Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-9895 State: PUBLISHED Published: 2024-10-15T08:29:12.180Z Last Updated: 2024-10-15T12:48:22.221Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: elbanyaoui Products: Smart Online Order for Clover Problem Types: CWE-79 Description: The Smart Online Order for Clover plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's moo_receipt_link shortcode in all versions up to, and including, 1.5.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that wil
for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/e7263e89-94b2-42e6-a7ed-a86579ce649e?source=cve - https://wordpress.org/plugins/clover-online-orders/#developers - https://plugins.trac.wordpress.org/browser/clover-online-orders/trunk/moo_OnlineOrders.php#L171 - https://plugins.trac.wordpress.org/browser/clover-online-orders/trunk/moo_OnlineOrders.php#L90 - https://plugins.trac.wordpress.org/browser/clover-online-orders/trunk/includes/shortcodes/chec
oo_OnlineOrders.php#L90 - https://plugins.trac.wordpress.org/browser/clover-online-orders/trunk/includes/shortcodes/checkoutPage.php#L2011 - https://plugins.trac.wordpress.org/changeset/3168433/
CVE ID: CVE-2024-9896 State: PUBLISHED Published: 2024-11-02T07:34:03.396Z Last Updated: 2024-11-02T16:44:32.965Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: spiderdevs Products: BBP Core – Expand bbPress powered forums with useful features Problem Types: CWE-79 Description: The BBP Core – Expand bbPress powered forums with useful features plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 1.2.5. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully tr
possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/a329cf0a-8800-470a-9657-452f26112956?source=cve - https://plugins.trac.wordpress.org/browser/bbp-core/trunk/includes/features/bbpc_attachments/code/front.php#L284 - https://wordpress.org/plugins/bbp-core/#developers - https://plugins.trac.wordpress.org/changeset/3179353/
CVE ID: CVE-2024-9897 State: PUBLISHED Published: 2024-10-19T09:37:43.390Z Last Updated: 2024-10-20T13:50:29.588Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: streamweasels Products: StreamWeasels Twitch Integration Problem Types: CWE-79 Description: The StreamWeasels Twitch Integration plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's sw-twitch-embed shortcode in all versions up to, and including, 1.8.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages
possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/d2922c85-7e16-48a1-9c43-c1a9d34571e0?source=cve - https://wordpress.org/plugins/streamweasels-twitch-integration/#developers - https://plugins.trac.wordpress.org/browser/streamweasels-twitch-integration/trunk/public/class-streamweasels-public.php#L201 - https://plugins.trac.wordpress.org/changeset/3171629
CVE ID: CVE-2024-9898 State: PUBLISHED Published: 2024-10-17T11:03:54.653Z Last Updated: 2024-10-17T13:08:37.813Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: thehowarde Products: Parallax Image Problem Types: CWE-79 Description: The Parallax Image plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's dd-parallax shortcode in all versions up to, and including, 1.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an
ntributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/57641366-85d3-4375-8cde-041227c9f811?source=cve - https://plugins.trac.wordpress.org/browser/parallax-image/trunk/assets/shortcode.php#L145 - https://wordpress.org/plugins/parallax-image/#developers - https://plugins.trac.wordpress.org/changeset/3170176/#file16 - https://plugins.trac.wordpress.org/changeset/3170176/
CVE ID: CVE-2024-9899 State: REJECTED Published: N/A Last Updated: 2024-10-23T20:44:00.677Z Description: No description available.
CVE ID: CVE-2024-9900 State: PUBLISHED Published: 2025-03-20T10:09:14.108Z Last Updated: 2025-04-04T08:45:38.623Z Severity: MEDIUM (CVSS 5.4 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N) Vendors: mudler Products: mudler/localai Problem Types: CWE-79 Description: mudler/localai version v2.21.1 contains a Cross-Site Scripting (XSS) vulnerability in its search functionality. The vulnerability arises due to improper sanitization of user input, allowing the injection and execution of arbitrary JavaScript code. This can lead to the execution of malicious scripts in the context of the victim's browser, potentially compromising user sessions, stealing session cookies, redirecting users to malicious
the victim's browser, potentially compromising user sessions, stealing session cookies, redirecting users to malicious websites, or manipulating the DOM. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/b39cd230-db66-471b-89b9-24afaa078e68 - https://github.com/mudler/localai/commit/a1634b219a4e52813e70ff07e6376a01449c4515
CVE ID: CVE-2024-9901 State: REJECTED Published: 2025-03-20T10:11:01.980Z Last Updated: 2025-04-15T15:52:50.485Z Description: No description available.
CVE ID: CVE-2024-9902 State: PUBLISHED Published: 2024-11-06T09:56:54.505Z Last Updated: 2025-11-06T23:17:23.106Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:L) Vendors: Red Hat Products: Ansible Automation Platform Execution Environments, Red Hat Ansible Automation Platform 2.4 for RHEL 8, Red Hat Ansible Automation Platform 2.4 for RHEL 9, Red Hat Ansible Automation Platform 2.5 for RHEL 8, Red Hat Ansible Automation Platform 2.5 for RHEL 9, Red Hat OpenStack Platform 17.1 for RHEL 9, Red Hat Enterprise Linux 10 Problem Types: CWE-863 Description: A flaw was found in Ansible. The ansible-core `user` module can allow an unprivileged user to silently create or repla
: A flaw was found in Ansible. The ansible-core `user` module can allow an unprivileged user to silently create or replace the contents of any file on any system path and take ownership of it when a privileged user executes the `user` module against the unprivileged user's home directory. If the unprivileged user has traversal permissions on the directory containing the exploited target file, they retain full control over the contents of the file as its owner. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2024:10762 - https://access.redhat.com/errata/RHSA-2024:8969 - https://access.redhat.com/errata/RHSA-2024:9
/errata/RHSA-2024:10762 - https://access.redhat.com/errata/RHSA-2024:8969 - https://access.redhat.com/errata/RHSA-2024:9894 - https://access.redhat.com/errata/RHSA-2025:1861 - https://access.redhat.com/security/cve/CVE-2024-9902 - https://bugzilla.redhat.com/show_bug.cgi?id=2318271
CVE ID: CVE-2024-9903 State: PUBLISHED Published: 2024-10-12T23:00:06.275Z Last Updated: 2024-10-15T14:38:20.692Z Severity: N/A (CVSS 5.8 AV:N/AC:L/Au:M/C:P/I:P/A:P) Vendors: n/a Products: 07FLYCMS, 07FLY-CMS, 07FlyCRM Problem Types: CWE-434 Description: A vulnerability classified as critical has been found in 07FLYCMS, 07FLY-CMS and 07FlyCRM up to 1.2.0. This affects the function fileUpload of the file /admin/File/fileUpload. The manipulation of the argument file leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The affected product is known with different names like 07FLYCMS, 07FLY-CMS, and 07FlyCRM.
the public and may be used. The affected product is known with different names like 07FLYCMS, 07FLY-CMS, and 07FlyCRM. It was not possible to reach out to the vendor before assigning a CVE due to a not working mail address. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.280179 - https://vuldb.com/?ctiid.280179 - https://vuldb.com/?submit.421685 - https://github.com/DeepMountains/Mirage/blob/main/CVE19-1.md
CVE ID: CVE-2024-9904 State: PUBLISHED Published: 2024-10-13T01:31:04.358Z Last Updated: 2024-10-15T14:28:47.424Z Severity: N/A (CVSS 5.8 AV:N/AC:L/Au:M/C:P/I:P/A:P) Vendors: n/a Products: 07FLYCMS, 07FLY-CMS, 07FlyCRM Problem Types: CWE-434 Description: A vulnerability classified as critical was found in 07FLYCMS, 07FLY-CMS and 07FlyCRM up to 1.2.0. This vulnerability affects the function pictureUpload of the file /admin/File/pictureUpload. The manipulation of the argument file leads to unrestricted upload. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The affected product is known with different names like 07FLYCMS, 07FLY-CMS, and 07Fly
ed to the public and may be used. The affected product is known with different names like 07FLYCMS, 07FLY-CMS, and 07FlyCRM. It was not possible to reach out to the vendor before assigning a CVE due to a not working mail address. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.280180 - https://vuldb.com/?ctiid.280180 - https://vuldb.com/?submit.421686 - https://github.com/DeepMountains/Mirage/blob/main/CVE19-2.md
CVE ID: CVE-2024-9905 State: PUBLISHED Published: 2024-10-13T02:31:04.538Z Last Updated: 2024-10-17T19:54:44.328Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: SourceCodester Products: Online Eyewear Shop Problem Types: CWE-89 Description: A vulnerability, which was classified as critical, has been found in SourceCodester Online Eyewear Shop 1.0. This issue affects some unknown processing of the file /admin/?page=inventory/view_inventory&id=2. The manipulation of the argument id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuld
n disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.280181 - https://vuldb.com/?ctiid.280181 - https://vuldb.com/?submit.422606 - https://gist.github.com/higordiego/8679961c9d732e4068aaa37fd8d01439 - https://www.sourcecodester.com/
CVE ID: CVE-2024-9906 State: PUBLISHED Published: 2024-10-13T04:00:06.743Z Last Updated: 2024-10-15T14:18:06.900Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: SourceCodester Products: Online Eyewear Shop Problem Types: CWE-79 Description: A vulnerability, which was classified as problematic, was found in SourceCodester Online Eyewear Shop 1.0. Affected is an unknown function of the file /admin/?page=inventory/view_inventory&id=2. The manipulation of the argument Code leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vu
een disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.280182 - https://vuldb.com/?ctiid.280182 - https://vuldb.com/?submit.422612 - https://gist.github.com/higordiego/1c1e1709a6832cb63bbe9e9328f55ff9 - https://www.sourcecodester.com/
CVE ID: CVE-2024-9907 State: PUBLISHED Published: 2024-10-13T04:31:08.124Z Last Updated: 2024-10-15T14:15:22.732Z Severity: LOW (CVSS 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: n/a Products: QileCMS Problem Types: CWE-640 Description: A vulnerability classified as problematic was found in QileCMS up to 1.1.3. This vulnerability affects the function sendEmail of the file /qilecms/user/controller/Forget.php of the component Verification Code Handler. The manipulation leads to weak password recovery. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be u
tack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.280234 - https://vuldb.com/?ctiid.280234 - https://vuldb.com/?submit.418417 - https://note.zhaoj.in/share/PZZ7IeudhULs
CVE ID: CVE-2024-9908 State: PUBLISHED Published: 2024-10-13T12:00:06.936Z Last Updated: 2024-10-15T15:06:43.117Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: D-Link Products: DIR-619L B1 Problem Types: CWE-120 Description: A vulnerability, which was classified as critical, was found in D-Link DIR-619L B1 2.06. Affected is the function formSetMACFilter of the file /goform/formSetMACFilter. The manipulation of the argument curTime leads to buffer overflow. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.280236 - https://vuldb.com/?ctiid.280236 - https://vul
tes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.280236 - https://vuldb.com/?ctiid.280236 - https://vuldb.com/?submit.418739 - https://github.com/abcdefg-png/IoT-vulnerable/blob/main/D-Link/DIR-619L/formSetMACFilter.md - https://www.dlink.com/
CVE ID: CVE-2024-9909 State: PUBLISHED Published: 2024-10-13T14:00:07.160Z Last Updated: 2024-10-15T15:06:06.424Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C) Vendors: D-Link Products: DIR-619L B1 Problem Types: CWE-120 Description: A vulnerability has been found in D-Link DIR-619L B1 2.06 and classified as critical. Affected by this vulnerability is the function formSetMuti of the file /goform/formSetMuti. The manipulation of the argument curTime leads to buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.280237 - https://vuldb.com/?cti
. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.280237 - https://vuldb.com/?ctiid.280237 - https://vuldb.com/?submit.418740 - https://github.com/abcdefg-png/IoT-vulnerable/blob/main/D-Link/DIR-619L/formSetMuti.md - https://www.dlink.com/
CVE ID: CVE-2024-9910 State: PUBLISHED Published: 2024-10-13T14:31:04.973Z Last Updated: 2024-10-15T15:05:10.980Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C) Vendors: D-Link Products: DIR-619L B1 Problem Types: CWE-120 Description: A vulnerability was found in D-Link DIR-619L B1 2.06 and classified as critical. Affected by this issue is the function formSetPassword of the file /goform/formSetPassword. The manipulation of the argument curTime leads to buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.280238 - https://vuldb.com/?ctiid.28
itional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.280238 - https://vuldb.com/?ctiid.280238 - https://vuldb.com/?submit.418741 - https://github.com/abcdefg-png/IoT-vulnerable/blob/main/D-Link/DIR-619L/formSetPassword.md - https://www.dlink.com/
CVE ID: CVE-2024-9911 State: PUBLISHED Published: 2024-10-13T16:00:07.222Z Last Updated: 2024-10-15T15:04:04.286Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C) Vendors: D-Link Products: DIR-619L B1 Problem Types: CWE-120 Description: A vulnerability was found in D-Link DIR-619L B1 2.06. It has been classified as critical. This affects the function formSetPortTr of the file /goform/formSetPortTr. The manipulation of the argument curTime leads to buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.280239 - https://vuldb.com/?ctiid
Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.280239 - https://vuldb.com/?ctiid.280239 - https://vuldb.com/?submit.418742 - https://github.com/abcdefg-png/IoT-vulnerable/blob/main/D-Link/DIR-619L/formSetPortTr.md - https://www.dlink.com/
CVE ID: CVE-2024-9912 State: PUBLISHED Published: 2024-10-13T16:31:05.117Z Last Updated: 2024-10-15T14:11:21.224Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C) Vendors: D-Link Products: DIR-619L B1 Problem Types: CWE-120 Description: A vulnerability was found in D-Link DIR-619L B1 2.06. It has been declared as critical. This vulnerability affects the function formSetQoS of the file /goform/formSetQoS. The manipulation of the argument curTime leads to buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.280240 - https://vuldb.com/?ctiid.280
tional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.280240 - https://vuldb.com/?ctiid.280240 - https://vuldb.com/?submit.418743 - https://github.com/abcdefg-png/IoT-vulnerable/blob/main/D-Link/DIR-619L/formSetQoS.md - https://www.dlink.com/
CVE ID: CVE-2024-9913 State: PUBLISHED Published: 2024-10-13T17:31:04.724Z Last Updated: 2024-10-15T14:09:20.508Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C) Vendors: D-Link Products: DIR-619L B1 Problem Types: CWE-120 Description: A vulnerability was found in D-Link DIR-619L B1 2.06. It has been rated as critical. This issue affects the function formSetRoute of the file /goform/formSetRoute. The manipulation of the argument curTime leads to buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.280241 - https://vuldb.com/?ctiid.280241 - h
Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.280241 - https://vuldb.com/?ctiid.280241 - https://vuldb.com/?submit.418745 - https://github.com/abcdefg-png/IoT-vulnerable/blob/main/D-Link/DIR-619L/formSetRoute.md - https://www.dlink.com/
CVE ID: CVE-2024-9914 State: PUBLISHED Published: 2024-10-13T18:00:06.971Z Last Updated: 2024-10-15T14:07:16.744Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C) Vendors: D-Link Products: DIR-619L B1 Problem Types: CWE-120 Description: A vulnerability classified as critical has been found in D-Link DIR-619L B1 2.06. Affected is the function formSetWizardSelectMode of the file /goform/formSetWizardSelectMode. The manipulation of the argument curTime leads to buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.280242 - https://vuldb.c
be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.280242 - https://vuldb.com/?ctiid.280242 - https://vuldb.com/?submit.418746 - https://github.com/abcdefg-png/IoT-vulnerable/blob/main/D-Link/DIR-619L/formSetWizardSelectMode.md - https://www.dlink.com/
CVE ID: CVE-2024-9915 State: PUBLISHED Published: 2024-10-13T18:31:04.848Z Last Updated: 2024-10-15T16:01:45.164Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C) Vendors: D-Link Products: DIR-619L B1 Problem Types: CWE-120 Description: A vulnerability classified as critical was found in D-Link DIR-619L B1 2.06. Affected by this vulnerability is the function formVirtualServ of the file /goform/formVirtualServ. The manipulation of the argument curTime leads to buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.280243 - https://vuldb.com/?ctii
Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.280243 - https://vuldb.com/?ctiid.280243 - https://vuldb.com/?submit.418747 - https://github.com/abcdefg-png/IoT-vulnerable/blob/main/D-Link/DIR-619L/formVirtualServ.md - https://www.dlink.com/
CVE ID: CVE-2024-9916 State: PUBLISHED Published: 2024-10-13T19:00:07.001Z Last Updated: 2024-10-15T15:02:13.072Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: HuangDou Products: UTCMS Problem Types: CWE-78 Description: A vulnerability, which was classified as critical, has been found in HuangDou UTCMS V9. Affected by this issue is some unknown functionality of the file app/modules/ut-cac/admin/cli.php. The manipulation of the argument o leads to os command injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: -
used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.280244 - https://vuldb.com/?ctiid.280244 - https://vuldb.com/?submit.418748 - https://github.com/DeepMountains/zzz/blob/main/CVE5-1.md
CVE ID: CVE-2024-9917 State: PUBLISHED Published: 2024-10-13T19:31:03.992Z Last Updated: 2024-10-15T15:01:58.207Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: HuangDou Products: UTCMS Problem Types: CWE-502 Description: A vulnerability, which was classified as critical, was found in HuangDou UTCMS V9. This affects an unknown part of the file app/modules/ut-template/admin/template_creat.php. The manipulation of the argument content leads to deserialization. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: -
used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.280245 - https://vuldb.com/?ctiid.280245 - https://vuldb.com/?submit.418749 - https://github.com/DeepMountains/zzz/blob/main/CVE5-2.md