Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-35403 State: PUBLISHED Published: 2024-05-28T16:21:22.198Z Last Updated: 2025-02-13T15:58:44.191Z Vendors: n/a Products: n/a Problem Types: n/a Description: TOTOLINK CP900L v4.1.5cu.798_B20221228 was discovered to contain a stack overflow via the desc parameter in the function setIpPortFilterRules Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/s4ndw1ch136/IOT-vuln-reports/blob/main/TOTOLINK%20CP900L/setIpPortFilterRules/README.md
CVE ID: CVE-2024-35409 State: PUBLISHED Published: 2024-05-22T13:59:48.015Z Last Updated: 2025-02-13T15:58:44.746Z Vendors: n/a Products: n/a Problem Types: n/a Description: WeBid 1.1.2 is vulnerable to SQL Injection via admin/tax.php. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/ixpqxi/CVE_LIST/blob/master/WeBid_sqli/WeBid_v1.1.2_sql_injection_vulnerability.md
CVE ID: CVE-2024-35410 State: PUBLISHED Published: 2024-11-08T00:00:00 Last Updated: 2024-11-18T14:58:01.105Z Vendors: n/a Products: n/a Problem Types: n/a Description: wac commit 385e1 was discovered to contain a heap overflow via the interpret function at /wac-asan/wa.c. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted wasm file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/kanaka/wac/issues/17 - https://gist.github.com/haruki3hhh/f686e1d517e8f5d1281b02e633129522
CVE ID: CVE-2024-35418 State: PUBLISHED Published: 2024-11-08T00:00:00 Last Updated: 2024-11-18T14:51:43.208Z Vendors: n/a Products: n/a Problem Types: n/a Description: wac commit 385e1 was discovered to contain a heap overflow via the setup_call function at /wac-asan/wa.c. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted wasm file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/kanaka/wac/issues/19 - https://gist.github.com/haruki3hhh/29237c52bd0cc30e3cc906f0af221b09
CVE ID: CVE-2024-35419 State: PUBLISHED Published: 2024-11-08T00:00:00 Last Updated: 2024-11-18T14:49:37.889Z Vendors: n/a Products: n/a Problem Types: n/a Description: wac commit 385e1 was discovered to contain a heap overflow via the load_module function at /wac-asan/wa.c. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted wasm file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/kanaka/wac/issues/18 - https://gist.github.com/haruki3hhh/8b9e1922083abef33a9024017eb2b9fe
CVE ID: CVE-2024-35420 State: PUBLISHED Published: 2024-11-08T00:00:00 Last Updated: 2024-11-18T14:58:00.959Z Vendors: n/a Products: n/a Problem Types: n/a Description: wac commit 385e1 was discovered to contain a heap overflow. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/kanaka/wac/issues/20 - https://gist.github.com/haruki3hhh/ebabc705fb04aff38c600f2b63601aae
CVE ID: CVE-2024-35421 State: PUBLISHED Published: 2024-11-08T00:00:00 Last Updated: 2024-11-12T15:21:24.879Z Vendors: n/a Products: n/a Problem Types: n/a Description: vmir e8117 was discovered to contain a segmentation violation via the wasm_parse_block function at /src/vmir_wasm_parser.c. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/andoma/vmir/issues/22 - https://gist.github.com/haruki3hhh/318c4e35531f9e3b01df51016ac5c12b
CVE ID: CVE-2024-35422 State: PUBLISHED Published: 2024-11-08T00:00:00.000Z Last Updated: 2025-03-14T15:47:10.397Z Vendors: n/a Products: n/a Problem Types: n/a Description: vmir e8117 was discovered to contain a heap buffer overflow via the wasm_call function at /src/vmir_wasm_parser.c. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/andoma/vmir/issues/23 - https://gist.github.com/haruki3hhh/21f9ad538db2a98e651cfe34ba4176f3
CVE ID: CVE-2024-35423 State: PUBLISHED Published: 2024-11-08T00:00:00 Last Updated: 2024-11-12T15:29:47.167Z Vendors: n/a Products: n/a Problem Types: n/a Description: vmir e8117 was discovered to contain a heap buffer overflow via the wasm_parse_section_functions function at /src/vmir_wasm_parser.c. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/andoma/vmir/issues/18 - https://gist.github.com/haruki3hhh/32fd20583f2008e6b68caaaaf4ecf237
CVE ID: CVE-2024-35424 State: PUBLISHED Published: 2024-11-08T00:00:00 Last Updated: 2024-11-12T15:26:15.577Z Vendors: n/a Products: n/a Problem Types: n/a Description: vmir e8117 was discovered to contain a segmentation violation via the import_function function at /src/vmir_wasm_parser.c. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/andoma/vmir/issues/21 - https://gist.github.com/haruki3hhh/58fa3df36ca7d0c972c7481cf80ffd80
CVE ID: CVE-2024-35425 State: PUBLISHED Published: 2024-11-08T00:00:00.000Z Last Updated: 2025-03-24T16:01:19.311Z Vendors: n/a Products: n/a Problem Types: n/a Description: vmir e8117 was discovered to contain a segmentation violation via the function_prepare_parse function at /src/vmir_function.c. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/andoma/vmir/issues/19 - https://gist.github.com/haruki3hhh/c64ff6431c71be1b08e15d4ff480ce6b
CVE ID: CVE-2024-35426 State: PUBLISHED Published: 2024-11-08T00:00:00.000Z Last Updated: 2025-03-18T15:13:30.801Z Vendors: n/a Products: n/a Problem Types: n/a Description: vmir e8117 was discovered to contain a stack overflow via the init_local_vars function at /src/vmir_wasm_parser.c. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/andoma/vmir/issues/24 - https://gist.github.com/haruki3hhh/9d2a5a139a8b72517009953d0ba7338c
CVE ID: CVE-2024-35427 State: PUBLISHED Published: 2024-11-08T00:00:00 Last Updated: 2024-11-12T15:05:25.236Z Vendors: n/a Products: n/a Problem Types: n/a Description: vmir e8117 was discovered to contain a segmentation violation via the export_function function at /src/vmir_wasm_parser.c. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/andoma/vmir/issues/20 - https://gist.github.com/haruki3hhh/1edba199c52039791bbcb33a5196c1c3
CVE ID: CVE-2024-35428 State: PUBLISHED Published: 2024-05-30T17:02:20.057Z Last Updated: 2025-03-13T14:11:39.005Z Vendors: n/a Products: n/a Problem Types: n/a Description: ZKTeco ZKBio CVSecurity 6.1.1 is vulnerable to Directory Traversal via BaseMediaFile. An authenticated user can delete local files from the server which can lead to DoS. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/mrojz/ZKT-Bio-CVSecurity/blob/main/CVE-2024-35428.md
CVE ID: CVE-2024-35429 State: PUBLISHED Published: 2024-05-30T16:20:53.690Z Last Updated: 2025-02-13T15:58:45.802Z Vendors: n/a Products: n/a Problem Types: n/a Description: ZKTeco ZKBio CVSecurity 6.1.1 is vulnerable to Directory Traversal via eventRecord. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/mrojz/ZKT-Bio-CVSecurity/blob/main/CVE-2024-35429.md
CVE ID: CVE-2024-35430 State: PUBLISHED Published: 2024-05-30T15:55:46.314Z Last Updated: 2025-07-09T16:13:55.376Z Vendors: n/a Products: n/a Problem Types: n/a Description: In ZKTeco ZKBio CVSecurity v6.1.1_R and earlier (fixed in 6.1.3_R) an authenticated user can bypass password checks while exporting data from the application. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/mrojz/ZKT-Bio-CVSecurity/blob/main/CVE-2024-35430.md - https://www.zkteco.com/en/Security_Bulletinsibs/16
CVE ID: CVE-2024-35431 State: PUBLISHED Published: 2024-05-30T16:10:50.419Z Last Updated: 2025-05-15T21:17:59.787Z Vendors: n/a Products: n/a Problem Types: n/a Description: ZKTeco ZKBio CVSecurity 6.1.1 is vulnerable to Directory Traversal via photoBase64. An unauthenticated user can download local files from the server. NOTE: Third parties have indicated other versions are also vulnerable including up to 6.4.1. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/mrojz/ZKT-Bio-CVSecurity/blob/main/CVE-2024-35431.md
CVE ID: CVE-2024-35432 State: PUBLISHED Published: 2024-05-30T16:05:05.907Z Last Updated: 2025-02-13T15:58:47.446Z Vendors: n/a Products: n/a Problem Types: n/a Description: ZKTeco ZKBio CVSecurity 6.1.1 is vulnerable to Cross Site Scripting (XSS) via an Audio File. An authenticated user can injection malicious JavaScript code to trigger a Cross Site Scripting. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/mrojz/ZKT-Bio-CVSecurity/blob/main/CVE-2024-35432.md
CVE ID: CVE-2024-35433 State: PUBLISHED Published: 2024-05-30T17:10:57.858Z Last Updated: 2025-02-13T15:58:48.055Z Vendors: n/a Products: n/a Problem Types: n/a Description: ZKTeco ZKBio CVSecurity 6.1.1 is vulnerable to Incorrect Access Control. An authenticated user, without the permissions of managing users, can create a new admin user. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/mrojz/ZKT-Bio-CVSecurity/blob/main/CVE-2024-35433.md
CVE ID: CVE-2024-35434 State: PUBLISHED Published: 2024-05-29T19:06:12.561Z Last Updated: 2025-02-13T15:58:48.588Z Vendors: n/a Products: n/a Problem Types: n/a Description: Irontec Sngrep v1.8.1 was discovered to contain a heap buffer overflow via the function rtp_check_packet at /sngrep/src/rtp.c. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted SIP packet. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/inputzero/Security-Advisories/blob/main/CVE-XXXX-XXXX.md
CVE ID: CVE-2024-35451 State: PUBLISHED Published: 2024-11-29T00:00:00 Last Updated: 2024-12-02T19:35:23.576Z Vendors: n/a Products: n/a Problem Types: n/a Description: LinkStack 2.7.9 through 4.7.7 allows resources\views\components\favicon.blade.php link SSRF. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://datafarm.co.th/blog/CVE-2024-35451:-From-%28Authenticated%29-SSRF-to-Remote-Code-Execution
CVE ID: CVE-2024-35468 State: PUBLISHED Published: 2024-05-30T17:17:28.654Z Last Updated: 2025-02-13T15:58:49.150Z Vendors: n/a Products: n/a Problem Types: n/a Description: A SQL injection vulnerability in /hrm/index.php in SourceCodester Human Resource Management System 1.0 allows attackers to execute arbitrary SQL commands via the password parameter. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.sourcecodester.com/php/15740/human-resource-management-system-project-php-and-mysql-free-source-code.html - https://github.com/dovankha/CVE-2024-35468
CVE ID: CVE-2024-35469 State: PUBLISHED Published: 2024-05-30T17:20:11.099Z Last Updated: 2025-02-13T15:58:49.715Z Vendors: n/a Products: n/a Problem Types: n/a Description: A SQL injection vulnerability in /hrm/user/ in SourceCodester Human Resource Management System 1.0 allows attackers to execute arbitrary SQL commands via the password parameter. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.sourcecodester.com/php/15740/human-resource-management-system-project-php-and-mysql-free-source-code.html - https://github.com/dovankha/CVE-2024-35469
CVE ID: CVE-2024-35474 State: PUBLISHED Published: 2024-06-10T00:00:00 Last Updated: 2024-10-29T14:32:57.761Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AC:L/AV:N/A:N/C:H/I:N/PR:L/S:U/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: A Directory Traversal vulnerability in iceice666 ResourcePack Server before v1.0.8 allows a remote attacker to disclose files on the server, via setPath in ResourcePackFileServer.kt. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gist.github.com/apple502j/e99ca3a00e492bf1c942214b13213b46
CVE ID: CVE-2024-35475 State: PUBLISHED Published: 2024-05-22T13:49:59.533Z Last Updated: 2025-02-13T15:58:50.231Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Cross-Site Request Forgery (CSRF) vulnerability was discovered in OpenKM Community Edition on or before version 6.3.12. The vulnerability exists in /admin/DatabaseQuery, which allows an attacker to manipulate a victim with administrative privileges to execute arbitrary SQL commands. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/carsonchan12345/OpenKM-CSRF-PoC - https://github.com/carsonchan12345/CVE-2024-35475
CVE ID: CVE-2024-35492 State: PUBLISHED Published: 2024-05-29T19:27:15.910Z Last Updated: 2025-02-13T15:58:50.799Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cesanta Mongoose commit b316989 was discovered to contain a NULL pointer dereference via the scpy function at src/fmt.c. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted MQTT packet. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/zzh-newlearner/MQTT_Crash/blob/main/Mongoose_null_pointer.md
CVE ID: CVE-2024-35495 State: PUBLISHED Published: 2024-09-30T00:00:00 Last Updated: 2024-10-30T14:13:59.247Z Vendors: n/a Products: n/a Problem Types: n/a Description: An Information Disclosure vulnerability in the Telemetry component in TP-Link Kasa KP125M V1.0.0 and Tapo P125M 1.0.0 Build 220930 Rel.143947 allows attackers to observe device state via observing network traffic. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Chapoly1305/tp-link-cve/blob/main/CVE-2024-35495.md
CVE ID: CVE-2024-35498 State: PUBLISHED Published: 2025-01-06T00:00:00 Last Updated: 2025-01-07T15:43:09.166Z Vendors: n/a Products: n/a Problem Types: n/a Description: A cross-site scripting (XSS) vulnerability in Grav v1.7.45 allows attackers to execute arbitrary web scripts or HTML via a crafted payload. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/r4vanan/Stored-xss-Grav-v1.7.45 - https://r4vanan.medium.com/a-quick-dive-into-xss-vulnerability-in-grav-cms-v1-7-45-cve-2024-35498-fc236b7d74a0
CVE ID: CVE-2024-35504 State: PUBLISHED Published: 2024-05-30T15:01:10.677Z Last Updated: 2025-03-27T19:34:36.103Z Vendors: n/a Products: n/a Problem Types: n/a Description: A cross-site scripting (XSS) vulnerability in the login page of FineSoft v8.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the URL:errorname parameter after a failed login attempt. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/dabaizhizhu/123/issues/1
CVE ID: CVE-2024-35510 State: PUBLISHED Published: 2024-05-28T19:35:21.599Z Last Updated: 2025-02-13T15:58:51.921Z Vendors: n/a Products: n/a Problem Types: n/a Description: An arbitrary file upload vulnerability in /dede/file_manage_control.php of DedeCMS v5.7.114 allows attackers to execute arbitrary code via uploading a crafted file. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/QianGeG/CVE/issues/14
CVE ID: CVE-2024-35511 State: PUBLISHED Published: 2024-05-28T20:35:52.644Z Last Updated: 2025-02-13T15:58:52.409Z Vendors: n/a Products: n/a Problem Types: n/a Description: phpgurukul Men Salon Management System v2.0 is vulnerable to SQL Injection via the "username" parameter of /msms/admin/index.php. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/efekaanakkar/CVE-2024-35511/blob/main/Men%20Salon%20Management%20System%20Using%20PHP%20and%20MySQL.md
CVE ID: CVE-2024-35512 State: PUBLISHED Published: 2024-05-29T16:55:34.086Z Last Updated: 2025-03-26T21:23:57.142Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in hmq v1.5.5 allows attackers to cause a Denial of Service (DoS) via crafted requests. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gist.github.com/pengwGit/6ccca73a5acf91f31ff0d4185b15a3ea
CVE ID: CVE-2024-35515 State: PUBLISHED Published: 2024-09-18T00:00:00 Last Updated: 2024-09-18T19:00:10.214Z Vendors: n/a Products: n/a Problem Types: n/a Description: Insecure deserialization in sqlitedict up to v2.1.0 allows attackers to execute arbitrary code. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/piskvorky/sqlitedict/ - https://wha13.github.io/2024/06/13/mfcve/
CVE ID: CVE-2024-35517 State: PUBLISHED Published: 2024-10-11T00:00:00.000Z Last Updated: 2025-03-13T16:18:40.263Z Severity: HIGH (CVSS 8.4 CVSS:3.1/AC:L/AV:A/A:H/C:H/I:H/PR:H/S:C/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: Netgear XR1000 v1.0.0.64 is vulnerable to command injection in usb_remote_smb_conf.cgi via the share_name parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/consrc/cves/blob/main/CVE-2024-35517.md
CVE ID: CVE-2024-35518 State: PUBLISHED Published: 2024-10-14T00:00:00.000Z Last Updated: 2025-03-19T14:14:57.133Z Severity: HIGH (CVSS 8.4 CVSS:3.1/AC:L/AV:A/A:H/C:H/I:H/PR:H/S:C/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: Netgear EX6120 v1.0.0.68 is vulnerable to Command Injection in genie_fix2.cgi via the wan_dns1_pri parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/consrc/cves/blob/main/CVE-2024-35518.md
CVE ID: CVE-2024-35519 State: PUBLISHED Published: 2024-10-14T00:00:00.000Z Last Updated: 2025-03-17T15:27:55.834Z Severity: HIGH (CVSS 8.4 CVSS:3.1/AC:L/AV:A/A:H/C:H/I:H/PR:H/S:C/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: Netgear EX6120 v1.0.0.68, Netgear EX6100 v1.0.2.28, and Netgear EX3700 v1.0.0.96 are vulnerable to command injection in operating_mode.cgi via the ap_mode parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/consrc/cves/blob/main/CVE-2024-35519.md
CVE ID: CVE-2024-35520 State: PUBLISHED Published: 2024-10-14T00:00:00 Last Updated: 2024-10-15T14:23:36.216Z Severity: HIGH (CVSS 8.4 CVSS:3.1/AC:L/AV:A/A:H/C:H/I:H/PR:H/S:C/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: Netgear R7000 1.0.11.136 is vulnerable to Command Injection in RMT_invite.cgi via device_name2 parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://kb.netgear.com/000066027/Security-Advisory-for-Post-Authentication-Command-Injection-on-the-R7000-PSV-2023-0154
CVE ID: CVE-2024-35522 State: PUBLISHED Published: 2024-10-11T00:00:00.000Z Last Updated: 2025-03-13T16:22:22.580Z Severity: HIGH (CVSS 8.4 CVSS:3.1/AC:L/AV:A/A:H/C:H/I:H/PR:H/S:C/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: Netgear EX3700 ' AC750 WiFi Range Extender Essentials Edition before 1.0.0.98 contains an authenticated command injection in operating_mode.cgi via the ap_mode parameter with ap_24g_manual set to 1 and ap_24g_manual_sec set to NotNone. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/consrc/cves/blob/main/CVE-2024-35522.md
CVE ID: CVE-2024-35526 State: PUBLISHED Published: 2024-06-25T00:00:00 Last Updated: 2024-11-07T20:37:01.691Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in Daemon PTY Limited FarCry Core framework before 7.2.14 allows attackers to access sensitive information in the /facade directory. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://bastionsecurity.co.nz/advisories/farcry-core-multiple.html
CVE ID: CVE-2024-35527 State: PUBLISHED Published: 2024-06-25T00:00:00 Last Updated: 2024-08-12T18:23:29.608Z Vendors: n/a Products: n/a Problem Types: n/a Description: An arbitrary file upload vulnerability in /fileupload/upload.cfm in Daemon PTY Limited FarCry Core framework before 7.2.14 allows attackers to execute arbitrary code via uploading a crafted .cfm file. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://bastionsecurity.co.nz/advisories/farcry-core-multiple.html
CVE ID: CVE-2024-35532 State: PUBLISHED Published: 2025-01-07T00:00:00 Last Updated: 2025-01-08T14:58:56.489Z Vendors: n/a Products: n/a Problem Types: n/a Description: An XML External Entity (XXE) injection vulnerability in Intersec Geosafe-ea 2022.12, 2022.13, and 2022.14 allows attackers to perform arbitrary file reading under the privileges of the running process, make SSRF requests, or cause a Denial of Service (DoS) via unspecified vectors. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/post-cyberlabs/CVE-Advisory/blob/main/CVE-2024-35532.pdf - https://intersec.com/public-safety
CVE ID: CVE-2024-35537 State: PUBLISHED Published: 2024-06-21T00:00:00.000Z Last Updated: 2025-03-13T14:22:55.888Z Vendors: n/a Products: n/a Problem Types: n/a Description: TVS Motor Company Limited TVS Connect Android v4.6.0 and IOS v5.0.0 was discovered to insecurely handle the RSA key pair, allowing attackers to possibly access sensitive information via decryption. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/aaravavi/TVS-Connect-Application-VAPT
CVE ID: CVE-2024-35538 State: PUBLISHED Published: 2024-08-19T00:00:00 Last Updated: 2024-08-20T13:23:21.256Z Vendors: n/a Products: n/a Problem Types: n/a Description: Typecho v1.3.0 was discovered to contain a Client IP Spoofing vulnerability, which allows attackers to falsify their IP addresses by specifying an arbitrary IP as value of X-Forwarded-For or Client-Ip headers while performing HTTP requests. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://typecho.org - https://cyberaz0r.info/2024/08/typecho-multiple-vulnerabilities/
CVE ID: CVE-2024-35539 State: PUBLISHED Published: 2024-08-19T00:00:00 Last Updated: 2024-08-21T14:07:18.801Z Vendors: n/a Products: n/a Problem Types: n/a Description: Typecho v1.3.0 was discovered to contain a race condition vulnerability in the post commenting function. This vulnerability allows attackers to post several comments before the spam protection checks if the comments are posted too frequently. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://typecho.org - https://cyberaz0r.info/2024/08/typecho-multiple-vulnerabilities/
CVE ID: CVE-2024-35540 State: PUBLISHED Published: 2024-08-20T00:00:00 Last Updated: 2024-08-20T15:13:12.575Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stored cross-site scripting (XSS) vulnerability in Typecho v1.3.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cyberaz0r.info/2024/08/typecho-multiple-vulnerabilities/
CVE ID: CVE-2024-35545 State: PUBLISHED Published: 2024-06-26T00:00:00 Last Updated: 2024-11-01T14:12:14.139Z Vendors: n/a Products: n/a Problem Types: n/a Description: MAP-OS v4.45.0 and earlier was discovered to contain a cross-site scripting (XSS) vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://portswigger.net/web-security/cross-site-scripting/stored - https://github.com/RamonSilva20/mapos/tree/master - https://github.com/RamonSilva20/mapos/commit/3559bae4782162faab94670f503fd35b0f331929
CVE ID: CVE-2024-35548 State: PUBLISHED Published: 2024-05-28T20:25:46.745Z Last Updated: 2025-02-13T15:58:53.499Z Vendors: n/a Products: n/a Problem Types: n/a Description: A SQL injection vulnerability in Mybatis plus versions below 3.5.6 allows remote attackers to obtain database information via a Boolean blind injection. NOTE: the vendor's position is that this can only occur in a misconfigured application; the documentation discusses how to develop applications that avoid SQL injection. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/baomidou/mybatis-plus/issues/6167 - https://baomidou.com/reference/about-cve/