Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-46328 State: PUBLISHED Published: 2024-09-26T00:00:00 Last Updated: 2024-09-26T14:31:36.573Z Vendors: n/a Products: n/a Problem Types: n/a Description: VONETS VAP11G-300 v3.3.23.6.9 was discovered to contain hardcoded credentials for several different privileged accounts, including root. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://hawktesters.com/5519644d-246e-4924-b7c8-8fdf742117be/9461d352-c4f6-477f-a44e-b91ff71e6d84.pdf
CVE ID: CVE-2024-46329 State: PUBLISHED Published: 2024-09-26T00:00:00 Last Updated: 2024-09-26T14:31:30.205Z Vendors: n/a Products: n/a Problem Types: n/a Description: VONETS VAP11G-300 v3.3.23.6.9 was discovered to contain a command injection vulnerability via the SystemCommand object. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://hawktesters.com/5519644d-246e-4924-b7c8-8fdf742117be/1af23e51-20e4-4432-a66c-64345c1e4ed4.pdf
CVE ID: CVE-2024-46330 State: PUBLISHED Published: 2024-09-26T00:00:00 Last Updated: 2024-09-26T14:31:23.200Z Vendors: n/a Products: n/a Problem Types: n/a Description: VONETS VAP11G-300 v3.3.23.6.9 was discovered to contain a command injection vulnerability via the iptablesWebsFilterRun object. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://hawktesters.com/5519644d-246e-4924-b7c8-8fdf742117be/704b5e66-fee5-4289-aa55-eb7feb5f0edc.pdf
CVE ID: CVE-2024-46331 State: PUBLISHED Published: 2024-09-27T00:00:00 Last Updated: 2024-09-27T16:22:58.014Z Vendors: n/a Products: n/a Problem Types: n/a Description: ModStartCMS v8.8.0 was discovered to contain an open redirect vulnerability in the redirect parameter at /admin/login. This vulnerability allows attackers to redirect users to an arbitrary website via a crafted URL. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/whiteshark2k/ModStartCMS-OpenRedirect/blob/main/ModStartCMS-OpenRedirect.md
CVE ID: CVE-2024-46333 State: PUBLISHED Published: 2024-09-27T00:00:00 Last Updated: 2024-09-27T16:22:50.945Z Vendors: n/a Products: n/a Problem Types: n/a Description: An authenticated cross-site scripting (XSS) vulnerability in Piwigo v14.5.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Album Name parameter under the Add Album function. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/whiteshark2k/Piwigo-XSS/blob/main/Piwigo-XSS.md
CVE ID: CVE-2024-46334 State: PUBLISHED Published: 2025-11-17T00:00:00.000Z Last Updated: 2025-11-17T17:00:35.888Z Vendors: n/a Products: n/a Problem Types: n/a Description: kashipara School Management System 1.0 is vulnerable to Cross Site Scripting (XSS) via the formuser and formpassword parameters in /adminLogin.php. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.kashipara.com/project/php/73/school-management-system-download-project-source-code-in-php - https://github.com/leexsoyoung/CVEs/blob/main/CVE-2024-46334.md
CVE ID: CVE-2024-46335 State: PUBLISHED Published: 2025-11-17T00:00:00.000Z Last Updated: 2025-11-17T19:11:59.223Z Vendors: n/a Products: n/a Problem Types: n/a Description: PHPGurukul Complaint Management System 2.0 is vulnerble to Cross Site Scripting (XSS) via the fromdate and todate parameters in between-date-userreport.php. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://phpgurukul.com/complaint-management-sytem - https://github.com/leexsoyoung/CVEs/blob/main/CVE-2024-46335.md
CVE ID: CVE-2024-46336 State: PUBLISHED Published: 2025-11-17T00:00:00.000Z Last Updated: 2025-11-17T20:20:32.912Z Vendors: n/a Products: n/a Problem Types: n/a Description: kashipara School Management System 1.0 is vulnerable to Cross Site Scripting (XSS) via /client_user/feedback.php. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.kashipara.com/project/php/73/school-management-system-download-project-source-code-in-php - https://github.com/leexsoyoung/CVEs/blob/main/CVE-2024-46336.md
CVE ID: CVE-2024-46340 State: PUBLISHED Published: 2024-12-10T00:00:00.000Z Last Updated: 2025-04-03T15:26:32.282Z Vendors: n/a Products: n/a Problem Types: n/a Description: TL-WR845N(UN)_V4_201214, TP-Link TL-WR845N(UN)_V4_200909, and TL-WR845N(UN)_V4_190219 was discovered to transmit user credentials in plaintext after executing a factory reset. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://security.iiita.ac.in/iot/factory-reset.docx
CVE ID: CVE-2024-46341 State: PUBLISHED Published: 2024-12-10T00:00:00 Last Updated: 2024-12-11T15:11:42.547Z Vendors: n/a Products: n/a Problem Types: n/a Description: TP-Link TL-WR845N(UN)_V4_190219 was discovered to transmit credentials in base64 encoded form, which can be easily decoded by an attacker executing a man-in-the-middle attack. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://security.iiita.ac.in/iot/base64-authorization.docx
CVE ID: CVE-2024-46362 State: PUBLISHED Published: 2024-09-17T00:00:00 Last Updated: 2024-09-17T17:52:54.322Z Vendors: n/a Products: n/a Problem Types: n/a Description: FrogCMS V0.9.5 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/?/plugin/file_manager/create_directory Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/ohuquq/cms/tree/main/13/readme.md
CVE ID: CVE-2024-46366 State: PUBLISHED Published: 2024-09-27T00:00:00 Last Updated: 2024-09-27T19:15:08.549Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Client-side Template Injection (CSTI) vulnerability in Webkul Krayin CRM 1.3.0 allows remote attackers to execute arbitrary client-side template code by injecting a malicious payload during the lead creation process. This can lead to privilege escalation when the payload is executed, granting the attacker elevated permissions within the CRM system. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gist.github.com/Tommywarren/89cef7f876ee897a4ff40a8b71b6208e
CVE ID: CVE-2024-46367 State: PUBLISHED Published: 2024-09-27T00:00:00 Last Updated: 2024-09-27T19:12:38.360Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Stored Cross-Site Scripting (XSS) vulnerability in Webkul Krayin CRM 1.3.0 allows remote attackers to inject arbitrary JavaScript code by submitting a malicious payload within the username field. This can lead to privilege escalation when the payload is executed, granting the attacker elevated permissions within the CRM system. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gist.github.com/Tommywarren/4ac0c8f6e5d8584accd31b8277e55749
CVE ID: CVE-2024-46372 State: PUBLISHED Published: 2024-09-18T00:00:00.000Z Last Updated: 2025-03-25T16:30:47.423Z Vendors: n/a Products: n/a Problem Types: n/a Description: DedeCMS 5.7.115 is vulnerable to Cross Site Scripting (XSS) via the advertisement code box in the advertisement management module. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/gaorenyusi/gaorenyusi/blob/main/CVE-2024-46372.md
CVE ID: CVE-2024-46373 State: PUBLISHED Published: 2024-09-18T00:00:00 Last Updated: 2024-09-19T18:34:36.759Z Vendors: n/a Products: n/a Problem Types: n/a Description: Dedecms V5.7.115 contains an arbitrary code execution via file upload vulnerability in the backend. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/gaorenyusi/gaorenyusi/blob/main/CVE-2024-46373.md
CVE ID: CVE-2024-46374 State: PUBLISHED Published: 2024-09-18T00:00:00 Last Updated: 2024-09-19T18:43:14.258Z Vendors: n/a Products: n/a Problem Types: n/a Description: Best House Rental Management System 1.0 contains a SQL injection vulnerability in the delete_category() function of the file rental/admin_class.php. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/gaorenyusi/gaorenyusi/blob/main/CVE-2024-46374.md
CVE ID: CVE-2024-46375 State: PUBLISHED Published: 2024-09-18T00:00:00 Last Updated: 2024-09-19T13:52:08.416Z Vendors: n/a Products: n/a Problem Types: n/a Description: Best House Rental Management System 1.0 contains an arbitrary file upload vulnerability in the signup() function of the file rental/admin_class.php. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/gaorenyusi/gaorenyusi/blob/main/CVE-2024-46375.md
CVE ID: CVE-2024-46376 State: PUBLISHED Published: 2024-09-18T00:00:00 Last Updated: 2024-09-19T13:49:04.351Z Vendors: n/a Products: n/a Problem Types: n/a Description: Best House Rental Management System 1.0 contains an arbitrary file upload vulnerability in the update_account() function of the file rental/admin_class.php. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/gaorenyusi/gaorenyusi/blob/main/CVE-2024-46376.md
CVE ID: CVE-2024-46377 State: PUBLISHED Published: 2024-09-18T00:00:00 Last Updated: 2024-09-19T14:11:54.947Z Vendors: n/a Products: n/a Problem Types: n/a Description: Best House Rental Management System 1.0 contains an arbitrary file upload vulnerability in the save_settings() function of the file rental/admin_class.php. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/gaorenyusi/gaorenyusi/blob/main/CVE-2024-46377.md
CVE ID: CVE-2024-46382 State: PUBLISHED Published: 2024-09-19T00:00:00 Last Updated: 2024-09-19T13:58:40.845Z Vendors: n/a Products: n/a Problem Types: n/a Description: A SQL injection vulnerability in linlinjava litemall 1.8.0 allows a remote attacker to obtain sensitive information via the goodsId, goodsSn, and name parameters in AdminGoodscontroller.java. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/linlinjava/litemall/issues/552
CVE ID: CVE-2024-46383 State: PUBLISHED Published: 2024-11-15T00:00:00 Last Updated: 2024-11-15T20:00:03.835Z Vendors: n/a Products: n/a Problem Types: n/a Description: Hathway Skyworth Router CM5100-511 v4.1.1.24 was discovered to store sensitive information about USB and Wifi connected devices in plaintext. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://skyworth.com - https://github.com/nitinronge91/Sensitive-Information-disclosure-via-SPI-flash-firmware-for-Hathway-router-CVE-2024-46383
CVE ID: CVE-2024-46394 State: PUBLISHED Published: 2024-09-19T00:00:00 Last Updated: 2024-09-19T13:53:43.470Z Vendors: n/a Products: n/a Problem Types: n/a Description: FrogCMS v0.9.5 was discovered to contain a Cross-Site Request Forgery (CSRF) via /admin/?/user/add Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/fffccx1/cms/tree/main/14/readme.md
CVE ID: CVE-2024-46409 State: PUBLISHED Published: 2024-10-04T00:00:00 Last Updated: 2024-10-04T18:29:36.173Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stored cross-site scripting (XSS) vulnerability in SeedDMS v6.0.28 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Name parameter in the Calendar page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://demo6.seeddms.org/out/out.LogManagement.php?logname=20240831.log - https://packetstormsecurity.com/files/181974/SeedDMS-6.0.28-Cross-Site-Scripting.html
CVE ID: CVE-2024-46410 State: PUBLISHED Published: 2024-10-08T00:00:00 Last Updated: 2024-10-09T14:52:54.809Z Vendors: n/a Products: n/a Problem Types: n/a Description: PublicCMS V4.0.202406.d was discovered to contain a cross-site scripting (XSS) vulnerability via a crafted script to the Category Managment feature Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitee.com/sanluan/PublicCMS - https://github.com/trengh222/publiccms_xss
CVE ID: CVE-2024-46412 State: PUBLISHED Published: 2025-08-25T00:00:00.000Z Last Updated: 2025-08-26T15:54:16.529Z Vendors: n/a Products: n/a Problem Types: n/a Description: Incorrect access control in the prehandle function of Rebuild v3.7.7 allows attackers to bypass authentication via a crafted GET request sent to /commons/ip-location. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/RacerZ-fighting/rebuild-vulns/blob/main/rebuild%203.7.7.md - https://github.com/RacerZ-fighting/CVE-vulns/blob/main/rebuild%203.7.5.md
CVE ID: CVE-2024-46413 State: PUBLISHED Published: 2025-08-25T00:00:00.000Z Last Updated: 2025-08-26T15:24:05.619Z Vendors: n/a Products: n/a Problem Types: n/a Description: Rebuild v3.7.7 was discovered to contain a Server-Side Request Forgery (SSRF) via the type parameter in the com.rebuild.web.admin.rbstore.RBStoreController#loadDataIndex method. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/RacerZ-fighting/rebuild-vulns/blob/main/rebuild%203.7.7.md - https://github.com/RacerZ-fighting/CVE-vulns/blob/main/rebuild%203.7.7.md
CVE ID: CVE-2024-46419 State: PUBLISHED Published: 2024-09-16T00:00:00 Last Updated: 2024-09-17T13:41:27.785Z Vendors: n/a Products: n/a Problem Types: n/a Description: TOTOLINK AC1200 T8 v4.1.5cu.861_B20230220 has a buffer overflow vulnerability in the setWizardCfg function via the ssid5g parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/TTTJJJWWW/AHU-IoT-vulnerable/blob/main/TOTOLINK/AC1200T8/setWizardCfg.md
CVE ID: CVE-2024-46424 State: PUBLISHED Published: 2024-09-16T00:00:00 Last Updated: 2024-09-17T13:51:21.429Z Vendors: n/a Products: n/a Problem Types: n/a Description: TOTOLINK AC1200 T8 v4.1.5cu.861_B20230220 has a buffer overflow vulnerability in the UploadCustomModule function, which allows attackers to cause a Denial of Service (DoS) via the File parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/TTTJJJWWW/AHU-IoT-vulnerable/blob/main/TOTOLINK/AC1200T8/UploadCustomModule.md
CVE ID: CVE-2024-46429 State: PUBLISHED Published: 2025-02-10T00:00:00.000Z Last Updated: 2025-02-10T21:46:49.000Z Vendors: n/a Products: n/a Problem Types: n/a Description: A hardcoded credentials vulnerability in Tenda W18E V16.01.0.8(1625) allows unauthenticated remote attackers to access the web management portal using a default guest account with administrative privileges. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://reddassolutions.com/blog/tenda_w18e_security_research
CVE ID: CVE-2024-46430 State: PUBLISHED Published: 2025-02-10T00:00:00.000Z Last Updated: 2025-02-10T21:47:12.104Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda W18E V16.01.0.8(1625) is vulnerable to Incorrect Access Control. Unauthorized password change via the web management portal allows an unauthenticated remote attacker to change the administrator password by sending a specially crafted HTTP POST request to the setLoginPassword function, bypassing the authentication mechanism. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://reddassolutions.com/blog/tenda_w18e_security_research
CVE ID: CVE-2024-46431 State: PUBLISHED Published: 2025-02-10T00:00:00.000Z Last Updated: 2025-02-10T21:47:24.473Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda W18E V16.01.0.8(1625) is vulnerable to Buffer Overflow. An attacker with access to the web management portal can exploit this vulnerability by sending specially crafted data to the delWewifiPic function. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://reddassolutions.com/blog/tenda_w18e_security_research
CVE ID: CVE-2024-46432 State: PUBLISHED Published: 2025-02-10T00:00:00.000Z Last Updated: 2025-02-10T21:47:36.559Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda W18E V16.01.0.8(1625) is vulnerable to Incorrect Access Control. An attacker can send a specially crafted HTTP POST request to the setQuickCfgWifiAndLogin function, which allows unauthorized changes to WiFi configuration settings and administrative credentials. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://reddassolutions.com/blog/tenda_w18e_security_research
CVE ID: CVE-2024-46433 State: PUBLISHED Published: 2025-02-10T00:00:00.000Z Last Updated: 2025-02-10T21:42:55.748Z Vendors: n/a Products: n/a Problem Types: n/a Description: A default credentials vulnerability in Tenda W18E V16.01.0.8(1625) allows unauthenticated remote attackers to access the web management portal using the default rzadmin account with administrative privileges. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://reddassolutions.com/blog/tenda_w18e_security_research
CVE ID: CVE-2024-46434 State: PUBLISHED Published: 2025-02-10T00:00:00.000Z Last Updated: 2025-02-10T21:47:57.677Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda W18E V16.01.0.8(1625) suffers from authentication bypass in the web management portal allowing an unauthorized remote attacker to gain administrative access by sending a specially crafted HTTP request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://reddassolutions.com/blog/tenda_w18e_security_research
CVE ID: CVE-2024-46435 State: PUBLISHED Published: 2025-02-10T00:00:00.000Z Last Updated: 2025-02-10T21:41:42.771Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stack overflow vulnerability in the Tenda W18E V16.01.0.8(1625) web management portal allows an authenticated remote attacker to cause a denial of service or potentially execute arbitrary code. This vulnerability occurs due to improper input validation when handling user-supplied data in the delFacebookPic function. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://reddassolutions.com/blog/tenda_w18e_security_research
CVE ID: CVE-2024-46436 State: PUBLISHED Published: 2025-02-10T00:00:00.000Z Last Updated: 2025-02-10T21:48:28.279Z Vendors: n/a Products: n/a Problem Types: n/a Description: Hardcoded credentials in Tenda W18E V16.01.0.8(1625) allows unauthenticated remote attackers to gain root access to the device over the telnet service. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://reddassolutions.com/blog/tenda_w18e_security_research
CVE ID: CVE-2024-46437 State: PUBLISHED Published: 2025-02-10T00:00:00.000Z Last Updated: 2025-02-10T21:40:28.464Z Vendors: n/a Products: n/a Problem Types: n/a Description: A sensitive information disclosure vulnerability in the Tenda W18E V16.01.0.8(1625) web management portal allows an unauthenticated remote attacker to retrieve sensitive configuration information, including WiFi SSID, WiFi password, and base64-encoded administrator credentials, by sending a specially crafted HTTP POST request to the getQuickCfgWifiAndLogin function, bypassing authentication checks. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://reddassolutions.com/blog/tenda_w18e_security_resear
tional Analyst Notes: - CISA ADP Vulnrichment: References: - https://reddassolutions.com/blog/tenda_w18e_security_research
CVE ID: CVE-2024-46441 State: PUBLISHED Published: 2024-09-27T00:00:00 Last Updated: 2024-09-27T14:35:01.426Z Vendors: n/a Products: n/a Problem Types: n/a Description: An arbitrary file upload vulnerability in YPay 1.2.0 allows attackers to execute arbitrary code via a ZIP archive to themePutFile in app/common/util/Upload.php (called from app/admin/controller/ypay/Home.php). The file extension of an uncompressed file is not checked. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/kacins/YPay/issues/4
CVE ID: CVE-2024-46442 State: PUBLISHED Published: 2024-12-10T00:00:00 Last Updated: 2024-12-11T14:57:04.420Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in the BYD Dilink Headunit System v3.0 to v4.0 allows attackers to bypass authentication via a bruteforce attack. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://byd.com - https://www.bydauto.com.cn/ - https://github.com/zgsnj123/BYD_headunit_vuls/tree/main
CVE ID: CVE-2024-46446 State: PUBLISHED Published: 2024-10-07T00:00:00 Last Updated: 2024-10-07T19:20:25.373Z Vendors: n/a Products: n/a Problem Types: n/a Description: Mecha CMS 3.0.0 is vulnerable to Directory Traversal. An attacker can construct cookies and URIs that bypass user identity checks. Parameters can then be passed through the POST method, resulting in the Deletion of Arbitrary Files or Website Takeover. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://mecha-cmscom.com - https://github.com/Sp1d3rL1/Mecha-cms-Arbitrary-File-Deletion-Vulnerability
CVE ID: CVE-2024-46450 State: PUBLISHED Published: 2025-01-16T00:00:00.000Z Last Updated: 2025-02-03T20:11:22.202Z Vendors: n/a Products: n/a Problem Types: n/a Description: Incorrect access control in Tenda AC1200 Smart Dual-Band WiFi Router Model AC6 v2.0 Firmware v15.03.06.50 allows attackers to bypass authentication via a crafted web request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://pastebin.com/BXxTqsZk
CVE ID: CVE-2024-46451 State: PUBLISHED Published: 2024-09-16T00:00:00 Last Updated: 2024-09-17T13:48:13.115Z Vendors: n/a Products: n/a Problem Types: n/a Description: TOTOLINK AC1200 T8 v4.1.5cu.861_B20230220 has a buffer overflow vulnerability in the setWiFiAclRules function via the desc parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/offshore0315/loT-vulnerable/blob/main/TOTOLINK/AC1200%20T8/setWiFiAclRules.md
CVE ID: CVE-2024-46452 State: PUBLISHED Published: 2025-06-09T00:00:00.000Z Last Updated: 2025-06-09T19:48:08.036Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Host Header injection vulnerability in the password reset function of VigyBag Open Source Online Shop commit 3f0e21b allows attackers to redirect victim users to a malicious site via a crafted URL. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/codervivek5/VigyBag - https://www.vigybag.com - https://github.com/ch3tanbug/vulnerability-research/tree/main/CVE-2024-46452
CVE ID: CVE-2024-46453 State: PUBLISHED Published: 2024-09-27T00:00:00.000Z Last Updated: 2025-03-13T15:48:30.260Z Vendors: n/a Products: n/a Problem Types: n/a Description: A cross-site scripting (XSS) vulnerability in the component /test/ of iq3xcite v2.31 to v3.05 allows attackers to execute arbitrary web scripts or HTML via a crafted payload. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/nosmo-gla/iq3xcite-XSS-2.31-3.05/tree/main
CVE ID: CVE-2024-46455 State: PUBLISHED Published: 2024-12-09T00:00:00 Last Updated: 2024-12-11T20:29:44.658Z Vendors: n/a Products: n/a Problem Types: n/a Description: unstructured v.0.14.2 and before is vulnerable to XML External Entity (XXE) via the XMLParser. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Unstructured-IO/unstructured/tree/0.14.2 - https://binarysouljour.me/cve-2024-46455
CVE ID: CVE-2024-46461 State: PUBLISHED Published: 2024-09-25T00:00:00 Last Updated: 2024-09-25T15:39:36.371Z Vendors: n/a Products: n/a Problem Types: n/a Description: VLC media player 3.0.20 and earlier is vulnerable to denial of service through an integer overflow which could be triggered with a maliciously crafted mms stream (heap based overflow). If successful, a malicious third party could trigger either a crash of VLC or an arbitrary code execution with the target user's privileges. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.videolan.org/security/sb-vlc3021.html
CVE ID: CVE-2024-46462 State: PUBLISHED Published: 2024-11-15T00:00:00 Last Updated: 2024-11-25T19:59:52.522Z Vendors: n/a Products: n/a Problem Types: n/a Description: By default, dedicated folders of ZEDMAIL for Windows up to 2024.3 can be accessed by other users to misuse technical files and make them perform tasks with higher privileges. Configuration of ZEDMAIL has to be modified to prevent this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.primx.eu/en/bulletins/security-bulletin-24931936/