Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.290231 - https://vuldb.com/?ctiid.290231 - https://vuldb.com/?submit.469217 - https://github.com/ZeroWdd/manager-system/issues/7
CVE ID: CVE-2024-13144 State: PUBLISHED Published: 2025-01-06T00:00:13.019Z Last Updated: 2025-01-06T13:40:54.938Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: zhenfeng13 Products: My-Blog Problem Types: CWE-434, CWE-284 Description: A vulnerability classified as critical has been found in zhenfeng13 My-Blog 1.0. Affected is the function uploadFileByEditomd of the file src/main/java/com/site/blog/my/core/controller/admin/BlogController.java. The manipulation of the argument editormd-image-file leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichme
remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.290232 - https://vuldb.com/?ctiid.290232 - https://vuldb.com/?submit.469220 - https://github.com/ZHENFENG13/My-Blog/issues/140 - https://github.com/ZHENFENG13/My-Blog/issues/140#issue-2759813820
CVE ID: CVE-2024-13145 State: PUBLISHED Published: 2025-01-06T00:31:04.715Z Last Updated: 2025-01-06T13:40:18.510Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: zhenfeng13 Products: My-Blog Problem Types: CWE-434, CWE-284 Description: A vulnerability classified as critical was found in zhenfeng13 My-Blog 1.0. Affected by this vulnerability is the function upload of the file src/main/java/com/site/blog/my/core/controller/admin/uploadController. java. The manipulation of the argument file leads to unrestricted upload. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: -
ploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.290233 - https://vuldb.com/?ctiid.290233 - https://vuldb.com/?submit.469221 - https://github.com/ZHENFENG13/My-Blog/issues/141 - https://github.com/ZHENFENG13/My-Blog/issues/141#issue-2759820153
CVE ID: CVE-2024-13146 State: PUBLISHED Published: 2025-03-26T06:00:08.756Z Last Updated: 2025-03-26T18:56:41.837Z Vendors: Unknown Products: Booknetic Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The Booknetic WordPress plugin before 4.1.5 does not have CSRF check when creating Staff accounts, which could allow attackers to make logged in admin add arbitrary Staff members via a CSRF attack Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/19cb40dd-53b0-46db-beb0-1841e385ce09/
CVE ID: CVE-2024-13147 State: PUBLISHED Published: 2025-03-05T14:06:04.447Z Last Updated: 2025-03-05T14:49:06.799Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Merkur Software Products: B2B Login Panel Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Merkur Software B2B Login Panel allows SQL Injection.This issue affects B2B Login Panel: before 15.01.2025. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.usom.gov.tr/bildirim/tr-25-0054
CVE ID: CVE-2024-13148 State: PUBLISHED Published: 2025-02-27T14:22:57.780Z Last Updated: 2025-02-27T14:39:48.128Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Yukseloglu Filter Products: B2B Login Platform Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Yukseloglu Filter B2B Login Platform allows SQL Injection.This issue affects B2B Login Platform: before 16.01.2025. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.usom.gov.tr/bildirim/tr-25-0045
CVE ID: CVE-2024-13149 State: PUBLISHED Published: 2025-09-16T14:09:07.104Z Last Updated: 2025-09-23T07:28:23.573Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Arma Store Products: Armalife Problem Types: CWE-89, CWE - 200 - Exposure of Sensitive Information to an Unauthorized Actor Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'), CWE - 200 - Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Arma Store Armalife allows SQL Injection.This issue affects Armalife: through 20250916. NOTE: The vendor did not inform about the completion of the fixing process within the specified time.
through 20250916. NOTE: The vendor did not inform about the completion of the fixing process within the specified time. The CVE will be updated when new information becomes available. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.usom.gov.tr/bildirim/tr-25-0258
CVE ID: CVE-2024-13150 State: PUBLISHED Published: 2025-09-29T12:59:48.575Z Last Updated: 2025-09-29T13:59:16.892Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Fayton Software and Consulting Services Products: fayton.pro ERP Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Fayton Software and Consulting Services fayton.Pro ERP allows SQL Injection.This issue affects fayton.Pro ERP: through 20250929. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.usom.gov.tr/bildirim/tr-25-0304
CVE ID: CVE-2024-13151 State: PUBLISHED Published: 2025-09-18T11:56:28.863Z Last Updated: 2025-10-03T12:19:32.604Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: ESBI Information and Telecommunication Industry and Trade Limited Company Products: Auto Service Software Problem Types: CWE - 89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Description: CWE - 89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ESBI Information and Telecommunication Industry and Trade Limited Company Auto Service Software allows SQL Injection.This issue affects Auto Service Software:
Industry and Trade Limited Company Auto Service Software allows SQL Injection.This issue affects Auto Service Software: before v.2025.10.01. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.usom.gov.tr/bildirim/tr-25-0273
CVE ID: CVE-2024-13152 State: PUBLISHED Published: 2025-02-14T13:01:44.625Z Last Updated: 2025-10-14T12:23:31.044Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: BSS Software Products: Mobuy Online Machinery Monitoring Panel Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in BSS Software Mobuy Online Machinery Monitoring Panel allows SQL Injection.This issue affects Mobuy Online Machinery Monitoring Panel: before 2.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.usom.gov.tr/bildirim/tr-25-0033
CVE ID: CVE-2024-13153 State: PUBLISHED Published: 2025-01-09T08:24:24.442Z Last Updated: 2025-01-09T15:17:35.410Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: unitecms Products: Unlimited Elements For Elementor Problem Types: CWE-79 Description: The Unlimited Elements For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple widgets in all versions up to, and including, 1.5.135 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenev
ed attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Note: Since the widget code isn't part of the code, to apply the patch, the affected widgets: Image Tooltip, Notification, Simple Popup, Video Play Button, and Card Carousel, must be deleted and reinstalled manually. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/99625a3e-b8a4-42f8-8996-f7c5c0ff2d5f?source=cve - https://wordpress.org/plugins/unlimited-elements-for-elementor/#developers - https://unlimited-elements.com/change-log/
CVE ID: CVE-2024-13154 State: REJECTED Published: N/A Last Updated: 2025-01-13T20:38:41.327Z Description: No description available.
CVE ID: CVE-2024-13155 State: PUBLISHED Published: 2025-02-20T07:33:37.200Z Last Updated: 2025-02-20T16:12:05.996Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: unitecms Products: Unlimited Elements For Elementor Problem Types: CWE-79 Description: The Unlimited Elements For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Transparent Split Hero widget in all versions up to, and including, 1.5.140 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in page
t possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Note: Since the widget code isn't part of the code base, to apply the patch, the affected widget: Transparent Split Hero must be deleted and reinstalled manually. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/63ba4880-9fbb-42e3-a8db-8115eb832b13?source=cve - https://unlimited-elements.com/change-log/ - https://wordpress.org/plugins/unlimited-elements-for-elementor/#developers
CVE ID: CVE-2024-13156 State: PUBLISHED Published: 2025-01-14T08:23:14.833Z Last Updated: 2025-01-14T14:45:23.115Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: bplugins Products: HTML5 Video Player – mp4 Video Player Plugin and Block Problem Types: CWE-79 Description: The HTML5 Video Player – mp4 Video Player Plugin and Block plugin for WordPress is vulnerable to DOM-Based Stored Cross-Site Scripting via the ‘heading’ parameter in all versions up to, and including, 2.5.35 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts i
akes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/e0b26af2-d559-49bf-841a-1974360b3ad6?source=cve - https://plugins.trac.wordpress.org/browser/html5-video-player/trunk/dist/frontend.js - https://wordpress.org/plugins/html5-video-player/#developers - https://plugins.trac.wordpress.org/changeset/3221089/
CVE ID: CVE-2024-13157 State: PUBLISHED Published: 2025-01-31T08:21:24.532Z Last Updated: 2025-01-31T19:34:36.747Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: sonaar Products: MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar Problem Types: CWE-79 Description: The MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Podcast RSS Feed in all versions up to, and including, 5.9.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to
er supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/547325ad-0b01-42d5-b47c-362044587395?source=cve - https://plugins.trac.wordpress.org/browser/mp3-music-player-by-sonaar/trunk/includes/class-sonaar-music-widget.php#L1733 - https://wordpress.org/plugins/mp3-music-player-by-sonaar/#developers - https://plugins.trac.wordpress.org/changeset/3231414/
CVE ID: CVE-2024-13158 State: PUBLISHED Published: 2025-01-14T17:13:29.275Z Last Updated: 2025-01-24T04:55:50.063Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Ivanti Products: Endpoint Manager Problem Types: CWE-426, CWE-22 Description: An unbounded resource search path in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote authenticated attacker with admin privileges to achieve remote code execution. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://forums.ivanti.com/s/article/Security-Advisory-EPM-January-2025-for-EPM-2024-and-EPM-2022-SU6
CVE ID: CVE-2024-13159 State: PUBLISHED Published: 2025-01-14T17:12:57.652Z Last Updated: 2025-10-21T22:55:32.248Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Ivanti Products: Endpoint Manager Problem Types: CWE-36 Description: Absolute path traversal in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote unauthenticated attacker to leak sensitive information. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://forums.ivanti.com/s/article/Security-Advisory-EPM-January-2025-for-EPM-2024-and-EPM-2022-SU6
CVE ID: CVE-2024-13160 State: PUBLISHED Published: 2025-01-14T17:12:23.237Z Last Updated: 2025-10-21T22:55:32.382Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Ivanti Products: Endpoint Manager Problem Types: CWE-36 Description: Absolute path traversal in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote unauthenticated attacker to leak sensitive information. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://forums.ivanti.com/s/article/Security-Advisory-EPM-January-2025-for-EPM-2024-and-EPM-2022-SU6
CVE ID: CVE-2024-13161 State: PUBLISHED Published: 2025-01-14T17:11:32.061Z Last Updated: 2025-10-21T22:55:32.564Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Ivanti Products: Endpoint Manager Problem Types: CWE-36 Description: Absolute path traversal in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote unauthenticated attacker to leak sensitive information. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://forums.ivanti.com/s/article/Security-Advisory-EPM-January-2025-for-EPM-2024-and-EPM-2022-SU6
CVE ID: CVE-2024-13162 State: PUBLISHED Published: 2025-01-14T17:23:48.256Z Last Updated: 2025-01-24T04:55:58.303Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Ivanti Products: Endpoint Manager Problem Types: CWE-89 Description: SQL injection in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote authenticated attacker with admin privileges to achieve remote code execution. This CVE addresses incomplete fixes from CVE-2024-32848. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://forums.ivanti.com/s/article/Security-Advisory-EPM-January-2025-for-EPM-2024-and-EPM-2022-SU6
CVE ID: CVE-2024-13163 State: PUBLISHED Published: 2025-01-14T17:23:13.781Z Last Updated: 2025-01-24T04:55:56.946Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Ivanti Products: Endpoint Manager Problem Types: CWE-502 Description: Deserialization of untrusted data in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote unauthenticated attacker to achieve remote code execution. Local user interaction is required. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://forums.ivanti.com/s/article/Security-Advisory-EPM-January-2025-for-EPM-2024-and-EPM-2022-SU6
CVE ID: CVE-2024-13164 State: PUBLISHED Published: 2025-01-14T17:22:49.382Z Last Updated: 2025-01-24T04:55:55.615Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Ivanti Products: Endpoint Manager Problem Types: CWE-908 Description: An uninitialized resource in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a local authenticated attacker to escalate their privileges. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://forums.ivanti.com/s/article/Security-Advisory-EPM-January-2025-for-EPM-2024-and-EPM-2022-SU6
CVE ID: CVE-2024-13165 State: PUBLISHED Published: 2025-01-14T17:22:15.933Z Last Updated: 2025-01-15T15:19:52.577Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Ivanti Products: Endpoint Manager Problem Types: CWE-787 Description: An out-of-bounds write in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote unauthenticated attacker to cause a denial of service. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://forums.ivanti.com/s/article/Security-Advisory-EPM-January-2025-for-EPM-2024-and-EPM-2022-SU6
CVE ID: CVE-2024-13166 State: PUBLISHED Published: 2025-01-14T17:20:19.876Z Last Updated: 2025-01-15T15:20:00.615Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Ivanti Products: Endpoint Manager Problem Types: CWE-787 Description: An out-of-bounds write in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote unauthenticated attacker to cause a denial of service. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://forums.ivanti.com/s/article/Security-Advisory-EPM-January-2025-for-EPM-2024-and-EPM-2022-SU6
CVE ID: CVE-2024-13167 State: PUBLISHED Published: 2025-01-14T17:19:43.062Z Last Updated: 2025-01-16T21:19:20.404Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Ivanti Products: Endpoint Manager Problem Types: CWE-787 Description: An out-of-bounds write in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote unauthenticated attacker to cause a denial of service. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://forums.ivanti.com/s/article/Security-Advisory-EPM-January-2025-for-EPM-2024-and-EPM-2022-SU6
CVE ID: CVE-2024-13168 State: PUBLISHED Published: 2025-01-14T17:19:00.787Z Last Updated: 2025-01-16T21:18:56.082Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Ivanti Products: Endpoint Manager Problem Types: CWE-787 Description: An out-of-bounds write in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote unauthenticated attacker to cause a denial of service. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://forums.ivanti.com/s/article/Security-Advisory-EPM-January-2025-for-EPM-2024-and-EPM-2022-SU6
CVE ID: CVE-2024-13169 State: PUBLISHED Published: 2025-01-14T17:18:28.069Z Last Updated: 2025-01-24T04:55:54.205Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Ivanti Products: Endpoint Manager Problem Types: CWE-125, CWE-843 Description: An out-of-bounds read in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a local authenticated attacker to escalate their privileges. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://forums.ivanti.com/s/article/Security-Advisory-EPM-January-2025-for-EPM-2024-and-EPM-2022-SU6
CVE ID: CVE-2024-13170 State: PUBLISHED Published: 2025-01-14T17:17:50.470Z Last Updated: 2025-01-16T21:17:15.067Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Ivanti Products: Endpoint Manager Problem Types: CWE-787 Description: An out-of-bounds write in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote unauthenticated attacker to cause a denial of service. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://forums.ivanti.com/s/article/Security-Advisory-EPM-January-2025-for-EPM-2024-and-EPM-2022-SU6
CVE ID: CVE-2024-13171 State: PUBLISHED Published: 2025-01-14T17:16:48.419Z Last Updated: 2025-01-24T04:55:52.846Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Ivanti Products: Endpoint Manager Problem Types: CWE-434 Description: Insufficient filename validation in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote unauthenticated attacker to achieve remote code execution. Local user interaction is required. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://forums.ivanti.com/s/article/Security-Advisory-EPM-January-2025-for-EPM-2024-and-EPM-2022-SU6
CVE ID: CVE-2024-13172 State: PUBLISHED Published: 2025-01-14T17:16:17.218Z Last Updated: 2025-01-24T04:55:51.479Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Ivanti Products: Endpoint Manager Problem Types: CWE-347 Description: Improper signature verification in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote unauthenticated attacker to achieve remote code execution. Local user interaction is required. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://forums.ivanti.com/s/article/Security-Advisory-EPM-January-2025-for-EPM-2024-and-EPM-2022-SU6
CVE ID: CVE-2024-13173 State: PUBLISHED Published: 2025-01-08T07:44:48.592Z Last Updated: 2025-01-08T14:16:22.022Z Vendors: vivo Products: Health Problem Types: CWE-306 Description: The health module has insufficient restrictions on loading URLs, which may lead to some information leakage. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.vivo.com/en/support/security-advisory-detail?id=14
CVE ID: CVE-2024-13174 State: PUBLISHED Published: 2025-09-16T14:28:19.739Z Last Updated: 2025-09-23T07:33:37.230Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L) Vendors: E1 Informatics Products: Web Application Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in E1 Informatics Web Application allows SQL Injection.This issue affects Web Application: through 20250916. NOTE: The vendor did not inform about the completion of the fixing process within the specified time. The CVE will be updated when new information becomes available. Additional Analyst Notes: - CISA ADP Vulnrichment: Refe
The CVE will be updated when new information becomes available. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.usom.gov.tr/bildirim/tr-25-0259
CVE ID: CVE-2024-13175 State: PUBLISHED Published: 2025-07-18T14:01:13.242Z Last Updated: 2025-07-18T14:56:03.831Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: Vidco Software Products: VOC TESTER Problem Types: CWE-639 Description: Authorization Bypass Through User-Controlled Key vulnerability in Vidco Software VOC TESTER allows Forceful Browsing.This issue affects VOC TESTER: before 12.41.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.usom.gov.tr/bildirim/tr-25-0159