1.0. This affects an unknown part of the file /endpoint/delete-expense.php. The manipulation of the argument expense leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com
closed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.274707 - https://vuldb.com/?ctiid.274707 - https://vuldb.com/?submit.390947 - https://github.com/Peanut886/Vulnerability/blob/main/webray.com.cn/2024/daily%20expenses%20monitoring%20app%20-%20delete-expense.php%20sql%20injection%20vulnerability.md
CVE ID: CVE-2024-7812 State: PUBLISHED Published: 2024-08-15T03:00:06.502Z Last Updated: 2024-08-20T15:06:09.435Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: SourceCodester Products: Best House Rental Management System Problem Types: CWE-79 Description: A vulnerability classified as problematic was found in SourceCodester Best House Rental Management System 1.0. This vulnerability affects unknown code of the file /rental_0/rental/ajax.php?action=save_tenant of the component POST Parameter Handler. The manipulation of the argument lastname leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Additiona
scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.274708 - https://vuldb.com/?ctiid.274708 - https://vuldb.com/?submit.390953 - https://github.com/lscjl/lsi.webray.com.cn/blob/main/CVE-project/rental%20management%20system%20Stored%20Cross-Site%20Scripting(XSS).md
CVE ID: CVE-2024-7813 State: PUBLISHED Published: 2024-08-15T03:00:08.118Z Last Updated: 2024-08-15T14:00:08.328Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: SourceCodester Products: Prison Management System Problem Types: CWE-522 Description: A vulnerability, which was classified as problematic, has been found in SourceCodester Prison Management System 1.0. This issue affects some unknown processing of the file /uploadImage/Profile/ of the component Profile Image Handler. The manipulation leads to insufficiently protected credentials. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst N
The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.274709 - https://vuldb.com/?ctiid.274709 - https://vuldb.com/?submit.391358 - https://github.com/CYB84/CVE_Writeup/blob/main/Directory%20Listing.md
CVE ID: CVE-2024-7814 State: PUBLISHED Published: 2024-08-15T03:31:04.091Z Last Updated: 2024-09-03T18:04:42.275Z Severity: N/A (CVSS 3.3 AV:N/AC:L/Au:M/C:N/I:P/A:N) Vendors: CodeAstro Products: Online Railway Reservation System Problem Types: CWE-79 Description: A vulnerability, which was classified as problematic, was found in CodeAstro Online Railway Reservation System 1.0. Affected is an unknown function of the file /admin/admin-add-employee.php of the component Add Employee Page. The manipulation of the argument emp_fname /emp_lname /emp_nat_idno/emp_addr leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be
s site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.274710 - https://vuldb.com/?ctiid.274710 - https://github.com/CYB84/CVE_Writeup/blob/main/Online%20Railway%20Reservation%20System/Stored%20XSS.md
CVE ID: CVE-2024-7815 State: PUBLISHED Published: 2024-08-15T04:00:05.493Z Last Updated: 2024-08-15T13:10:50.535Z Severity: N/A (CVSS 3.3 AV:N/AC:L/Au:M/C:N/I:P/A:N) Vendors: CodeAstro Products: Online Railway Reservation System Problem Types: CWE-79 Description: A vulnerability has been found in CodeAstro Online Railway Reservation System 1.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /admin/admin-update-employee.php of the component Update Employee Page. The manipulation of the argument emp_fname /emp_lname /emp_nat_idno/emp_addr leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to t
at_idno/emp_addr leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.274711 - https://vuldb.com/?ctiid.274711 - https://vuldb.com/?submit.391376 - https://github.com/CYB84/CVE_Writeup/blob/main/Online%20Railway%20Reservation%20System/Stored%20XSS.md
CVE ID: CVE-2024-7816 State: PUBLISHED Published: 2024-09-12T06:00:04.807Z Last Updated: 2024-09-12T14:10:40.055Z Vendors: Unknown Products: Gixaw Chat Problem Types: CWE-79 Cross-Site Scripting (XSS), CWE-352 Cross-Site Request Forgery (CSRF) Description: The Gixaw Chat WordPress plugin through 1.0 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/f610c4a5-ccde-4305-93e0-3c6f50c741ee/
CVE ID: CVE-2024-7817 State: PUBLISHED Published: 2024-09-12T06:00:05.184Z Last Updated: 2024-09-12T14:04:47.826Z Vendors: Unknown Products: Misiek Photo Album Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The Misiek Photo Album WordPress plugin through 1.4.3 does not have CSRF checks in some places, which could allow attackers to make logged in users delete arbitrary albums via a CSRF attack Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/ab09e5a3-f5ea-479f-be2d-366f8707775e/
CVE ID: CVE-2024-7818 State: PUBLISHED Published: 2024-09-12T06:00:05.403Z Last Updated: 2024-09-12T13:59:23.571Z Vendors: Unknown Products: Misiek Photo Album Problem Types: CWE-79 Cross-Site Scripting (XSS), CWE-352 Cross-Site Request Forgery (CSRF) Description: The Misiek Photo Album WordPress plugin through 1.4.3 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/3d2263b9-e1e7-4e86-8475-5e468eef1826/
CVE ID: CVE-2024-7819 State: PUBLISHED Published: 2025-03-20T10:09:02.046Z Last Updated: 2025-03-20T18:59:15.771Z Severity: HIGH (CVSS 7.4 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N) Vendors: danswer-ai Products: danswer-ai/danswer Problem Types: CWE-346 Description: A CORS misconfiguration in danswer-ai/danswer v1.4.1 allows attackers to steal sensitive information such as chat contents, API keys, and other data. This vulnerability occurs due to improper validation of the origin header, enabling malicious web pages to make unauthorized requests to the application's API. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/06a21857-e13f-4cf4-aa67-de11
Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/06a21857-e13f-4cf4-aa67-de11419a98c0
CVE ID: CVE-2024-7820 State: PUBLISHED Published: 2024-09-12T06:00:05.585Z Last Updated: 2024-09-12T13:54:42.298Z Vendors: Unknown Products: ILC Thickbox Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The ILC Thickbox WordPress plugin through 1.0 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/31b2c97b-2458-43ee-93db-e57968ac8455/
CVE ID: CVE-2024-7821 State: REJECTED Published: N/A Last Updated: 2024-09-04T09:21:47.629Z Description: No description available.
CVE ID: CVE-2024-7822 State: PUBLISHED Published: 2024-09-12T06:00:05.782Z Last Updated: 2024-09-12T13:49:21.288Z Vendors: Unknown Products: Quick Code Problem Types: CWE-79 Cross-Site Scripting (XSS), CWE-352 Cross-Site Request Forgery (CSRF) Description: The Quick Code WordPress plugin through 1.0 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/3a5bdd7e-7dd5-4749-9fad-ff4d7df20273/
CVE ID: CVE-2024-7824 State: PUBLISHED Published: 2024-10-03T17:05:37.645Z Last Updated: 2024-10-03T17:45:56.051Z Severity: N/A (CVSS 6.3 AV:L/AC:M/Au:N/C:C/I:N/A:C) Vendors: Webroot Products: SecureAnywhere - Web Shield Problem Types: CWE-843 Description: Access of Resource Using Incompatible Type ('Type Confusion') vulnerability in Webroot SecureAnywhere - Web Shield on Windows, ARM, 64 bit, 32 bit (wrUrl.Dll modules) allows Functionality Misuse.This issue affects SecureAnywhere - Web Shield: before 2.1.2.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://answers.webroot.com/Webroot/ukp.aspx?pid=12&app=vw&vw=1&login=1&json=1&solutionid=4275
CVE ID: CVE-2024-7825 State: PUBLISHED Published: 2024-10-03T17:05:36.282Z Last Updated: 2024-10-03T17:46:06.996Z Severity: N/A (CVSS 6.2 AV:L/AC:L/Au:S/C:C/I:N/A:C) Vendors: Webroot Products: SecureAnywhere - Web Shield Problem Types: CWE-843 Description: Access of Resource Using Incompatible Type ('Type Confusion') vulnerability in Webroot SecureAnywhere - Web Shield on Windows, ARM, 64 bit, 32 bit (wrUrl.Dll modules) allows Functionality Misuse.This issue affects SecureAnywhere - Web Shield: before 2.1.2.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://answers.webroot.com/Webroot/ukp.aspx?pid=12&app=vw&vw=1&login=1&json=1&solutionid=4275
CVE ID: CVE-2024-7826 State: PUBLISHED Published: 2024-10-03T17:05:33.461Z Last Updated: 2024-10-03T17:46:18.210Z Severity: N/A (CVSS 6.2 AV:L/AC:L/Au:S/C:C/I:N/A:C) Vendors: Webroot Products: SecureAnywhere - Web Shield Problem Types: CWE-754 Description: Improper Check for Unusual or Exceptional Conditions vulnerability in Webroot SecureAnywhere - Web Shield on Windows, ARM, 64 bit, 32 bit (wrURL.Dll modules) allows Functionality Misuse.This issue affects SecureAnywhere - Web Shield: before 2.1.2.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://answers.webroot.com/Webroot/ukp.aspx?pid=12&app=vw&vw=1&login=1&json=1&solutionid=4275
CVE ID: CVE-2024-7827 State: PUBLISHED Published: 2024-08-20T02:03:18.330Z Last Updated: 2024-08-20T16:17:49.392Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: levelfourstorefront Products: Shopping Cart & eCommerce Store Problem Types: CWE-89 Description: The Shopping Cart & eCommerce Store plugin for WordPress is vulnerable to boolean-based SQL Injection via the ‘model_number’ parameter in all versions up to, and including, 5.7.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Contributor-level access and above, to append addit
SQL query. This makes it possible for authenticated attackers, with Contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/aa55dfe1-7ee8-4d25-a9f6-cbefeebb1376?source=cve - https://plugins.trac.wordpress.org/browser/wp-easycart/trunk/wpeasycart.php#L8821 - https://wordpress.org/plugins/wp-easycart/#developers - https://plugins.trac.wordpress.org/changeset/3136347/
CVE ID: CVE-2024-7828 State: PUBLISHED Published: 2024-08-15T12:31:03.787Z Last Updated: 2024-08-16T15:14:16.066Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C) Vendors: D-Link Products: DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05, DNS-1550-04 Problem Types: CWE-120 Description: ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability classified as critical was found in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200
321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20240814. This vulnerability affects the function cgi_set_cover of the file /cgi-bin/photocenter_mgr.cgi. The manipulation of the argument album_name leads to buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: Vendor was contacted early and confirmed that the product is end-of-life. It should be retired and replaced. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - htt
is end-of-life. It should be retired and replaced. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.274726 - https://vuldb.com/?ctiid.274726 - https://vuldb.com/?submit.390114 - https://github.com/BuaaIOTTeam/Iot_Dlink_NAS/blob/main/DNS_cgi_set_cover.md - https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10383