Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
osed to the public and may be used. VDB-257386 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.257386 - https://vuldb.com/?ctiid.257386 - https://github.com/E1CHO/cve_hub/blob/main/Online%20Job%20Finder%20System/Online%20Job%20Finder%20System%20-%20vuln%2021.pdf
CVE ID: CVE-2024-2687 State: PUBLISHED Published: 2024-03-20T09:31:06.341Z Last Updated: 2025-04-10T20:17:59.892Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: Campcodes Products: Online Job Finder System Problem Types: CWE-89 Description: A vulnerability was found in Campcodes Online Job Finder System 1.0 and classified as critical. This issue affects some unknown processing of the file /admin/applicants/index.php. The manipulation of the argument id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-257387. Additional Analyst Notes: - CISA ADP Vulnr
d may be used. The associated identifier of this vulnerability is VDB-257387. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.257387 - https://vuldb.com/?ctiid.257387 - https://github.com/E1CHO/cve_hub/blob/main/Online%20Job%20Finder%20System/Online%20Job%20Finder%20System%20-%20vuln%2011.pdf
CVE ID: CVE-2024-2688 State: PUBLISHED Published: 2024-03-23T02:32:55.950Z Last Updated: 2024-08-01T19:18:48.169Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) Vendors: wpdevteam Products: EmbedPress – Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The EmbedPress – Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the EmbedPress documen
ts in Gutenberg & Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the EmbedPress document widget in all versions up to, and including, 3.9.12 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/c5b67927-5993-4e21-af52-8ebe7fee48ab?source=cve - https://plugins.trac.wordpress.org/changeset?
intel/vulnerabilities/id/c5b67927-5993-4e21-af52-8ebe7fee48ab?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3055856%40embedpress&new=3055856%40embedpress&sfp_email=&sfph_mail=
CVE ID: CVE-2024-2689 State: PUBLISHED Published: 2024-04-03T21:13:31.599Z Last Updated: 2025-08-27T21:02:57.514Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H) Vendors: Temporal Technologies, Inc. Products: Temporal Server Problem Types: CWE-20 Description: Denial of Service in Temporal Server prior to version 1.20.5, 1.21.6, and 1.22.7 allows an authenticated user who has permissions to interact with workflows and has crafted an invalid UTF-8 string for submission to potentially cause a crashloop. If left unchecked, the task containing the invalid UTF-8 will become stuck in the queue, causing an increase in queue lag. Eventually, all processes handling these queue
d UTF-8 will become stuck in the queue, causing an increase in queue lag. Eventually, all processes handling these queues will become stuck and the system will run out of resources. The workflow ID of the failing task will be visible in the logs, and can be used to remove that workflow as a mitigation. Version 1.23 is not impacted. In this context, a user is an operator of Temporal Server. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/temporalio/temporal/releases
CVE ID: CVE-2024-2690 State: PUBLISHED Published: 2024-03-20T10:00:06.860Z Last Updated: 2024-08-01T19:18:48.443Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: SourceCodester Products: Online Discussion Forum Site Problem Types: CWE-434 Description: A vulnerability was found in SourceCodester Online Discussion Forum Site 1.0. It has been classified as critical. Affected is an unknown function of the file /uupdate.php. The manipulation of the argument ima leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-257388. Additional Analyst Notes: - CISA ADP
to the public and may be used. The identifier of this vulnerability is VDB-257388. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.257388 - https://vuldb.com/?ctiid.257388 - https://github.com/wkeyi0x1/vul-report/issues/2
CVE ID: CVE-2024-2691 State: PUBLISHED Published: 2024-07-16T08:32:29.781Z Last Updated: 2024-08-01T19:18:48.235Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: wpeventmanager Products: WP Event Manager – Events Calendar, Registrations, Sell Tickets with WooCommerce Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The WP Event Manager – Events Calendar, Registrations, Sell Tickets with WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'events' shortcode in all versions up to, and including, 3.1.43 due to insufficient input sanitization and out
plugin's 'events' shortcode in all versions up to, and including, 3.1.43 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/01a6dcf2-6f0b-494b-a18c-04bd9c44e0ce?source=cve - https://plugins.trac.wordpress.org/changeset/3116941/wp-event-manager/trunk/shortcodes/wp-event-manager-shortcodes.php
CVE ID: CVE-2024-2692 State: PUBLISHED Published: 2024-04-04T01:26:58.240Z Last Updated: 2025-05-19T16:59:48.351Z Severity: CRITICAL (CVSS 9 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H) Vendors: SiYuan Products: SiYuan Problem Types: CWE-79 Description: SiYuan version 3.0.3 allows executing arbitrary commands on the server. This is possible because the application is vulnerable to Server Side XSS. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://fluidattacks.com/advisories/dezco/ - https://github.com/siyuan-note/siyuan/
CVE ID: CVE-2024-2693 State: PUBLISHED Published: 2024-04-09T18:59:02.060Z Last Updated: 2024-08-09T18:49:55.864Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: linkwhspr Products: Link Whisper Free Problem Types: CWE-502 Deserialization of Untrusted Data Description: The Link Whisper Free plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 0.7.1 via deserialization of untrusted input of the 'mfn-page-items' post meta value. This makes it possible for authenticated attackers, with contributor-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable plugin. If a POP chain is pr
l access and above, to inject a PHP Object. No known POP chain is present in the vulnerable plugin. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/7d5dd7cd-f96a-48df-a553-be5e59d8290f?source=cve - https://plugins.trac.wordpress.org/changeset/3057518/link-whisper/tags/0.7.2/core/Wpil/Editor/Muffin.php?old=3048109&old_path=link-whisper%2Ftags%2F0.7.1%2Fcore%2FWpil%2FEditor%2FMuffin.php
CVE ID: CVE-2024-2694 State: PUBLISHED Published: 2024-08-30T04:29:56.636Z Last Updated: 2024-08-30T14:38:27.101Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: MuffinGroup Products: Betheme Problem Types: CWE-502 Description: The Betheme theme for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 27.5.6 via deserialization of untrusted input of the 'mfn-page-items' post meta value. This makes it possible for authenticated attackers, with contributor-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable plugin. If a POP chain is present via an additional plugin or theme installed on
POP chain is present in the vulnerable plugin. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/a7c31409-c84a-4197-b08c-b70df5e66a80?source=cve - https://themeforest.net/item/betheme-responsive-multipurpose-wordpress-theme/7758048
CVE ID: CVE-2024-2695 State: PUBLISHED Published: 2024-06-15T08:42:16.998Z Last Updated: 2024-08-01T19:18:48.351Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: 3uu Products: Shariff Wrapper Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Shariff Wrapper plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'shariff' shortcode in all versions up to, and including, 4.6.13 due to insufficient input sanitization and output escaping on user supplied attributes such as 'borderradius' and 'timestamp'. This makes it possible for authenticated attackers, with co
supplied attributes such as 'borderradius' and 'timestamp'. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/9baa8bbf-a318-4bc5-8bfd-2bd64536965e?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3069111%40shariff%2Ftrunk&old=3061040%40shariff%2Ftrunk&sfp_email=&sfph_mail=#file1
CVE ID: CVE-2024-2696 State: PUBLISHED Published: 2024-07-12T06:00:05.434Z Last Updated: 2024-08-01T19:18:48.239Z Vendors: Unknown Products: socialdriver-framework Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The socialdriver-framework WordPress plugin before 2024.04.30 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://wpscan.com/vulnerability/b6e64af0-adeb-4e28-9a81-f4024b0446ee/
CVE ID: CVE-2024-2697 State: PUBLISHED Published: 2024-05-17T06:00:01.759Z Last Updated: 2024-08-01T19:18:48.397Z Vendors: Unknown Products: socialdriver-framework Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The socialdriver-framework WordPress plugin before 2024.0.0 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://wpscan.com/vulnerability/c430b30d-61db-45f5
tes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://wpscan.com/vulnerability/c430b30d-61db-45f5-8499-91b491503b9c/
CVE ID: CVE-2024-2698 State: PUBLISHED Published: 2024-06-12T08:03:49.013Z Last Updated: 2025-11-20T07:13:20.455Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Red Hat Products: Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 8.8 Extended Update Support, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 9.2 Extended Update Support, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7 Problem Types: CWE-863 Description: A vulnerability was found in FreeIPA in how the initial implementation of MS-SFU by MIT Kerberos was missing a condition for granting the "forwardable" flag on S4U2Self tickets. Fixing this mistake required adding a special case for
ndition for granting the "forwardable" flag on S4U2Self tickets. Fixing this mistake required adding a special case for the check_allowed_to_delegate() function: If the target service argument is NULL, then it means the KDC is probing for general constrained delegation rules and not checking a specific S4U2Proxy request. In FreeIPA 4.11.0, the behavior of ipadb_match_acl() was modified to match the changes from upstream MIT Kerberos 1.20. However, a mistake resulting in this mechanism applies in cases where the target service argument is set AND where it is unset. This results in S4U2Proxy requests being accepted regardless of whether or not there is a matching service delegation rule. Addit
lts in S4U2Proxy requests being accepted regardless of whether or not there is a matching service delegation rule. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2024:3754 - https://access.redhat.com/errata/RHSA-2024:3755 - https://access.redhat.com/errata/RHSA-2024:3757 - https://access.redhat.com/errata/RHSA-2024:3759 - https://access.redhat.com/security/cve/CVE-2024-2698 - https://bugzilla.redhat.com/show_bug.cgi?id=2270353 - https://www.freeipa.org/release-notes/4-12-1.html
CVE ID: CVE-2024-2700 State: PUBLISHED Published: 2024-04-04T13:46:39.956Z Last Updated: 2025-11-07T10:50:22.276Z Severity: HIGH (CVSS 7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Red Hat Products: HawtIO 4.0.0 for Red Hat build of Apache Camel 4, Red Hat AMQ Streams 2.7.0, Red Hat build of Apicurio Registry 2.6.1 GA, Red Hat build of Quarkus 3.2.12.Final, Red Hat build of Quarkus 3.8.4.redhat, RHOSS-1.33-RHEL-8, Red Hat build of Apache Camel 4 for Quarkus 3, Red Hat build of Apache Camel - HawtIO 4, Red Hat Build of Keycloak, Red Hat build of OptaPlanner 8, Red Hat build of Quarkus, Red Hat Integration Camel K 1, Red Hat Integration Camel Quarkus 2 Problem Types: CWE-526 Descrip
Hat build of Quarkus, Red Hat Integration Camel K 1, Red Hat Integration Camel Quarkus 2 Problem Types: CWE-526 Description: A vulnerability was found in the quarkus-core component. Quarkus captures local environment variables from the Quarkus namespace during the application's build, therefore, running the resulting application inherits the values captured at build time. Some local environment variables may have been set by the developer or CI environment for testing purposes, such as dropping the database during application startup or trusting all TLS certificates to accept self-signed certificates. If these properties are configured using environment variables or the .env facility, they
ept self-signed certificates. If these properties are configured using environment variables or the .env facility, they are captured into the built application, which can lead to dangerous behavior if the application does not override these values. This behavior only happens for configuration properties from the `quarkus.*` namespace. Application-specific properties are not captured. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2024:11023 - https://access.redhat.com/errata/RHSA-2024:2106 - https://access.redhat.com/errata/RHSA-2024:2705 - https://access.redhat.com/errata/RHSA-2024:3527 - https://access.redhat.
tps://access.redhat.com/errata/RHSA-2024:2705 - https://access.redhat.com/errata/RHSA-2024:3527 - https://access.redhat.com/errata/RHSA-2024:4028 - https://access.redhat.com/errata/RHSA-2024:4873 - https://access.redhat.com/security/cve/CVE-2024-2700 - https://bugzilla.redhat.com/show_bug.cgi?id=2273281
CVE ID: CVE-2024-2702 State: PUBLISHED Published: 2024-03-20T09:36:45.118Z Last Updated: 2024-08-05T16:53:09.424Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H) Vendors: Olive Themes Products: Olive One Click Demo Import Problem Types: CWE-862 Description: Missing Authorization vulnerability in Olive Themes Olive One Click Demo Import allows importing settings and data, ultimately leading to XSS.This issue affects Olive One Click Demo Import: from n/a through 1.1.1. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/olive-one-click-demo-import/wordpress-olive-one-click-demo-import-plu
s: - https://patchstack.com/database/vulnerability/olive-one-click-demo-import/wordpress-olive-one-click-demo-import-plugin-1-1-1-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2024-2703 State: PUBLISHED Published: 2024-03-20T16:00:06.080Z Last Updated: 2024-08-21T23:00:23.349Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C) Vendors: Tenda Products: AC10U Problem Types: CWE-121 Description: A vulnerability classified as critical has been found in Tenda AC10U 15.03.06.49. Affected is the function formSetDeviceName of the file /goform/SetOnlineDevName. The manipulation of the argument mac leads to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-257454 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but
-257454 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.257454 - https://vuldb.com/?ctiid.257454 - https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/AC10U/v1.V15.03.06.49/more/formSetDeviceName_mac.md
CVE ID: CVE-2024-2704 State: PUBLISHED Published: 2024-03-20T16:00:07.684Z Last Updated: 2024-08-12T18:06:34.407Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C) Vendors: Tenda Products: AC10U Problem Types: CWE-121 Description: A vulnerability classified as critical was found in Tenda AC10U 15.03.06.49. Affected by this vulnerability is the function formSetFirewallCfg of the file /goform/SetFirewallCfg. The manipulation of the argument firewallEn leads to stack-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-257455. NOTE: The vendor was contacted early about thi
y be used. The associated identifier of this vulnerability is VDB-257455. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.257455 - https://vuldb.com/?ctiid.257455 - https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/AC10U/v1.V15.03.06.49/more/formSetFirewallCfg.md
CVE ID: CVE-2024-2705 State: PUBLISHED Published: 2024-03-20T16:31:04.186Z Last Updated: 2024-08-01T19:18:48.341Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C) Vendors: Tenda Products: AC10U Problem Types: CWE-121 Description: A vulnerability, which was classified as critical, has been found in Tenda AC10U 1.0/15.03.06.49. Affected by this issue is the function formSetQosBand of the file /goform/SetNetControlList. The manipulation of the argument list leads to stack-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-257456. NOTE: The vendor was contacted early about this dis
and may be used. The identifier of this vulnerability is VDB-257456. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.257456 - https://vuldb.com/?ctiid.257456 - https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/AC10U/v1.V15.03.06.49/more/formSetQosBand.md
CVE ID: CVE-2024-2706 State: PUBLISHED Published: 2024-03-20T16:31:05.842Z Last Updated: 2024-08-21T22:59:20.274Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C) Vendors: Tenda Products: AC10U Problem Types: CWE-121 Description: A vulnerability, which was classified as critical, was found in Tenda AC10U 15.03.06.49. This affects the function formWifiWpsStart of the file /goform/WifiWpsStart. The manipulation of the argument index leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-257457 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclo
ed. The identifier VDB-257457 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.257457 - https://vuldb.com/?ctiid.257457 - https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/AC10U/v1.V15.03.06.49/more/formWifiWpsStart.md
CVE ID: CVE-2024-2707 State: PUBLISHED Published: 2024-03-20T17:00:07.795Z Last Updated: 2024-08-21T23:00:43.030Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: Tenda Products: AC10U Problem Types: CWE-78 Description: A vulnerability has been found in Tenda AC10U 15.03.06.49 and classified as critical. This vulnerability affects the function formWriteFacMac of the file /goform/WriteFacMac. The manipulation of the argument mac leads to os command injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-257458 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but d
57458 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.257458 - https://vuldb.com/?ctiid.257458 - https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/AC10U/v1.V15.03.06.49/more/formWriteFacMac.md
CVE ID: CVE-2024-2708 State: PUBLISHED Published: 2024-03-20T17:31:04.520Z Last Updated: 2024-08-21T23:00:05.639Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C) Vendors: Tenda Products: AC10U Problem Types: CWE-121 Description: A vulnerability was found in Tenda AC10U 15.03.06.49 and classified as critical. This issue affects the function formexeCommand of the file /goform/execCommand. The manipulation of the argument cmdinput leads to stack-based buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-257459. NOTE: The vendor was contacted early about this disclosure but di