Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
be used. The associated identifier of this vulnerability is VDB-271059. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.271059 - https://vuldb.com/?ctiid.271059 - https://vuldb.com/?submit.372193 - https://github.com/littletree7/cve/issues/1
CVE ID: CVE-2024-6653 State: PUBLISHED Published: 2024-07-11T00:00:05.392Z Last Updated: 2024-08-01T21:41:04.323Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: code-projects Products: Simple Task List Problem Types: CWE-89 Description: A vulnerability was found in code-projects Simple Task List 1.0. It has been declared as critical. This vulnerability affects unknown code of the file loginForm.php of the component Login. The manipulation of the argument username leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-271060. Additional Analyst Notes: - CISA ADP Vulnr
e public and may be used. The identifier of this vulnerability is VDB-271060. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.271060 - https://vuldb.com/?ctiid.271060 - https://vuldb.com/?submit.372263 - https://github.com/hantianj/cve/issues/1
CVE ID: CVE-2024-6654 State: PUBLISHED Published: 2024-09-27T08:54:28.250Z Last Updated: 2024-10-09T08:47:17.411Z Vendors: ESET, spol. s r.o. Products: ESET Cyber Security, ESET Endpoint Security for macOS Problem Types: CWE-377 Description: Products for macOS enables a user logged on to the system to perform a denial-of-service attack, which could be misused to disable the protection of the ESET security product and cause general system slow-down. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.eset.com/en/ca8725-denial-of-service-vulnerability-in-eset-products-for-macos-fixed
CVE ID: CVE-2024-6655 State: PUBLISHED Published: 2024-07-16T15:05:55.424Z Last Updated: 2025-11-20T19:54:38.660Z Severity: HIGH (CVSS 7 CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Red Hat Products: Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7 Problem Types: CWE-94 Description: A flaw was found in the GTK library. Under certain conditions, it is possible for a library to be injected into a GTK application from the current working directory. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2024:6963 - https://a
ISA ADP Vulnrichment: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2024:6963 - https://access.redhat.com/errata/RHSA-2024:9184 - https://access.redhat.com/security/cve/CVE-2024-6655 - https://bugzilla.redhat.com/show_bug.cgi?id=2297098 - https://gitlab.gnome.org/GNOME/gtk/-/merge_requests/7361/diffs?commit_id=3bbf0b6176d42836d23c36a6ac410e807ec0a7a7#diff-content-e3fbe6480add9420b69f82374fb26ccac2c015a0 - https://www.openwall.com/lists/oss-security/2024/09/09/1
CVE ID: CVE-2024-6656 State: PUBLISHED Published: 2024-09-13T08:44:43.942Z Last Updated: 2024-09-13T14:06:04.211Z Vendors: TNB Mobile Solutions Products: Cockpit Software Problem Types: CWE-798 Description: Use of Hard-coded Credentials vulnerability in TNB Mobile Solutions Cockpit Software allows Read Sensitive Strings Within an Executable.This issue affects Cockpit Software: before v2.13. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.usom.gov.tr/bildirim/tr-24-1466
CVE ID: CVE-2024-6657 State: PUBLISHED Published: 2024-10-11T13:52:59.562Z Last Updated: 2024-11-04T14:16:17.415Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: silabs.com Products: EFR32 BLE SDK Problem Types: CWE-821 Description: A denial of service may be caused to a single peripheral device in a BLE network when multiple central devices continuously connect and disconnect to the peripheral. A hard reset is required to recover the peripheral device. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://community.silabs.com/068Vm00000FfVNN
CVE ID: CVE-2024-6658 State: PUBLISHED Published: 2024-09-12T14:38:48.129Z Last Updated: 2024-09-23T19:19:19.461Z Severity: HIGH (CVSS 8.4 CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: Progress Products: LoadMaster Problem Types: CWE-20 Description: Improper Input Validation vulnerability of Authenticated User in Progress LoadMaster allows OS Command Injection.This issue affects: Product Affected Versions LoadMaster From 7.2.55.0 to 7.2.60.0 (inclusive) From 7.2.49.0 to 7.2.54.11 (inclusive) 7.2.48.12 and all prior versions Multi-Tenant Hypervisor 7.1.35.11 and all prior versions ECS All prior versions to 7.2.60.0 (inclusive) Additional Analyst Notes: - CISA ADP Vulnrichment: Refere
prior versions ECS All prior versions to 7.2.60.0 (inclusive) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.kemptechnologies.com/hc/en-us/articles/28910587250701
CVE ID: CVE-2024-6660 State: PUBLISHED Published: 2024-07-17T06:45:09.895Z Last Updated: 2024-08-01T21:41:04.263Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: reputeinfosystems Products: Appointment Booking Calendar Plugin and Online Scheduling Plugin – BookingPress Problem Types: CWE-280 Improper Handling of Insufficient Permissions or Privileges Description: The BookingPress – Appointment Booking Calendar Plugin and Online Scheduling Plugin plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the bookingpress_import_data_continue_process_func function in all vers
escalation due to a missing capability check on the bookingpress_import_data_continue_process_func function in all versions up to, and including, 1.1.5. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update arbitrary options on the WordPress site and upload arbitrary files. This can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/851ff861-474e-4063-88ff-d8d35b10e9a0?source=c
r: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/851ff861-474e-4063-88ff-d8d35b10e9a0?source=cve - https://plugins.trac.wordpress.org/browser/bookingpress-appointment-booking/trunk/core/classes/class.bookingpress_import_export.php#L476 - https://plugins.trac.wordpress.org/browser/bookingpress-appointment-booking/trunk/core/classes/class.bookingpress_import_export.php#L410 - https://plugins.trac.wordpress.org/browser/bookingpress-appointment-booking/trunk/core/classes/class.bookingpress_import_export.php#L1491 - https://plugins.trac.wordpress.org/changeset/3116857/bookingpress-appointment-booking/trunk/core/classes/class.bookingpress_import_export.php?contextall=1
CVE ID: CVE-2024-6661 State: PUBLISHED Published: 2024-07-27T01:51:06.339Z Last Updated: 2024-08-01T21:41:04.315Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N) Vendors: paritydiscounts Products: ParityPress – Parity Pricing with Discount Rules Problem Types: CWE-79 Description: The ParityPress – Parity Pricing with Discount Rules plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'Discount Text' in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will
enticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/f015ff9b-a7dc-47de-83d4-d6b91ec433f7?source=cve - https://wordpress.org/plugins/paritypress/#developers - https://plugins.trac.wordpress.org/browser/paritypress/trunk/app/Hooks/Activator.php#L22
CVE ID: CVE-2024-6662 State: PUBLISHED Published: 2025-01-10T17:50:51.104Z Last Updated: 2025-01-10T18:15:08.142Z Vendors: Jan Syski Products: MegaBIP Problem Types: CWE-352 Description: Websites managed by MegaBIP in versions below 5.15 are vulnerable to Cross-Site Request Forgery (CSRF) as the form available under "/edytor/index.php?id=7,7,0" lacks protection mechanisms. A user could be tricked into visiting a malicious website, which would send POST request to this endpoint. If the victim is a logged in administrator, this could lead to creation of new accounts and granting of administrative permissions. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert.pl/en/p
ing of administrative permissions. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert.pl/en/posts/2024/09/CVE-2024-6662 - https://megabip.pl/ - https://www.gov.pl/web/cyfryzacja/rekomendacja-pelnomocnika-rzadu-ds-cyberbezpieczenstwa-dotyczaca-biuletynow-informacji-publicznej
CVE ID: CVE-2024-6663 State: REJECTED Published: N/A Last Updated: 2024-07-10T20:59:56.894980Z Description: No description available.
CVE ID: CVE-2024-6664 State: REJECTED Published: N/A Last Updated: 2024-07-10T21:00:00.304244Z Description: No description available.
CVE ID: CVE-2024-6665 State: PUBLISHED Published: 2025-05-15T20:07:08.117Z Last Updated: 2025-05-17T03:43:41.285Z Vendors: Unknown Products: KBucket: Your Curated Content in WordPress Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The KBucket: Your Curated Content in WordPress plugin before 4.1.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/a0b3335f-6e04-402f-8cfd-fc4c62e52168/
CVE ID: CVE-2024-6666 State: PUBLISHED Published: 2024-07-11T06:43:13.765Z Last Updated: 2024-08-01T21:41:04.318Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: wedevs Products: WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting Problem Types: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Description: The WP ERP plugin for WordPress is vulnerable to SQL Injection via the ‘vendor_id’ parameter in all versions up to, and including, 1.13.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it po
t escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Accounting Manager access (erp_ac_view_sales_summary capability) and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/e23335c9-0830-4c6b-8e0d-6897a7176ba5?source=cve - https://plugins.trac.wordpress.org/changeset/3064874/erp/tags/1.13.1/modules/accounting/includes/functions/transactions.php
CVE ID: CVE-2024-6667 State: PUBLISHED Published: 2025-05-15T20:07:08.330Z Last Updated: 2025-05-17T03:42:38.455Z Vendors: Unknown Products: KBucket: Your Curated Content in WordPress Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The KBucket: Your Curated Content in WordPress plugin before 4.1.5 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against admin. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/d2b8ca6c-2b14-4d72-8e39-0f3ca5c23f56/
CVE ID: CVE-2024-6668 State: PUBLISHED Published: 2025-05-15T20:07:08.537Z Last Updated: 2025-05-20T19:24:18.423Z Vendors: Unknown Products: ProfilePro Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The ProfilePro WordPress plugin through 1.3 does not sanitise and escape some parameters and lacks proper access controls, which could allow users with a role as low as subscriber to perform Cross-Site Scripting attacks Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/8faf1409-44e6-4ebf-9a68-b5f93a5295e9/
CVE ID: CVE-2024-6669 State: PUBLISHED Published: 2024-07-17T06:45:11.037Z Last Updated: 2024-08-01T21:41:04.291Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N) Vendors: quantumcloud Products: AI ChatBot for WordPress – WPBot Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The AI ChatBot for WordPress – WPBot plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 5.5.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to
output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/ce23efed-fe21-486a-ab3b-9ed0dd26a971?source=cve - https://plugins.trac.wordpress.org/browser/chatbot/trunk/admin_ui.php#L755 - https://wordpress.org/plugins/chatbot/#developers - https://plugins.trac.wordpress.org/browser/chatbot/
in_ui.php#L755 - https://wordpress.org/plugins/chatbot/#developers - https://plugins.trac.wordpress.org/browser/chatbot/trunk/admin_ui.php#L2211 - https://plugins.trac.wordpress.org/changeset/3119022/
CVE ID: CVE-2024-6670 State: PUBLISHED Published: 2024-08-29T22:04:41.139Z Last Updated: 2025-10-21T22:55:46.285Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Progress Software Corporation Products: WhatsUp Gold Problem Types: CWE-89 Description: In WhatsUp Gold versions released before 2024.0.0, a SQL Injection vulnerability allows an unauthenticated attacker to retrieve the users encrypted password. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.progress.com/network-monitoring - https://community.progress.com/s/article/WhatsUp-Gold-Security-Bulletin-August-2024
CVE ID: CVE-2024-6671 State: PUBLISHED Published: 2024-08-29T22:06:19.291Z Last Updated: 2024-09-25T03:55:41.371Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Progress Software Corporation Products: WhatsUp Gold Problem Types: CWE-89 Description: In WhatsUp Gold versions released before 2024.0.0, if the application is configured with only a single user, a SQL Injection vulnerability allows an unauthenticated attacker to retrieve the users encrypted password. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.progress.com/network-monitoring - https://community.progress.com/s/article/WhatsUp-Gold-Security-Bulletin-August-2024
CVE ID: CVE-2024-6672 State: PUBLISHED Published: 2024-08-29T22:07:13.727Z Last Updated: 2024-08-30T13:45:45.129Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Progress Software Corporation Products: WhatsUp Gold Problem Types: CWE-89 Description: In WhatsUp Gold versions released before 2024.0.0, a SQL Injection vulnerability allows an authenticated low-privileged attacker to achieve privilege escalation by modifying a privileged user's password. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.progress.com/network-monitoring - https://community.progress.com/s/article/WhatsUp-Gold-Security-Bulletin-August-2024
CVE ID: CVE-2024-6673 State: PUBLISHED Published: 2024-10-29T12:50:20.748Z Last Updated: 2024-10-29T18:10:09.460Z Severity: MEDIUM (CVSS 4.4 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L) Vendors: parisneo Products: parisneo/lollms-webui Problem Types: CWE-352 Description: A Cross-Site Request Forgery (CSRF) vulnerability exists in the `install_comfyui` endpoint of the `lollms_comfyui.py` file in the parisneo/lollms-webui repository, versions v9.9 to the latest. The endpoint uses the GET method without requiring a client ID, allowing an attacker to trick a victim into installing ComfyUI. If the victim's device does not have sufficient capacity, this can result in a crash. Additional Analyst N
ling ComfyUI. If the victim's device does not have sufficient capacity, this can result in a crash. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/a38f9a7d-b357-427d-adac-f9654d8c0e3c - https://github.com/parisneo/lollms-webui/commit/c1bb1ad19752aa7541675b398495eaf98fd589f1
CVE ID: CVE-2024-6674 State: PUBLISHED Published: 2024-10-29T12:46:44.950Z Last Updated: 2024-10-29T13:41:08.667Z Severity: HIGH (CVSS 8.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H) Vendors: parisneo Products: parisneo/lollms-webui Problem Types: CWE-346 Description: A CORS misconfiguration in parisneo/lollms-webui prior to version 10 allows attackers to steal sensitive information such as logs, browser sessions, and settings containing private API keys from other services. This vulnerability can also enable attackers to perform actions on behalf of a user, such as deleting a project or sending a message. The issue impacts the confidentiality and integrity of the information. Additional A
ing a project or sending a message. The issue impacts the confidentiality and integrity of the information. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/e688f71b-a3a4-4f6d-b48a-837073fa6908 - https://github.com/parisneo/lollms-webui/commit/c1bb1ad19752aa7541675b398495eaf98fd589f1
CVE ID: CVE-2024-6675 State: PUBLISHED Published: 2024-07-22T20:01:15.981Z Last Updated: 2024-08-01T21:41:04.305Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: NI Products: VeriStand Problem Types: CWE-502 Description: A deserialization of untrusted data vulnerability exists in NI VeriStand that may result in remote code execution. Successful exploitation requires an attacker to get a user to open a specially crafted project file. This vulnerability affects VeriStand 2024 Q2 and prior versions. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.ni.com/en/support/security/available-critical-and-security-updat
ent: - CVE Program Container: References: - https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/deserialization-of-untrusted-data-vulnerability-in-ni-veristand-project-file.html
CVE ID: CVE-2024-6676 State: PUBLISHED Published: 2024-07-11T02:00:10.857Z Last Updated: 2024-08-01T21:41:04.311Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: witmy Products: my-springsecurity-plus Problem Types: CWE-89 Description: A vulnerability has been found in witmy my-springsecurity-plus up to 2024-07-03 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /api/user. The manipulation of the argument params.dataScope leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. This product does not use versioning. This is why information about affected and unaffec
to the public and may be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The associated identifier of this vulnerability is VDB-271111. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.271111 - https://vuldb.com/?ctiid.271111 - https://gitee.com/witmy/my-springsecurity-plus/issues/IAAE8U
CVE ID: CVE-2024-6677 State: PUBLISHED Published: 2024-07-12T02:41:17.327Z Last Updated: 2025-03-25T17:46:04.619Z Vendors: Citrix Products: uberAgent Description: Privilege escalation in uberAgent Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://support.citrix.com/article/CTX691103/citrix-uberagent-security-bulletin-for-cve20246677
CVE ID: CVE-2024-6678 State: PUBLISHED Published: 2024-09-12T18:26:33.060Z Last Updated: 2024-09-13T14:17:37.029Z Severity: CRITICAL (CVSS 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: GitLab Products: GitLab Problem Types: CWE-290 Description: An issue was discovered in GitLab CE/EE affecting all versions starting from 8.14 prior to 17.1.7, starting from 17.2 prior to 17.2.5, and starting from 17.3 prior to 17.3.2, which allows an attacker to trigger a pipeline as an arbitrary user under certain circumstances. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/471923 - https://hackerone.com/rep
- CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/471923 - https://hackerone.com/reports/2595495
CVE ID: CVE-2024-6679 State: PUBLISHED Published: 2024-07-11T15:00:11.027Z Last Updated: 2024-08-01T21:41:04.398Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: witmy Products: my-springsecurity-plus Problem Types: CWE-89 Description: A vulnerability classified as critical has been found in witmy my-springsecurity-plus up to 2024-07-04. Affected is an unknown function of the file /api/role. The manipulation of the argument params.dataScope leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-271152. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE P
be used. The identifier of this vulnerability is VDB-271152. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.271152 - https://vuldb.com/?ctiid.271152 - https://gitee.com/witmy/my-springsecurity-plus/issues/IAAHCR
CVE ID: CVE-2024-6680 State: PUBLISHED Published: 2024-07-11T16:00:09.662Z Last Updated: 2024-08-01T21:41:04.303Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: witmy Products: my-springsecurity-plus Problem Types: CWE-89 Description: A vulnerability classified as critical was found in witmy my-springsecurity-plus up to 2024-07-04. Affected by this vulnerability is an unknown functionality of the file /api/dept/build. The manipulation of the argument params.dataScope leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-271153 was assigned to this vulnerability. Additional Analyst Notes: - C
the public and may be used. The identifier VDB-271153 was assigned to this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.271153 - https://vuldb.com/?ctiid.271153 - https://gitee.com/witmy/my-springsecurity-plus/issues/IAAH8A