Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-48048 State: PUBLISHED Published: 2024-10-17T12:17:31.221Z Last Updated: 2024-10-17T13:05:08.540Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: WSIFY – Sales can fly Products: Wsify Widget Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in WSIFY – Sales can fly Wsify Widget allows Stored XSS.This issue affects Wsify Widget: from n/a through 1.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/wsify-widget/wordpress-wsify-widget-plugin-1-0-csrf-to-stored-xss-vulnerability?_s_id=cve
CVE ID: CVE-2024-48049 State: PUBLISHED Published: 2024-10-20T07:54:23.053Z Last Updated: 2024-10-20T13:34:00.395Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: Mighty Plugins Products: Mighty Builder Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Mighty Plugins Mighty Builder allows Stored XSS.This issue affects Mighty Builder: from n/a through 1.0.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/mighty-builder/wordpress-mighty-builder-plugin-1-0-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2024-48050 State: PUBLISHED Published: 2024-11-04T00:00:00 Last Updated: 2024-11-06T21:02:15.321Z Vendors: n/a Products: n/a Problem Types: n/a Description: In agentscope <=v0.0.4, the file agentscope\web\workstation\workflow_utils.py has the function is_callable_expression. Within this function, the line result = eval(s) poses a security risk as it can directly execute user-provided commands. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://rumbling-slice-eb0.notion.site/Unauthenticated-Remote-Code-Execution-via-The-use-of-eval-in-is_callable_expression-and-sanitize_nod-cd4ea6c576da4e0b965ef596855c298d - https://gist.github.com/AfterSnows/0ad9d233a9d2a5b7
lable_expression-and-sanitize_nod-cd4ea6c576da4e0b965ef596855c298d - https://gist.github.com/AfterSnows/0ad9d233a9d2a5b7e6e5273e2e23508d
CVE ID: CVE-2024-48052 State: PUBLISHED Published: 2024-11-04T00:00:00 Last Updated: 2024-11-06T19:21:09.673Z Vendors: n/a Products: n/a Problem Types: n/a Description: In gradio <=4.42.0, the gr.DownloadButton function has a hidden server-side request forgery (SSRF) vulnerability. The reason is that within the save_url_to_cache function, there are no restrictions on the URL, which allows access to local target resources. This can lead to the download of local resources and sensitive information. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://rumbling-slice-eb0.notion.site/FULL-SSRF-in-gr-DownloadButton-in-gradio-app-gradio-870b21e0908b48cbafd914719ac1a4e6?pvs=4 - h
ing-slice-eb0.notion.site/FULL-SSRF-in-gr-DownloadButton-in-gradio-app-gradio-870b21e0908b48cbafd914719ac1a4e6?pvs=4 - https://gist.github.com/AfterSnows/45ffc23797f9127e00755376cc610e12
CVE ID: CVE-2024-48057 State: PUBLISHED Published: 2024-11-04T00:00:00 Last Updated: 2024-11-05T17:28:51.570Z Vendors: n/a Products: n/a Problem Types: n/a Description: localai <=2.20.1 is vulnerable to Cross Site Scripting (XSS). When calling the delete model API and passing inappropriate parameters, it can cause a one-time storage XSS, which will trigger the payload when a user accesses the homepage. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://rumbling-slice-eb0.notion.site/LocalAI-deleted-model-with-storage-XSS-CSRF-vulnerability-in-mudler-localai-101e3cda9e8c80e0ac12fe418d5dd982?pvs=4 - https://gist.github.com/AfterSnows/1bd7ee5a3a42dbb5f5ff67f7f9c8ccec
CVE ID: CVE-2024-48059 State: PUBLISHED Published: 2024-11-04T00:00:00 Last Updated: 2024-11-05T21:24:41.074Z Vendors: n/a Products: n/a Problem Types: n/a Description: gaizhenbiao/chuanhuchatgpt project, version <=20240802 is vulnerable to stored Cross-Site Scripting (XSS) in WebSocket session transmission. An attacker can inject malicious content into a WebSocket message. When a victim accesses this session, the malicious JavaScript is executed in the victim's browser. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://rumbling-slice-eb0.notion.site/Stored-XSS-via-Chat-message-in-gaizhenbiao-chuanhuchatgpt-104e3cda9e8c80b4b611dfc491c488d8?pvs=4 - https://gist.github.c
Stored-XSS-via-Chat-message-in-gaizhenbiao-chuanhuchatgpt-104e3cda9e8c80b4b611dfc491c488d8?pvs=4 - https://gist.github.com/AfterSnows/c5a4cb029fb9142be5c54e531a9a240e
CVE ID: CVE-2024-48061 State: PUBLISHED Published: 2024-11-04T00:00:00 Last Updated: 2024-11-06T19:18:23.293Z Vendors: n/a Products: n/a Problem Types: n/a Description: langflow <=1.0.18 is vulnerable to Remote Code Execution (RCE) as any component provided the code functionality and the components run on the local machine rather than in a sandbox. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://rumbling-slice-eb0.notion.site/There-is-a-Remote-Code-Execution-RCE-vulnerability-in-the-repository-https-github-com-langflow-a-105e3cda9e8c800fac92f1b571bd40d8 - https://gist.github.com/AfterSnows/1e58257867002462923fd62dde2b5d61
CVE ID: CVE-2024-48063 State: PUBLISHED Published: 2024-10-29T00:00:00 Last Updated: 2025-01-09T17:22:47.091Z Vendors: n/a Products: n/a Problem Types: n/a Description: In PyTorch <=2.4.1, the RemoteModule has Deserialization RCE. NOTE: this is disputed by multiple parties because this is intended behavior in PyTorch distributed computing. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://rumbling-slice-eb0.notion.site/Distributed-RPC-Framework-RemoteModule-has-Deserialization-RCE-in-pytorch-pytorch-111e3cda9e8c8021a7d3cbc61ee1a20c - https://gist.github.com/hexian2001/c046c066895a963ecc0a2cf9e1180065 - https://github.com/pytorch/pytorch/issues/129228 - https://github.c
ub.com/hexian2001/c046c066895a963ecc0a2cf9e1180065 - https://github.com/pytorch/pytorch/issues/129228 - https://github.com/pytorch/pytorch/security/policy#using-distributed-features
CVE ID: CVE-2024-48068 State: PUBLISHED Published: 2024-11-15T00:00:00 Last Updated: 2024-11-21T18:11:47.821Z Vendors: n/a Products: n/a Problem Types: n/a Description: A cross-site scripting (XSS) vulnerability in Shenzhen Landray Software Co.,LTD Landray EKP v16 and earlier allows attackers to execute arbitrary web scripts or HTML via a crafted payload. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gist.github.com/CoinIsMoney/3448ba7c3e0cf01c3cbc6e2ab280d3c3 - https://www.landray.com.cn/
CVE ID: CVE-2024-48069 State: PUBLISHED Published: 2024-11-19T00:00:00 Last Updated: 2024-11-21T16:32:21.047Z Vendors: n/a Products: n/a Problem Types: n/a Description: A vulnerability was found in Weaver E-cology allows attackers use race conditions to bypass security mechanisms to upload malicious files and control server privileges Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/stuven1989/TemporaryGuild/blob/main/guild2.md - https://gist.github.com/CoinIsMoney/5dd555805e8f974630ced8a1df8182f1
CVE ID: CVE-2024-48070 State: PUBLISHED Published: 2024-11-19T00:00:00 Last Updated: 2024-11-21T16:36:00.273Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in Weaver E-cology v. attackers construct special requests to insert remote malicious code and to trigger malicious code execution, and control server privileges Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/stuven1989/TemporaryGuild/blob/main/files/exp2-eng.pdf - https://gist.github.com/CoinIsMoney/ec863c35dfd05c7deea2afea11bf2446
CVE ID: CVE-2024-48071 State: PUBLISHED Published: 2024-11-19T00:00:00 Last Updated: 2024-11-21T16:38:59.609Z Vendors: n/a Products: n/a Problem Types: n/a Description: E-cology has a directory traversal vulnerability. An attacker can exploit this vulnerability to delete the server directory, causing the server to permanently deny service. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/stuven1989/TemporaryGuild/blob/main/files/exp-eng-3.pdf - https://gist.github.com/CoinIsMoney/d437f267f2d65cb80dd7da97cb2068e8
CVE ID: CVE-2024-48072 State: PUBLISHED Published: 2024-11-19T00:00:00 Last Updated: 2024-11-21T16:31:38.408Z Vendors: n/a Products: n/a Problem Types: n/a Description: Weaver Ecology v9.* was discovered to contain a SQL injection vulnerability via the component /mobilemode/Action.jsp?invoker=com.weaver.formmodel.mobile.mec.servlet.MECAction&action=getFieldTriggerValue&searchField=*&fromTable=HrmResourceManager&whereClause=1%3d1&triggerCondition=1&expression=%3d&fieldValue=1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/stuven1989/TemporaryGuild/blob/main/files/exp-eng4.pdf - https://gist.github.com/CoinIsMoney/8ca1f2bf2e0399724c698327f2da8579
CVE ID: CVE-2024-48073 State: PUBLISHED Published: 2024-11-08T00:00:00 Last Updated: 2024-11-18T14:43:39.165Z Vendors: n/a Products: n/a Problem Types: n/a Description: sunniwell HT3300 before 1.0.0.B022.2 is vulnerable to Insecure Permissions. The /usr/local/bin/update program, which is responsible for updating the software in the HT3300 device, is given the execution mode of sudo NOPASSWD. This program is vulnerable to a command injection vulnerability, which could allow an attacker to pass commands to this program via command line arguments to gain elevated root privileges. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Giles-one/sunniwellHT3300Privile
es. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Giles-one/sunniwellHT3300PrivilegeEscalation - https://gist.github.com/Giles-one/56f677b96aab5a67fbe31dd41fd1303d
CVE ID: CVE-2024-48074 State: PUBLISHED Published: 2024-10-28T00:00:00 Last Updated: 2024-11-08T21:08:35.165705 Vendors: n/a Products: n/a Problem Types: n/a Description: An authorized RCE vulnerability exists in the DrayTek Vigor2960 router version 1.4.4, where an attacker can place a malicious command into the table parameter of the doPPPoE function in the cgi-bin/mainfunction.cgi route, and finally the command is executed by the system function. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Giles-one/Vigor2960Crack - https://gist.github.com/Giles-one/6425e97dcd1ec97a722a1e20da25fad7
CVE ID: CVE-2024-48075 State: PUBLISHED Published: 2024-11-12T00:00:00.000Z Last Updated: 2025-09-15T19:22:30.834Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Heap buffer overflow in the server-site handshake implementation in Real Time Logic SharkSSL from 09/09/24 and earlier allows a remote attacker to trigger a Denial-of-Service via a malformed TLS Client Key Exchange message. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/RealTimeLogic/SharkSSL/commit/7045f6f254060640ff77eef2027f108fcc20e2f2 - https://www.telekom.com/resource/blob/1083076/8bf5c03520005b8e699dfb9bce470fc7/dl-241104-cve-2024-48075-data.pdf
CVE ID: CVE-2024-48080 State: PUBLISHED Published: 2024-12-03T00:00:00.000Z Last Updated: 2025-02-21T05:22:04.641Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in aedes v0.51.2 allows attackers to cause a Denial of Service(DoS) via a crafted request. NOTE: the Supplier indicates that exploitation cannot occur because of the protection mechanism in the validateTopic function in lib/utils.js. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gist.github.com/pengwGit/cd3c1701a9e05b424fa6c60d86845de4 - https://github.com/moscajs/aedes/releases/tag/v0.51.2 - https://github.com/moscajs/aedes/issues/1024 - https://gist.github.com/mcollina/f06af2098665e4
es/releases/tag/v0.51.2 - https://github.com/moscajs/aedes/issues/1024 - https://gist.github.com/mcollina/f06af2098665e4bb8372104425f3999e - https://github.com/moscajs/aedes/issues/1024#issuecomment-2671695219
CVE ID: CVE-2024-48091 State: PUBLISHED Published: 2025-02-07T00:00:00.000Z Last Updated: 2025-02-10T16:50:57.223Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tally Prime Edit Log v2.1 was discovered to contain a DLL hijacking vulnerability via the component TextShaping.dll. This vulnerability allows attackers to execute arbitrary code via a crafted DLL. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://tallysolutions.com/download/ - https://gist.github.com/singhmanpreet493/0f1df7fa4e744a3317877ab85d187937#file-gistfile1-txt
CVE ID: CVE-2024-48093 State: PUBLISHED Published: 2024-10-30T00:00:00 Last Updated: 2024-10-31T14:24:51.128Z Vendors: n/a Products: n/a Problem Types: n/a Description: Unrestricted File Upload in the Discussions tab in Operately v.0.1.0 allows a privileged user to achieve Remote Code Execution via uploading and executing malicious files without validating file extensions or content types. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://youtu.be/rCYIohrQdxM - https://github.com/yamerooo123/CVE/blob/main/CVE-2024-48093/Description.md
CVE ID: CVE-2024-48107 State: PUBLISHED Published: 2024-10-28T00:00:00 Last Updated: 2024-10-30T16:59:38.111Z Vendors: n/a Products: n/a Problem Types: n/a Description: SparkShop <=1.1.7 is vulnerable to server-side request forgery (SSRF). This vulnerability allows attacks to scan ports on the Intranet or local network where the server resides, attack applications running on the Intranet or local network, or read metadata on the cloud server. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitee.com/sparkshop/sparkshop - https://gist.github.com/RMAX2000/ebb654016e5b8a5b55aa6d8a7f2f321a#file-cve-2024-48107
CVE ID: CVE-2024-48112 State: PUBLISHED Published: 2024-10-30T00:00:00 Last Updated: 2024-10-31T14:07:13.314Z Vendors: n/a Products: n/a Problem Types: n/a Description: A deserialization vulnerability in the component \controller\Index.php of Thinkphp v6.1.3 to v8.0.4 allows attackers to execute arbitrary code. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/top-think/think - https://github.com/nn0nkey/nn0nkey/blob/main/Thinkphp/CVE-2024-48112.md
CVE ID: CVE-2024-48119 State: PUBLISHED Published: 2024-10-14T00:00:00 Last Updated: 2024-10-17T17:32:57.909Z Vendors: n/a Products: n/a Problem Types: n/a Description: Vtiger CRM v8.2.0 has a HTML Injection vulnerability in the module parameter. Authenticated users can inject arbitrary HTML. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://okankurtulus.com.tr/2024/09/12/vtiger-crm-v8-2-0-html-injection-authenticated/
CVE ID: CVE-2024-48120 State: PUBLISHED Published: 2024-10-14T00:00:00 Last Updated: 2024-10-15T15:22:16.044Z Vendors: n/a Products: n/a Problem Types: n/a Description: X2CRM v8.5 is vulnerable to a stored Cross-Site Scripting (XSS) in the "Opportunities" module. An attacker can inject malicious JavaScript code into the "Name" field when creating a list. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://okankurtulus.com.tr/2024/09/12/x2crm-v8-5-stored-cross-site-scripting-xss-authenticated/
CVE ID: CVE-2024-48121 State: PUBLISHED Published: 2025-01-15T00:00:00.000Z Last Updated: 2025-02-03T17:17:55.196Z Vendors: n/a Products: n/a Problem Types: n/a Description: The HI-SCAN 6040i Hitrax HX-03-19-I was discovered to transmit user credentials in cleartext over the GIOP protocol. This allows attackers to possibly gain access to sensitive information via a man-in-the-middle attack. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://kth.diva-portal.org/smash/get/diva2:1876534/FULLTEXT01.pdf
CVE ID: CVE-2024-48122 State: PUBLISHED Published: 2025-01-15T00:00:00.000Z Last Updated: 2025-02-03T17:18:29.545Z Vendors: n/a Products: n/a Problem Types: n/a Description: Insecure default configurations in HI-SCAN 6040i Hitrax HX-03-19-I allow authenticated attackers with low-level privileges to escalate to root-level privileges. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://kth.diva-portal.org/smash/get/diva2:1876534/FULLTEXT01.pdf
CVE ID: CVE-2024-48123 State: PUBLISHED Published: 2025-01-15T00:00:00.000Z Last Updated: 2025-02-03T17:35:38.045Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in the USB Autorun function of HI-SCAN 6040i Hitrax HX-03-19-I allows attackers to execute arbitrary code via uploading a crafted script from a USB device. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://kth.diva-portal.org/smash/get/diva2:1876534/FULLTEXT01.pdf
CVE ID: CVE-2024-48125 State: PUBLISHED Published: 2025-01-15T00:00:00.000Z Last Updated: 2025-03-18T14:17:40.445Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in the AsDB service of HI-SCAN 6040i Hitrax HX-03-19-I allows attackers to enumerate user credentials via crafted GIOP protocol requests. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://kth.diva-portal.org/smash/get/diva2:1876534/FULLTEXT01.pdf
CVE ID: CVE-2024-48126 State: PUBLISHED Published: 2025-01-15T00:00:00.000Z Last Updated: 2025-03-18T20:38:07.525Z Vendors: n/a Products: n/a Problem Types: n/a Description: HI-SCAN 6040i Hitrax HX-03-19-I was discovered to contain hardcoded credentials for access to vendor support and service access. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://kth.diva-portal.org/smash/get/diva2:1876534/FULLTEXT01.pdf
CVE ID: CVE-2024-48138 State: PUBLISHED Published: 2024-10-29T00:00:00 Last Updated: 2024-10-30T14:38:55.614Z Vendors: n/a Products: n/a Problem Types: n/a Description: A remote code execution (RCE) vulnerability in the component /PluXml/core/admin/parametres_edittpl.php of PluXml v5.8.16 and lower allows attackers to execute arbitrary code via injecting a crafted payload into a template. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/pluxml/PluXml/issues/829
CVE ID: CVE-2024-48139 State: PUBLISHED Published: 2024-10-24T00:00:00 Last Updated: 2024-10-25T18:48:51.427Z Vendors: n/a Products: n/a Problem Types: n/a Description: A prompt injection vulnerability in the chatbox of Blackbox AI v1.3.95 allows attackers to access and exfiltrate all previous and subsequent chat data between the user and the AI assistant via a crafted message. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://marketplace.visualstudio.com/items?itemName=Blackboxapp.blackbox - https://github.com/soursec/CVEs/tree/main/CVE-2024-48139
CVE ID: CVE-2024-48140 State: PUBLISHED Published: 2024-10-24T00:00:00 Last Updated: 2024-10-25T18:41:46.065Z Vendors: n/a Products: n/a Problem Types: n/a Description: A prompt injection vulnerability in the chatbox of Butterfly Effect Limited Monica Your AI Copilot powered by ChatGPT4 v6.3.0 allows attackers to access and exfiltrate all previous and subsequent chat data between the user and the AI assistant via a crafted message. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://chromewebstore.google.com/detail/monica-your-ai-copilot-po/ofpnmcalabcbjgholdjcjblkibolbppb?hl=en - https://github.com/soursec/CVEs/tree/main/CVE-2024-48140
CVE ID: CVE-2024-48141 State: PUBLISHED Published: 2024-10-24T00:00:00 Last Updated: 2024-10-25T18:29:20.156Z Vendors: n/a Products: n/a Problem Types: n/a Description: A prompt injection vulnerability in the chatbox of Zhipu AI CodeGeeX v2.17.0 allows attackers to access and exfiltrate all previous and subsequent chat data between the user and the AI assistant via a crafted message. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://marketplace.visualstudio.com/items?itemName=aminer.codegeex - https://github.com/soursec/CVEs/tree/main/CVE-2024-48141
CVE ID: CVE-2024-48142 State: PUBLISHED Published: 2024-10-24T00:00:00 Last Updated: 2024-10-25T17:50:54.270Z Vendors: n/a Products: n/a Problem Types: n/a Description: A prompt injection vulnerability in the chatbox of Butterfly Effect Limited Monica ChatGPT AI Assistant v2.4.0 allows attackers to access and exfiltrate all previous and subsequent chat data between the user and the AI assistant via a crafted message. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://monica.im/desktop - https://github.com/soursec/CVEs/tree/main/CVE-2024-48142
CVE ID: CVE-2024-48143 State: PUBLISHED Published: 2024-10-24T00:00:00 Last Updated: 2024-10-25T17:41:32.102Z Vendors: n/a Products: n/a Problem Types: n/a Description: A lack of rate limiting in the OTP validation component of Digitory Multi Channel Integrated POS v1.0 allows attackers to gain access to the ordering system and place an excessive amount of food orders. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://digitory.com/multi-channel-integrated-pos/ - https://github.com/soursec/CVEs/tree/main/CVE-2024-48143
CVE ID: CVE-2024-48144 State: PUBLISHED Published: 2024-10-24T00:00:00 Last Updated: 2024-10-28T19:54:03.409Z Vendors: n/a Products: n/a Problem Types: n/a Description: A prompt injection vulnerability in the chatbox of Fusion Chat Chat AI Assistant Ask Me Anything v1.2.4.0 allows attackers to access and exfiltrate all previous and subsequent chat data between the user and the AI assistant via a crafted message. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://apps.microsoft.com/detail/9n3ff8j3d7zr?hl=en-US&gl=US - https://github.com/soursec/CVEs/tree/main/CVE-2024-48144
CVE ID: CVE-2024-48145 State: PUBLISHED Published: 2024-10-24T00:00:00 Last Updated: 2024-10-28T19:51:43.280Z Vendors: n/a Products: n/a Problem Types: n/a Description: A prompt injection vulnerability in the chatbox of Netangular Technologies ChatNet AI Version v1.0 allows attackers to access and exfiltrate all previous and subsequent chat data between the user and the AI assistant via a crafted message. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://apps.microsoft.com/detail/9n3zxd05895t?hl=en-us&gl=US - https://github.com/soursec/CVEs/tree/main/CVE-2024-48145
CVE ID: CVE-2024-48150 State: PUBLISHED Published: 2024-10-14T00:00:00 Last Updated: 2024-10-15T15:41:17.371Z Vendors: n/a Products: n/a Problem Types: n/a Description: D-Link DIR-820L 1.05B03 has a stack overflow vulnerability in the sub_451208 function. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/fu37kola/cve/blob/main/D-Link/DIR-820L/D-Link%20DIR-820L%20Stack%20Overflow%20Vulnerability.md
CVE ID: CVE-2024-48153 State: PUBLISHED Published: 2024-10-14T00:00:00 Last Updated: 2024-10-17T17:26:45.530Z Vendors: n/a Products: n/a Problem Types: n/a Description: DrayTek Vigor3900 1.5.1.3 allows attackers to inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the get_subconfig function. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/tw11ty/CVE/blob/main/DrayTek/Vigor3900/Vigor3900%20command%20execution%20vulnerability.md
CVE ID: CVE-2024-48168 State: PUBLISHED Published: 2024-10-14T00:00:00 Last Updated: 2024-10-15T15:32:57.205Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stack overflow vulnerability exists in the sub_402280 function of the HNAP service of D-Link DCS-960L 1.09, allowing an attacker to execute arbitrary code. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/fu37kola/cve/blob/main/D-Link/DCS-960L/D-Link%20DCS-960L%201.09%20Stack%20overflow_1.md
CVE ID: CVE-2024-48170 State: PUBLISHED Published: 2025-02-10T00:00:00.000Z Last Updated: 2025-02-18T19:57:49.814Z Vendors: n/a Products: n/a Problem Types: n/a Description: PHPGurukul Small CRM 3.0 is vulnerable to Cross Site Scripting (XSS) via a crafted payload injected into the name in the profile.php. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://medium.com/@jose.inaciot/cve-2024-48170-bee6ccb773d4