Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-31800 State: PUBLISHED Published: 2024-08-15T00:00:00 Last Updated: 2024-10-30T19:25:37.917Z Vendors: n/a Products: n/a Problem Types: n/a Description: Authentication Bypass in GNCC's GC2 Indoor Security Camera 1080P allows an attacker with physical access to gain a privileged command shell via the UART Debugging Port. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gncchome.com/collections/indoor-camera/products/c2-indoor-security-camera-1080p - https://www.nsideattacklogic.de/advisories/NSIDE-SA-2024-001
CVE ID: CVE-2024-31801 State: PUBLISHED Published: 2024-04-29T00:00:00 Last Updated: 2024-08-02T01:59:50.635Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory Traversal vulnerability in NEXSYS-ONE before v.Rev.15320 allows a remote attacker to obtain sensitive information via a crafted request. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.nexsysone.com/ - https://dishdev.nexsysone.com/nexsysonev3/ - https://gist.github.com/hamoshwani/6e207aa4ea513438cd75b97c1fc8abfe
CVE ID: CVE-2024-31802 State: PUBLISHED Published: 2024-06-27T00:00:00 Last Updated: 2024-11-18T20:52:56.104Z Vendors: n/a Products: n/a Problem Types: n/a Description: DESIGNA ABACUS v.18 and before allows an attacker to bypass the payment process via a crafted QR code. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.rodrigofavarini.com.br/cybersecurity/designa-abacus-v-18-and-before-allows-an-attacker-to-bypass-the-payment-process-via-a-crafted-qr-code/
CVE ID: CVE-2024-31803 State: PUBLISHED Published: 2024-05-09T13:56:13.026Z Last Updated: 2025-02-13T15:47:56.796Z Vendors: n/a Products: n/a Problem Types: n/a Description: Buffer Overflow vulnerability in emp-ot v.0.2.4 allows a remote attacker to execute arbitrary code via the FerretCOT<T>::read_pre_data128_from_file function. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/emp-toolkit/emp-ot/issues/89 - https://github.com/FudanMPL/Vulnerabilities-in-MPC-Framework/tree/main/emp-ot/stack-buffer-overflow-ferret_cot
CVE ID: CVE-2024-31804 State: PUBLISHED Published: 2024-04-23T00:00:00 Last Updated: 2024-11-22T15:19:41.887Z Vendors: n/a Products: n/a Problem Types: n/a Description: An unquoted service path vulnerability in Terratec DMX_6Fire USB v.1.23.0.02 allows a local attacker to escalate privileges via the Program.exe component. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.ired.team/offensive-security/privilege-escalation/unquoted-service-paths - https://medium.com/%40kobbycyber/terratec-dmx-6fire-usb-unquoted-service-path-cve-2024-31804-70cced459202 - https://www.exploit-db.com/exploits/51977
CVE ID: CVE-2024-31805 State: PUBLISHED Published: 2024-04-08T00:00:00 Last Updated: 2024-08-15T12:59:35.070Z Vendors: n/a Products: n/a Problem Types: n/a Description: TOTOLINK EX200 V4.0.3c.7646_B20201211 allows attackers to start the Telnet service without authorization via the telnet_enabled parameter in the setTelnetCfg function. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/4hsien/CVE-vulns/blob/main/TOTOLINK/EX200/CI_5_setTelnetCfg/CI.md
CVE ID: CVE-2024-31806 State: PUBLISHED Published: 2024-04-08T00:00:00.000Z Last Updated: 2025-03-13T13:47:22.832Z Vendors: n/a Products: n/a Problem Types: n/a Description: TOTOLINK EX200 V4.0.3c.7646_B20201211 was discovered to contain a Denial-of-Service (DoS) vulnerability in the RebootSystem function which can reboot the system without authorization. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/4hsien/CVE-vulns/blob/main/TOTOLINK/EX200/DoS_RebootSystem/DoS.md
CVE ID: CVE-2024-31807 State: PUBLISHED Published: 2024-04-08T00:00:00 Last Updated: 2024-08-13T14:51:20.092Z Vendors: n/a Products: n/a Problem Types: n/a Description: TOTOLINK EX200 V4.0.3c.7646_B20201211 was discovered to contain a remote code execution (RCE) vulnerability via the hostTime parameter in the NTPSyncWithHost function. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/4hsien/CVE-vulns/blob/main/TOTOLINK/EX200/CI_2_NTPSyncWithHost/CI.md
CVE ID: CVE-2024-31808 State: PUBLISHED Published: 2024-04-08T00:00:00 Last Updated: 2024-08-02T01:59:50.238Z Vendors: n/a Products: n/a Problem Types: n/a Description: TOTOLINK EX200 V4.0.3c.7646_B20201211 was discovered to contain a remote code execution (RCE) vulnerability via the webWlanIdx parameter in the setWebWlanIdx function. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/4hsien/CVE-vulns/blob/main/TOTOLINK/EX200/CI_3_setWebWlanIdx/CI.md
CVE ID: CVE-2024-31809 State: PUBLISHED Published: 2024-04-08T00:00:00 Last Updated: 2024-08-02T01:59:49.991Z Vendors: n/a Products: n/a Problem Types: n/a Description: TOTOLINK EX200 V4.0.3c.7646_B20201211 was discovered to contain a remote code execution (RCE) vulnerability via the FileName parameter in the setUpgradeFW function. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/4hsien/CVE-vulns/blob/main/TOTOLINK/EX200/CI_4_setUpgradeFW/CI.md
CVE ID: CVE-2024-31810 State: PUBLISHED Published: 2024-05-13T19:58:17.623Z Last Updated: 2025-03-28T23:28:19.996Z Vendors: n/a Products: n/a Problem Types: n/a Description: TOTOLINK EX200 V4.0.3c.7646_B20201211 was discovered to contain a hardcoded password for root at /etc/shadow.sample. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/4hsien/CVE-vulns/blob/main/TOTOLINK/EX200/HardCode/HardCode.md
CVE ID: CVE-2024-31811 State: PUBLISHED Published: 2024-04-08T00:00:00 Last Updated: 2024-08-28T14:18:45.166Z Vendors: n/a Products: n/a Problem Types: n/a Description: TOTOLINK EX200 V4.0.3c.7646_B20201211 was discovered to contain a remote code execution (RCE) vulnerability via the langType parameter in the setLanguageCfg function. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/4hsien/CVE-vulns/blob/main/TOTOLINK/EX200/CI_1_setLanguageCfg/CI.md
CVE ID: CVE-2024-31812 State: PUBLISHED Published: 2024-04-08T00:00:00 Last Updated: 2024-08-02T01:59:49.394Z Vendors: n/a Products: n/a Problem Types: n/a Description: In TOTOLINK EX200 V4.0.3c.7646_B20201211, an attacker can obtain sensitive information without authorization through the function getWiFiExtenderConfig. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/4hsien/CVE-vulns/blob/main/TOTOLINK/EX200/Leak_getWiFiExtenderConfig/Leak.md
CVE ID: CVE-2024-31813 State: PUBLISHED Published: 2024-04-08T00:00:00 Last Updated: 2024-11-19T19:44:19.996Z Vendors: n/a Products: n/a Problem Types: n/a Description: TOTOLINK EX200 V4.0.3c.7646_B20201211 does not contain an authentication mechanism by default. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/4hsien/CVE-vulns/blob/main/TOTOLINK/EX200/Missing_Authentication/missauth.md
CVE ID: CVE-2024-31814 State: PUBLISHED Published: 2024-04-08T00:00:00 Last Updated: 2024-08-02T01:59:50.413Z Vendors: n/a Products: n/a Problem Types: n/a Description: TOTOLINK EX200 V4.0.3c.7646_B20201211 allows attackers to bypass login through the Form_Login function. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/4hsien/CVE-vulns/blob/main/TOTOLINK/EX200/Login_Bypass/bypass.md
CVE ID: CVE-2024-31815 State: PUBLISHED Published: 2024-04-08T00:00:00 Last Updated: 2024-10-28T13:56:35.830Z Vendors: n/a Products: n/a Problem Types: n/a Description: In TOTOLINK EX200 V4.0.3c.7314_B20191204, an attacker can obtain the configuration file without authorization through /cgi-bin/ExportSettings.sh Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/4hsien/CVE-vulns/blob/main/TOTOLINK/EX200/Leak_ExportSettings/Leak.md
CVE ID: CVE-2024-31816 State: PUBLISHED Published: 2024-04-08T00:00:00 Last Updated: 2024-08-14T13:50:16.079Z Vendors: n/a Products: n/a Problem Types: n/a Description: In TOTOLINK EX200 V4.0.3c.7646_B20201211, an attacker can obtain sensitive information without authorization through the function getEasyWizardCfg. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/4hsien/CVE-vulns/blob/main/TOTOLINK/EX200/Leak_getEasyWizardCfg/Leak.md
CVE ID: CVE-2024-31817 State: PUBLISHED Published: 2024-04-08T00:00:00 Last Updated: 2024-08-02T01:59:50.055Z Vendors: n/a Products: n/a Problem Types: n/a Description: In TOTOLINK EX200 V4.0.3c.7646_B20201211, an attacker can obtain sensitive information without authorization through the function getSysStatusCfg. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/4hsien/CVE-vulns/blob/main/TOTOLINK/EX200/Leak_getSysStatusCfg/Leak.md
CVE ID: CVE-2024-31818 State: PUBLISHED Published: 2024-04-12T00:00:00 Last Updated: 2024-08-02T01:59:50.637Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory Traversal vulnerability in DerbyNet v.9.0 allows a remote attacker to execute arbitrary code via the page parameter of the kiosk.php component. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/jeffpiazza/derbynet/blob/1ae0bb55c3990dec8fd9b9f4a82400be9a75de92/website/kiosk.php - https://chocapikk.com/posts/2024/derbynet-vulnerabilities/
CVE ID: CVE-2024-31819 State: PUBLISHED Published: 2024-04-10T00:00:00 Last Updated: 2024-08-28T18:36:12.131Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in WWBN AVideo v.12.4 through v.14.2 allows a remote attacker to execute arbitrary code via the systemRootPath parameter of the submitIndex.php component. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/WWBN/ - https://github.com/WWBN/AVideo - https://github.com/Chocapikk/CVE-2024-31819 - https://chocapikk.com/posts/2024/cve-2024-31819/
CVE ID: CVE-2024-31820 State: PUBLISHED Published: 2024-04-29T00:00:00 Last Updated: 2024-08-02T01:59:50.598Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in Ecommerce-CodeIgniter-Bootstrap commit v. d22b54e8915f167a135046ceb857caaf8479c4da allows a remote attacker to execute arbitrary code via the getLangFolderForEdit method of the Languages.php component. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://liotree.github.io/2023/Ecommerce-CodeIgniter-Bootstrap.html - https://github.com/kirilkirkov/Ecommerce-CodeIgniter-Bootstrap/commit/d22b54e8915f167a135046ceb857caaf8479c4da - https://gist.github.com/LioTree/890b0eea95fc
rce-CodeIgniter-Bootstrap/commit/d22b54e8915f167a135046ceb857caaf8479c4da - https://gist.github.com/LioTree/890b0eea95fce6225d820afe4e3510e9
CVE ID: CVE-2024-31821 State: PUBLISHED Published: 2024-04-29T00:00:00 Last Updated: 2024-08-02T01:59:49.985Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL Injection vulnerability in Ecommerce-CodeIgniter-Bootstrap commit v. d22b54e8915f167a135046ceb857caaf8479c4da allows a remote attacker to execute arbitrary code via the manageQuantitiesAndProcurement method of the Orders_model.php component. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://liotree.github.io/2023/Ecommerce-CodeIgniter-Bootstrap.html - https://github.com/kirilkirkov/Ecommerce-CodeIgniter-Bootstrap/commit/d22b54e8915f167a135046ceb857caaf8479c4da - https://gist
://github.com/kirilkirkov/Ecommerce-CodeIgniter-Bootstrap/commit/d22b54e8915f167a135046ceb857caaf8479c4da - https://gist.github.com/LioTree/5c963a37e2c335c22e74ca3d9aea32bb
CVE ID: CVE-2024-31822 State: PUBLISHED Published: 2024-04-29T00:00:00 Last Updated: 2024-08-02T01:59:50.150Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in Ecommerce-CodeIgniter-Bootstrap commit v. d22b54e8915f167a135046ceb857caaf8479c4da allows a remote attacker to execute arbitrary code via the saveLanguageFiles method of the Languages.php component. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://liotree.github.io/2023/Ecommerce-CodeIgniter-Bootstrap.html - https://github.com/kirilkirkov/Ecommerce-CodeIgniter-Bootstrap/commit/d22b54e8915f167a135046ceb857caaf8479c4da - https://gist.github.com/LioTree/f83e25b2c5e144c
-CodeIgniter-Bootstrap/commit/d22b54e8915f167a135046ceb857caaf8479c4da - https://gist.github.com/LioTree/f83e25b2c5e144c0b3ad8919e6483c7a
CVE ID: CVE-2024-31823 State: PUBLISHED Published: 2024-04-29T00:00:00 Last Updated: 2024-08-02T01:59:50.442Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in Ecommerce-CodeIgniter-Bootstrap commit v. d22b54e8915f167a135046ceb857caaf8479c4da allows a remote attacker to execute arbitrary code via the removeSecondaryImage method of the Publish.php component. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://liotree.github.io/2023/Ecommerce-CodeIgniter-Bootstrap.html - https://github.com/kirilkirkov/Ecommerce-CodeIgniter-Bootstrap/commit/d22b54e8915f167a135046ceb857caaf8479c4da - https://gist.github.com/LioTree/4989e0f20b6a88
e-CodeIgniter-Bootstrap/commit/d22b54e8915f167a135046ceb857caaf8479c4da - https://gist.github.com/LioTree/4989e0f20b6a885604dd3178fa4b66b5
CVE ID: CVE-2024-31828 State: PUBLISHED Published: 2024-04-26T00:00:00 Last Updated: 2024-08-02T01:59:50.639Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting vulnerability in Lavalite CMS v.10.1.0 allows attackers to execute arbitrary code and obtain sensitive information via a crafted payload to the URL. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://jinmu1108.github.io/uncategorized/CVE-2024-31828/
CVE ID: CVE-2024-31835 State: PUBLISHED Published: 2024-10-01T00:00:00 Last Updated: 2024-10-01T17:42:48.368Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting vulnerability in flatpress CMS Flatpress v1.3 allows a remote attacker to execute arbitrary code via a crafted payload to the file name parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://drive.google.com/file/d/1OthtP87MduNTYur_p0RZv3moY8CrBcaM/view - https://github.com/paragbagul111/CVE-2024-31835
CVE ID: CVE-2024-31837 State: PUBLISHED Published: 2024-04-30T00:00:00.000Z Last Updated: 2025-11-03T21:54:41.399Z Vendors: n/a Products: n/a Problem Types: n/a Description: DMitry (Deepmagic Information Gathering Tool) 1.3a has a format-string vulnerability, with a threat model similar to CVE-2017-7938. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/jaygreig86/dmitry/pull/12
CVE ID: CVE-2024-31839 State: PUBLISHED Published: 2024-04-12T00:00:00 Last Updated: 2024-08-02T01:59:50.666Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting vulnerability in tiagorlampert CHAOS v.5.0.1 allows a remote attacker to escalate privileges via the sendCommandHandler function in the handler.go component. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/tiagorlampert/CHAOS - https://blog.chebuya.com/posts/remote-code-execution-on-chaos-rat-via-spoofed-agents/
CVE ID: CVE-2024-31840 State: PUBLISHED Published: 2024-05-21T15:32:37.989Z Last Updated: 2025-03-14T14:52:16.101Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Italtel Embrace 1.6.4. The web application inserts cleartext passwords in the HTML source code. An authenticated user is able to edit the configuration of the email server. Once the user access the edit function, the web application fills the edit form with the current credentials for the email account, including the cleartext password. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.gruppotim.it/it/footer/red-team.html
CVE ID: CVE-2024-31841 State: PUBLISHED Published: 2024-04-19T00:00:00 Last Updated: 2024-08-02T01:59:50.479Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Italtel Embrace 1.6.4. The web server fails to sanitize input data, allowing remote unauthenticated attackers to read arbitrary files on the filesystem. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.gruppotim.it/it/footer/red-team.html
CVE ID: CVE-2024-31842 State: PUBLISHED Published: 2024-08-20T00:00:00 Last Updated: 2024-10-29T20:16:46.914Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Italtel Embrace 1.6.4. The web application inserts the access token of an authenticated user inside GET requests. The query string for the URL could be saved in the browser's history, passed through Referers to other web sites, stored in web logs, or otherwise recorded in other sources. If the query string contains sensitive information such as session identifiers, then attackers can use this information to launch further attacks. Because the access token in sent in GET requests, this vulnerability
an use this information to launch further attacks. Because the access token in sent in GET requests, this vulnerability could lead to complete account takeover. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.gruppotim.it/it/footer/red-team.html
CVE ID: CVE-2024-31843 State: PUBLISHED Published: 2024-05-23T19:01:58.571Z Last Updated: 2025-02-13T15:47:58.472Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Italtel Embrace 1.6.4. The Web application does not properly check the parameters sent as input before they are processed on the server side. This allows authenticated users to execute commands on the Operating System. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.gruppotim.it/it/footer/red-team.html
CVE ID: CVE-2024-31844 State: PUBLISHED Published: 2024-05-21T15:33:17.348Z Last Updated: 2025-03-13T20:26:02.820Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Italtel Embrace 1.6.4. The server does not properly handle application errors. In some cases, this leads to a disclosure of information about the server. An unauthenticated user is able craft specific requests in order to make the application generate an error. Inside an error message, some information about the server is revealed, such as the absolute path of the source code of the application. This kind of information can help an attacker to perform other attacks against the system. This can
of the application. This kind of information can help an attacker to perform other attacks against the system. This can be exploited without authentication. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.gruppotim.it/it/footer/red-team.html
CVE ID: CVE-2024-31845 State: PUBLISHED Published: 2024-05-21T15:33:40.135Z Last Updated: 2025-02-13T15:47:59.505Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Italtel Embrace 1.6.4. The product does not neutralize or incorrectly neutralizes output that is written to logs. The web application writes logs using a GET query string parameter. This parameter can be modified by an attacker, so that every action he performs is attributed to a different user. This can be exploited without authentication. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.gruppotim.it/it/footer/red-team.html
CVE ID: CVE-2024-31846 State: PUBLISHED Published: 2024-04-19T00:00:00 Last Updated: 2024-08-02T01:59:50.649Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Italtel Embrace 1.6.4. The web application does not restrict or incorrectly restricts access to a resource from an unauthorized actor. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.gruppotim.it/it/footer/red-team.html
CVE ID: CVE-2024-31847 State: PUBLISHED Published: 2024-05-21T15:34:04.208Z Last Updated: 2025-03-13T17:32:58.883Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Italtel Embrace 1.6.4. A stored cross-site scripting (XSS) vulnerability allows authenticated and unauthenticated remote attackers to inject arbitrary web script or HTML into a GET parameter. This reflects/stores the user input without sanitization. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.gruppotim.it/it/footer/red-team.html
CVE ID: CVE-2024-31848 State: PUBLISHED Published: 2024-04-05T17:39:46.001Z Last Updated: 2024-08-02T01:59:50.069Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: CData Products: API Server Problem Types: CWE-22 Description: A path traversal vulnerability exists in the Java version of CData API Server < 23.4.8844 when running using the embedded Jetty server, which could allow an unauthenticated remote attacker to gain complete administrative access to the application. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.tenable.com/security/research/tra-2024-09
CVE ID: CVE-2024-31849 State: PUBLISHED Published: 2024-04-05T17:40:54.797Z Last Updated: 2024-08-02T01:59:50.072Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: CData Products: Connect Problem Types: CWE-22 Description: A path traversal vulnerability exists in the Java version of CData Connect < 23.4.8846 when running using the embedded Jetty server, which could allow an unauthenticated remote attacker to gain complete administrative access to the application. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.tenable.com/security/research/tra-2024-09
CVE ID: CVE-2024-31850 State: PUBLISHED Published: 2024-04-05T17:42:15.334Z Last Updated: 2024-08-26T20:14:14.357Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L) Vendors: CData Products: Arc Problem Types: CWE-22 Description: A path traversal vulnerability exists in the Java version of CData Arc < 23.4.8839 when running using the embedded Jetty server, which could allow an unauthenticated remote attacker to gain access to sensitive information and perform limited actions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.tenable.com/security/research/tra-2024-09
CVE ID: CVE-2024-31851 State: PUBLISHED Published: 2024-04-05T17:43:11.167Z Last Updated: 2024-08-02T01:59:49.914Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L) Vendors: CData Products: Sync Problem Types: CWE-22 Description: A path traversal vulnerability exists in the Java version of CData Sync < 23.4.8843 when running using the embedded Jetty server, which could allow an unauthenticated remote attacker to gain access to sensitive information and perform limited actions. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.tenable.com/security/research/tra-2024-09