Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-25714 State: PUBLISHED Published: 2024-02-11T00:00:00 Last Updated: 2024-08-01T23:52:06.192Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Rhonabwy through 1.1.13, HMAC signature verification uses a strcmp function that is vulnerable to side-channel attacks, because it stops the comparison when the first difference is spotted in the two signatures. (The fix uses gnutls_memcmp, which has constant-time execution.) Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/babelouest/rhonabwy/commit/f9fd9a1c77e48b514ebb3baf0360f87eef3d846e
CVE ID: CVE-2024-25715 State: PUBLISHED Published: 2024-02-11T00:00:00.000Z Last Updated: 2025-06-16T18:10:10.080Z Vendors: n/a Products: n/a Problem Types: n/a Description: Glewlwyd SSO server 2.x through 2.7.6 allows open redirection via redirect_uri. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/babelouest/glewlwyd/commit/59239381a88c505ab38fe64fdd92f846defa5754 - https://github.com/babelouest/glewlwyd/commit/c91c0155f2393274cc18efe77e06c6846e404c75
CVE ID: CVE-2024-25718 State: PUBLISHED Published: 2024-02-11T00:00:00.000Z Last Updated: 2025-04-24T15:45:22.426Z Vendors: n/a Products: n/a Problem Types: n/a Description: In the Samly package before 1.4.0 for Elixir, Samly.State.Store.get_assertion/3 can return an expired session, which interferes with access control because Samly.AuthHandler uses a cached session and does not replace it, even after expiry. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://hex.pm/packages/samly - https://github.com/handnot2/samly - https://github.com/dropbox/samly - https://diff.hex.pm/diff/samly/1.3.0..1.4.0 - https://github.com/dropbox/samly/pull/13 - http
github.com/dropbox/samly - https://diff.hex.pm/diff/samly/1.3.0..1.4.0 - https://github.com/dropbox/samly/pull/13 - https://github.com/dropbox/samly/pull/13/commits/812b5c3ad076dc9c9334c1a560c8e6470607d1eb
CVE ID: CVE-2024-25722 State: PUBLISHED Published: 2024-02-11T00:00:00.000Z Last Updated: 2025-06-11T20:20:55.765Z Vendors: n/a Products: n/a Problem Types: n/a Description: qanything_kernel/connector/database/mysql/mysql_client.py in qanything.ai QAnything before 1.2.0 allows SQL Injection. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/netease-youdao/QAnything/compare/v1.1.1...v1.2.0 - https://github.com/netease-youdao/QAnything/commit/35753b892c2c4361b318d68dfa3e251c85ce889c
CVE ID: CVE-2024-25723 State: PUBLISHED Published: 2024-02-27T00:00:00 Last Updated: 2024-08-01T23:52:05.824Z Vendors: n/a Products: n/a Problem Types: n/a Description: ZenML Server in the ZenML machine learning package before 0.46.7 for Python allows remote privilege escalation because the /api/v1/users/{user_name_or_id}/activate REST API endpoint allows access on the basis of a valid username along with a new password in the request body. These are also patched versions: 0.44.4, 0.43.1, and 0.42.2. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/zenml-io/zenml - https://www.zenml.io/blog/critical-security-update-for-zenml-users -
: References: - https://github.com/zenml-io/zenml - https://www.zenml.io/blog/critical-security-update-for-zenml-users - https://github.com/zenml-io/zenml/compare/0.44.3...0.44.4 - https://github.com/zenml-io/zenml/compare/0.43.0...0.43.1 - https://github.com/zenml-io/zenml/compare/0.42.1...0.42.2
CVE ID: CVE-2024-25724 State: PUBLISHED Published: 2024-05-21T18:38:01.402Z Last Updated: 2025-08-27T15:41:02.700Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AC:L/AV:L/A:H/C:L/I:H/PR:L/S:U/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: In RTI Connext Professional 5.3.1 through 6.1.0 before 6.1.1, a buffer overflow in XML parsing from Routing Service, Recording Service, Queuing Service, and Cloud Discovery Service allows attackers to execute code with the affected service's privileges, compromise the service's integrity, leak sensitive information, or crash the service. These attacks could be done via a remote malicious RTPS message; a compromised call with malicious parameters to th
ice. These attacks could be done via a remote malicious RTPS message; a compromised call with malicious parameters to the RTI_RoutingService_new, rti::recording::Service, RTI_QueuingService_new, or RTI_CDS_Service_new public APIs; or a compromised local file system containing a malicious XML file. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://community.rti.com/static/documentation/connext-dds/current/doc/vulnerabilities/index.html#cve-2024-25724
CVE ID: CVE-2024-25728 State: PUBLISHED Published: 2024-02-11T00:00:00 Last Updated: 2024-10-30T19:12:30.970Z Vendors: n/a Products: n/a Problem Types: n/a Description: ExpressVPN before 12.73.0 on Windows, when split tunneling is used, sends DNS requests according to the Windows configuration (e.g., sends them to DNS servers operated by the user's ISP instead of to the ExpressVPN DNS servers), which may allow remote attackers to obtain sensitive information about websites visited by VPN users. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.bleepingcomputer.com/news/security/expressvpn-bug-has-been-leaking-some-dns-requests-for-years/ -
rences: - https://www.bleepingcomputer.com/news/security/expressvpn-bug-has-been-leaking-some-dns-requests-for-years/ - https://www.expressvpn.com/blog/windows-app-dns-requests/
CVE ID: CVE-2024-25729 State: PUBLISHED Published: 2024-03-07T00:00:00 Last Updated: 2024-08-01T23:52:04.898Z Vendors: n/a Products: n/a Problem Types: n/a Description: Arris SBG6580 devices have predictable default WPA2 security passwords that could lead to unauthorized remote access. (They use the first 6 characters of the SSID and the last 6 characters of the BSSID, decrementing the last octet.) Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://i.ebayimg.com/images/g/DhoAAOSwx0FbhhcN/s-l1600.jpg - https://i.ebayimg.com/images/g/z2oAAOSwO1pbQ9BS/s-l1600.jpg - https://github.com/actuator/cve/blob/main/Arris/SBG6580.png - https://github.com/act
es/g/z2oAAOSwO1pbQ9BS/s-l1600.jpg - https://github.com/actuator/cve/blob/main/Arris/SBG6580.png - https://github.com/actuator/cve/blob/main/Arris/CVE-2024-25729
CVE ID: CVE-2024-25730 State: PUBLISHED Published: 2024-02-23T00:00:00 Last Updated: 2024-08-16T17:14:35.095Z Vendors: n/a Products: n/a Problem Types: n/a Description: Hitron CODA-4582 and CODA-4589 devices have default PSKs that are generated from 5-digit hex values concatenated with a "Hitron" substring, resulting in insufficient entropy (only about one million possibilities). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://i.ebayimg.com/images/g/I-8AAOSwGE9lsGwI/s-l1600.webp - https://i.ebayimg.com/images/g/qK8AAOSwbr9lq3PJ/s-l1600.webp - https://i.ebayimg.com/images/g/VDcAAOSwlodlSuz4/s-l1600.webp - https://i.ebayimg.com/images/g/MwMAAOS
3PJ/s-l1600.webp - https://i.ebayimg.com/images/g/VDcAAOSwlodlSuz4/s-l1600.webp - https://i.ebayimg.com/images/g/MwMAAOSwjTFk3kpd/s-l1600.webp - https://i.ebayimg.com/images/g/XaAAAOSwvMNkuESk/s-l1600.webp - https://i.ebayimg.com/images/g/hzUAAOSwUwVllGMZ/s-l1600.webp - https://github.com/actuator/cve/blob/main/Hitron/CVE-2024-25730
CVE ID: CVE-2024-25731 State: PUBLISHED Published: 2024-03-04T00:00:00.000Z Last Updated: 2025-03-26T20:08:09.570Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Elink Smart eSmartCam (com.cn.dq.ipc) application 2.1.5 for Android contains hardcoded AES encryption keys that can be extracted from a binary file. Thus, encryption can be defeated by an attacker who can observe packet data (e.g., over Wi-Fi). Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/actuator/com.cn.dq.ipc - https://github.com/actuator/com.cn.dq.ipc/blob/main/CVE-2024-25731
CVE ID: CVE-2024-25734 State: PUBLISHED Published: 2024-03-27T00:00:00.000Z Last Updated: 2025-11-04T18:29:40.322Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on WyreStorm Apollo VX20 devices before 1.3.58. The TELNET service prompts for a password only after a valid username is entered, which might make it easier for remote attackers to enumerate user accounts. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://hyp3rlinx.altervista.org - http://packetstormsecurity.com/files/177081
CVE ID: CVE-2024-25735 State: PUBLISHED Published: 2024-03-27T00:00:00.000Z Last Updated: 2025-11-04T18:29:41.526Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on WyreStorm Apollo VX20 devices before 1.3.58. Remote attackers can discover cleartext passwords via a SoftAP /device/config GET request. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://hyp3rlinx.altervista.org - http://packetstormsecurity.com/files/177082
CVE ID: CVE-2024-25736 State: PUBLISHED Published: 2024-03-27T00:00:00.000Z Last Updated: 2025-11-04T18:29:42.753Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on WyreStorm Apollo VX20 devices before 1.3.58. Remote attackers can restart the device via a /device/reboot GET request. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://hyp3rlinx.altervista.org - http://packetstormsecurity.com/files/177083
CVE ID: CVE-2024-25737 State: PUBLISHED Published: 2024-05-22T19:05:25.776Z Last Updated: 2025-02-13T15:47:11.915Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Server-Side Request Forgery (SSRF) vulnerability in the /Cover/Show route (showAction in CoverController.php) in Open Library Foundation VuFind 2.4 through 9.1 before 9.1.1 allows remote attackers to access internal HTTP servers and perform Cross-Site Scripting (XSS) attacks by proxying arbitrary URLs via the proxy GET parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/vufind-org/vufind/commit/345d00f7d7f1c581f46742effdac70e803b3847b - https://github.
er: References: - https://github.com/vufind-org/vufind/commit/345d00f7d7f1c581f46742effdac70e803b3847b - https://github.com/vufind-org/vufind/commit/51f2ddac0dc1047e6fd3b27e6d984b19e1601d00 - https://vufind.org/wiki/security:cve-2024-25737
CVE ID: CVE-2024-25738 State: PUBLISHED Published: 2024-05-22T18:56:47.568Z Last Updated: 2025-02-13T15:47:12.407Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Server-Side Request Forgery (SSRF) vulnerability in the /Upgrade/FixConfig route in Open Library Foundation VuFind 2.0 through 9.1 before 9.1.1 allows a remote attacker to overwrite local configuration files to gain access to the administrator panel and achieve Remote Code Execution. A mitigating factor is that it requires the allow_url_include PHP runtime setting to be on, which is off in default installations. It also requires the /Upgrade route to be exposed, which is exposed by default after installing VuFind, and
tallations. It also requires the /Upgrade route to be exposed, which is exposed by default after installing VuFind, and is recommended to be disabled by setting autoConfigure to false in config.ini. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vufind.org/wiki/security:cve-2024-25738
CVE ID: CVE-2024-25739 State: PUBLISHED Published: 2024-02-12T00:00:00.000Z Last Updated: 2025-03-14T18:24:22.750Z Vendors: n/a Products: n/a Problem Types: n/a Description: create_empty_lvol in drivers/mtd/ubi/vtbl.c in the Linux kernel through 6.7.4 can attempt to allocate zero bytes, and crash, because of a missing check for ubi->leb_size. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.spinics.net/lists/kernel/msg5074816.html - https://groups.google.com/g/syzkaller/c/Xl97YcQA4hg - https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=68a24aba7c593eafa8fd00f2f76407b9b32b47a9 - https://lists.debian.org/debian-lts-an
rnel/git/torvalds/linux.git/commit/?id=68a24aba7c593eafa8fd00f2f76407b9b32b47a9 - https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html - https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html - https://web.git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/drivers/mtd/ubi/vtbl.c?h=v6.6.24&id=d1b505c988b7
CVE ID: CVE-2024-25740 State: PUBLISHED Published: 2024-02-12T00:00:00.000Z Last Updated: 2025-05-07T21:05:09.235Z Vendors: n/a Products: n/a Problem Types: n/a Description: A memory leak flaw was found in the UBI driver in drivers/mtd/ubi/attach.c in the Linux kernel through 6.7.4 for UBI_IOCATT, because kobj->name is not released. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://lore.kernel.org/lkml/0171b6cc-95ee-3538-913b-65a391a446b3%40huawei.com/T/
CVE ID: CVE-2024-25741 State: PUBLISHED Published: 2024-02-12T00:00:00.000Z Last Updated: 2025-11-03T21:54:05.600Z Vendors: n/a Products: n/a Problem Types: n/a Description: printer_write in drivers/usb/gadget/function/f_printer.c in the Linux kernel through 6.7.4 does not properly call usb_ep_queue, which might allow attackers to cause a denial of service or have unspecified other impact. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.spinics.net/lists/linux-usb/msg252167.html
CVE ID: CVE-2024-25742 State: PUBLISHED Published: 2024-05-17T21:14:08.723Z Last Updated: 2025-03-27T20:08:11.967Z Vendors: n/a Products: n/a Problem Types: n/a Description: In the Linux kernel before 6.9, an untrusted hypervisor can inject virtual interrupt 29 (#VC) at any point in time and can trigger its handler. This affects AMD SEV-SNP and AMD SEV-ES. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.amd.com/en/resources/product-security/bulletin/amd-sb-3008.html - https://github.com/torvalds/linux/commit/e3ef461af35a8c74f2f4ce6616491ddb355a208f - https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=e3ef461af35a8c
8c74f2f4ce6616491ddb355a208f - https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=e3ef461af35a8c74f2f4ce6616491ddb355a208f - https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.9
CVE ID: CVE-2024-25743 State: PUBLISHED Published: 2024-05-15T17:43:31.216Z Last Updated: 2025-03-14T19:05:38.011Z Vendors: n/a Products: n/a Problem Types: n/a Description: In the Linux kernel through 6.9, an untrusted hypervisor can inject virtual interrupts 0 and 14 at any point in time and can trigger the SIGFPE signal handler in userspace applications. This affects AMD SEV-SNP and AMD SEV-ES. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.amd.com/en/resources/product-security/bulletin/amd-sb-3008.html - https://bugzilla.suse.com/show_bug.cgi?id=1223307 - https://bugzilla.redhat.com/show_bug.cgi?id=2270836
CVE ID: CVE-2024-25744 State: PUBLISHED Published: 2024-02-12T00:00:00.000Z Last Updated: 2025-05-07T21:07:20.990Z Vendors: n/a Products: n/a Problem Types: n/a Description: In the Linux kernel before 6.6.7, an untrusted VMM can trigger int80 syscall handling at any given point. This is related to arch/x86/coco/tdx/tdx.c and arch/x86/mm/mem_encrypt_amd.c. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=b82a8dbd3d2f4563156f7150c6f2ecab6e960b30 - https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.6.7
CVE ID: CVE-2024-25746 State: PUBLISHED Published: 2024-02-22T00:00:00 Last Updated: 2024-08-28T17:57:28.459Z Vendors: n/a Products: n/a Problem Types: n/a Description: Stack Based Buffer Overflow vulnerability in Tenda AC9 v.3.0 with firmware version v.15.03.06.42_multi allows a remote attacker to execute arbitrary code via the add_white_node function. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/TimeSeg/IOT_CVE/blob/main/tenda/AC9V3/0218/add_white_node.md
CVE ID: CVE-2024-25748 State: PUBLISHED Published: 2024-02-22T00:00:00 Last Updated: 2024-08-28T17:55:46.333Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Stack Based Buffer Overflow vulnerability in tenda AC9 AC9 v.3.0 with firmware version v.15.03.06.42_multi allows a remote attacker to execute arbitrary code via the fromSetIpMacBind function. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/TimeSeg/IOT_CVE/blob/main/tenda/AC9V3/0218/fromSetIpMacBind.md
CVE ID: CVE-2024-25751 State: PUBLISHED Published: 2024-02-26T00:00:00 Last Updated: 2024-08-27T19:00:23.880Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Stack Based Buffer Overflow vulnerability in Tenda AC9 v.3.0 with firmware version v.15.03.06.42_multi allows a remote attacker to execute arbitrary code via the fromSetSysTime function. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/TimeSeg/IOT_CVE/blob/main/tenda/AC9V3/0218/fromSetSysTime.md
CVE ID: CVE-2024-25753 State: PUBLISHED Published: 2024-02-22T00:00:00 Last Updated: 2024-08-01T23:52:06.359Z Vendors: n/a Products: n/a Problem Types: n/a Description: Stack Based Buffer Overflow vulnerability in Tenda AC9 v.3.0 with firmware version v.15.03.06.42_multi allows a remote attacker to execute arbitrary code via the formSetDeviceName function. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/TimeSeg/IOT_CVE/blob/main/tenda/AC9V3/0218/formSetDeviceName.md
CVE ID: CVE-2024-25756 State: PUBLISHED Published: 2024-02-22T00:00:00 Last Updated: 2024-08-01T23:52:05.902Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Stack Based Buffer Overflow vulnerability in Tenda AC9 v.3.0 with firmware version v.15.03.06.42_multi allows a remote attacker to execute arbitrary code via the formWifiBasicSet function. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/TimeSeg/IOT_CVE/blob/main/tenda/AC9V3/0218/formWifiBasicSet.md
CVE ID: CVE-2024-25760 State: REJECTED Published: N/A Last Updated: 2024-02-27T14:46:53.958900 Description: No description available.
CVE ID: CVE-2024-25763 State: PUBLISHED Published: 2024-02-26T00:00:00 Last Updated: 2024-12-06T21:05:20.074Z Vendors: n/a Products: n/a Problem Types: n/a Description: openNDS 10.2.0 is vulnerable to Use-After-Free via /openNDS/src/auth.c. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/LuMingYinDetect/openNDS_defects/blob/main/openNDS_detect_1.md
CVE ID: CVE-2024-25767 State: PUBLISHED Published: 2024-02-26T00:00:00 Last Updated: 2024-10-27T00:59:44.786Z Vendors: n/a Products: n/a Problem Types: n/a Description: nanomq 0.21.2 contains a Use-After-Free vulnerability in /nanomq/nng/src/core/socket.c. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/LuMingYinDetect/nanomq_defects/blob/main/nanomq_detect_1.md
CVE ID: CVE-2024-25768 State: PUBLISHED Published: 2024-02-26T00:00:00 Last Updated: 2024-10-29T20:27:00.524Z Vendors: n/a Products: n/a Problem Types: n/a Description: OpenDMARC 1.4.2 contains a null pointer dereference vulnerability in /OpenDMARC/libopendmarc/opendmarc_policy.c. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/LuMingYinDetect/OpenDMARC_defects/blob/main/OpenDMARC_detect_1.md
CVE ID: CVE-2024-25770 State: PUBLISHED Published: 2024-02-26T00:00:00 Last Updated: 2024-08-09T14:49:02.239Z Vendors: n/a Products: n/a Problem Types: n/a Description: libming 0.4.8 contains a memory leak vulnerability in /libming/src/actioncompiler/listaction.c. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/LuMingYinDetect/libming_defects/blob/main/libming_detect_1.md
CVE ID: CVE-2024-25801 State: PUBLISHED Published: 2024-02-22T00:00:00.000Z Last Updated: 2025-03-13T16:09:02.623Z Vendors: n/a Products: n/a Problem Types: n/a Description: SKINsoft S-Museum 7.02.3 allows XSS via the filename of an uploaded file. Unlike in CVE-2024-25802, the attack payload is in the name (not the content) of a file. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://shrouded-trowel-50c.notion.site/S-Museum-Version-7-02-3-Stored-Cross-Site-Scripting-69ca7b8805cc448ea12cb8f7ed571fa3?pvs=4
CVE ID: CVE-2024-25802 State: PUBLISHED Published: 2024-02-22T00:00:00 Last Updated: 2024-10-30T14:01:17.260Z Vendors: n/a Products: n/a Problem Types: n/a Description: SKINsoft S-Museum 7.02.3 allows Unrestricted File Upload via the Add Media function. Unlike in CVE-2024-25801, the attack payload is the file content. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://shrouded-trowel-50c.notion.site/S-Museum-Version-7-02-3-Unrestricted-File-Upload-b73d4590b024449787464ddcc175b8f7?pvs=4
CVE ID: CVE-2024-25807 State: PUBLISHED Published: 2024-03-22T00:00:00 Last Updated: 2024-08-01T23:52:05.723Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting (XSS) vulnerability in Lychee 3.1.6, allows remote attackers to execute arbitrary code and obtain sensitive information via the title parameter when creating an album. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/Hebing123/cve/issues/17
CVE ID: CVE-2024-25808 State: PUBLISHED Published: 2024-03-22T00:00:00 Last Updated: 2024-09-06T16:17:59.477Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site Request Forgery (CSRF) vulnerability in Lychee version 3.1.6, allows remote attackers to execute arbitrary code via the create new album function. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/Hebing123/cve/issues/17
CVE ID: CVE-2024-25811 State: PUBLISHED Published: 2024-02-29T00:00:00 Last Updated: 2024-08-04T11:34:06.580Z Vendors: n/a Products: n/a Problem Types: n/a Description: An access control issue in Dreamer CMS v4.0.1 allows attackers to download backup files and leak sensitive information. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/Fei123-design/vuln/blob/master/Dreamer%20CMS%20Unauthorized%20access%20vulnerability.md
CVE ID: CVE-2024-25817 State: PUBLISHED Published: 2024-03-05T00:00:00 Last Updated: 2024-08-08T20:39:42.193Z Vendors: n/a Products: n/a Problem Types: n/a Description: Buffer Overflow vulnerability in eza before version 0.18.2, allows local attackers to execute arbitrary code via the .git/HEAD, .git/refs, and .git/objects components. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/advisories/GHSA-3qx3-6hxr-j2ch - https://www.cubeyond.net/blog/my-cves/eza-cve-report
CVE ID: CVE-2024-25825 State: PUBLISHED Published: 2024-10-09T00:00:00 Last Updated: 2024-10-10T15:37:49.835Z Vendors: n/a Products: n/a Problem Types: n/a Description: FydeOS for PC 17.1 R114, FydeOS for VMware 17.0 R114, FydeOS for You 17.1 R114, and OpenFyde R114 were discovered to be configured with the root password saved as a wildcard. This allows attackers to gain root access without a password. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://fydeos.io/ - https://openfyde.io/ - https://github.com/openFyde/ - https://gist.github.com/hchasens/d20dff418f6908dc96e65f4e43a058f1