Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-4939 State: PUBLISHED Published: 2024-06-05T07:34:56.368Z Last Updated: 2024-08-01T20:55:10.280Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: wpweaver Products: Weaver Xtreme Theme Support Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Weaver Xtreme Theme Support plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's div shortcode in all versions up to, and including, 6.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level acc
put escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/bc121ed0-4cb3-4ba4-b693-413b1c25e4ca?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3095286%40weaverx-theme-support%2Ftrunk&old=3017943%40weaverx-theme-support%2Ftrunk&sfp_email=&sfph_mail=
CVE ID: CVE-2024-4940 State: PUBLISHED Published: 2024-06-22T05:23:49.761Z Last Updated: 2025-10-15T12:50:24.795Z Severity: MEDIUM (CVSS 5.4 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N) Vendors: gradio-app Products: gradio-app/gradio Problem Types: CWE-601 Description: An open redirect vulnerability exists in the gradio-app/gradio, affecting the latest version. The vulnerability allows an attacker to redirect users to arbitrary websites, which can be exploited for phishing attacks, Cross-site Scripting (XSS), Server-Side Request Forgery (SSRF), amongst others. This issue is due to improper validation of user-supplied input in the handling of URLs. Attackers can exploit this vulnerability by
s due to improper validation of user-supplied input in the handling of URLs. Attackers can exploit this vulnerability by crafting a malicious URL that, when processed by the application, redirects the user to an attacker-controlled web page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://huntr.com/bounties/35aaea93-6895-4f03-9c1b-cd992665aa60
CVE ID: CVE-2024-4941 State: PUBLISHED Published: 2024-06-06T17:55:11.754Z Last Updated: 2025-10-15T12:49:40.335Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: gradio-app Products: gradio-app/gradio Problem Types: CWE-22 Description: A local file inclusion vulnerability exists in the JSON component of gradio-app/gradio version 4.25. The vulnerability arises from improper input validation in the `postprocess()` function within `gradio/components/json_component.py`, where a user-controlled string is parsed as JSON. If the parsed JSON object contains a `path` key, the specified file is moved to a temporary directory, making it possible to retrieve it later via
ontains a `path` key, the specified file is moved to a temporary directory, making it possible to retrieve it later via the `/file=..` endpoint. This issue is due to the `processing_utils.move_files_to_cache()` function traversing any object passed to it, looking for a dictionary with a `path` key, and then copying the specified file to a temporary directory. The vulnerability can be exploited by an attacker to read files on the remote system, posing a significant security risk. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://huntr.com/bounties/39889ce1-298d-4568-aecd-7ae40c2ca58e - https://github.com/gradio-app/gradio/commit/ee1e2942e0a1ae84
//huntr.com/bounties/39889ce1-298d-4568-aecd-7ae40c2ca58e - https://github.com/gradio-app/gradio/commit/ee1e2942e0a1ae84a08a05464e41c8108a03fa9c
CVE ID: CVE-2024-4942 State: PUBLISHED Published: 2024-06-06T02:02:53.172Z Last Updated: 2024-08-01T20:55:10.316Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N) Vendors: dextorlobo Products: Custom Dash Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Custom Dash plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.0.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that
authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/13344366-feb0-4987-9543-222e3d35dab3?source=cve - https://wordpress.org/plugins/custom-dash/
CVE ID: CVE-2024-4943 State: PUBLISHED Published: 2024-05-21T02:32:59.924Z Last Updated: 2024-08-01T20:55:10.363Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: creativethemeshq Products: Blocksy Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Blocksy theme for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘has_field_link_rel’ parameter in all versions up to, and including, 2.0.46 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in
es it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/dc7099d7-94fd-42be-a921-bfcad43ae252?source=cve - https://themes.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=227333%40blocksy%2F2.0.47&old=227242%40blocksy%2F2.0.46
CVE ID: CVE-2024-4944 State: PUBLISHED Published: 2024-07-09T02:23:25.039Z Last Updated: 2024-08-01T20:55:10.311Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: WatchGuard Products: Mobile VPN with SSL Client Problem Types: CWE-77 Description: A local privilege escalation vlnerability in the WatchGuard Mobile VPN with SSL client on Windows enables a local user to execute arbitrary commands with elevated privileged. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2024-00010
CVE ID: CVE-2024-4945 State: PUBLISHED Published: 2024-05-16T05:00:05.656Z Last Updated: 2024-08-01T20:55:10.344Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: SourceCodester Products: Best Courier Management System Problem Types: CWE-434 Description: A vulnerability was found in SourceCodester Best Courier Management System 1.0. It has been classified as problematic. Affected is an unknown function of the file view_parcel.php. The manipulation of the argument id leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-264480. Additi
The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-264480. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.264480 - https://vuldb.com/?ctiid.264480 - https://vuldb.com/?submit.333960 - https://github.com/CveSecLook/cve/issues/28
CVE ID: CVE-2024-4946 State: PUBLISHED Published: 2024-05-16T05:31:04.185Z Last Updated: 2024-08-01T20:55:10.319Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: SourceCodester Products: Online Art Gallery Management System Problem Types: CWE-434 Description: A vulnerability was found in SourceCodester Online Art Gallery Management System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file admin/adminHome.php. The manipulation of the argument sliderpic leads to unrestricted upload. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-264481 was assigned to t
ched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-264481 was assigned to this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.264481 - https://vuldb.com/?ctiid.264481 - https://vuldb.com/?submit.334215 - https://github.com/CveSecLook/cve/issues/29
CVE ID: CVE-2024-4947 State: PUBLISHED Published: 2024-05-15T20:42:34.192Z Last Updated: 2025-10-21T23:05:17.882Z Vendors: Google Products: Chrome Problem Types: Type Confusion Description: Type Confusion in V8 in Google Chrome prior to 125.0.6422.60 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High) Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://chromereleases.googleblog.com/2024/05/stable-channel-update-for-desktop_15.html - https://issues.chromium.org/issues/340221135 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/messag
ium.org/issues/340221135 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NTSN22LNYXMWHVTYNOYQVOY7VDZFHENQ/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WSUWM73ZCXTN62AT2REYQDD5ZKPFMDZD/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/
CVE ID: CVE-2024-4948 State: PUBLISHED Published: 2024-05-15T20:42:34.434Z Last Updated: 2025-02-13T17:53:43.901Z Vendors: Google Products: Chrome Problem Types: Use after free Description: Use after free in Dawn in Google Chrome prior to 125.0.6422.60 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://chromereleases.googleblog.com/2024/05/stable-channel-update-for-desktop_15.html - https://issues.chromium.org/issues/333414294 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/
m.org/issues/333414294 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NTSN22LNYXMWHVTYNOYQVOY7VDZFHENQ/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WSUWM73ZCXTN62AT2REYQDD5ZKPFMDZD/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/
CVE ID: CVE-2024-4949 State: PUBLISHED Published: 2024-05-15T20:42:34.700Z Last Updated: 2025-02-13T17:53:44.432Z Vendors: Google Products: Chrome Problem Types: Use after free Description: Use after free in V8 in Google Chrome prior to 125.0.6422.60 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium) Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://chromereleases.googleblog.com/2024/05/stable-channel-update-for-desktop_15.html - https://issues.chromium.org/issues/326607001 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/
m.org/issues/326607001 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NTSN22LNYXMWHVTYNOYQVOY7VDZFHENQ/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WSUWM73ZCXTN62AT2REYQDD5ZKPFMDZD/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/
CVE ID: CVE-2024-4950 State: PUBLISHED Published: 2024-05-15T20:42:34.902Z Last Updated: 2025-03-28T19:59:23.443Z Vendors: Google Products: Chrome Problem Types: Inappropriate implementation Description: Inappropriate implementation in Downloads in Google Chrome prior to 125.0.6422.60 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low) Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://chromereleases.googleblog.com/2024/05/stable-channel-update-for-desktop_15.html - https://issues.chromium.org/issues/40065403 - https://lists.fedoraproje
4/05/stable-channel-update-for-desktop_15.html - https://issues.chromium.org/issues/40065403 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NTSN22LNYXMWHVTYNOYQVOY7VDZFHENQ/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WSUWM73ZCXTN62AT2REYQDD5ZKPFMDZD/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/
CVE ID: CVE-2024-4951 State: REJECTED Published: N/A Last Updated: 2025-02-11T01:05:47.252Z Description: No description available.
CVE ID: CVE-2024-4952 State: REJECTED Published: N/A Last Updated: 2025-02-11T01:05:46.420Z Description: No description available.
CVE ID: CVE-2024-4956 State: PUBLISHED Published: 2024-05-16T15:31:01.795Z Last Updated: 2024-08-01T20:55:10.367Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Sonatype Products: Nexus Repository Problem Types: CWE-22 Description: Path Traversal in Sonatype Nexus Repository 3 allows an unauthenticated attacker to read system files. Fixed in version 3.68.1. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://support.sonatype.com/hc/en-us/articles/29416509323923
CVE ID: CVE-2024-4957 State: PUBLISHED Published: 2024-06-26T06:00:03.703Z Last Updated: 2024-08-01T20:55:10.298Z Vendors: Unknown Products: Frontend Checklist Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Frontend Checklist WordPress plugin through 2.3.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://wpscan.com/vulnerability/0a560ed4-7dec-4274-b4a4-39dea0c0d67e/
CVE ID: CVE-2024-4958 State: PUBLISHED Published: 2024-06-01T07:35:56.868Z Last Updated: 2024-08-01T20:55:10.374Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: wpeverest Products: User Registration – Custom Registration Form, Login Form, and User Profile WordPress Plugin Problem Types: CWE-862 Missing Authorization Description: The User Registration – Custom Registration Form, Login Form, and User Profile WordPress Plugin plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'import_form_action' function in versions up to, and including, 3.2.0.1. This makes it possible for authenticated attackers, wi
_form_action' function in versions up to, and including, 3.2.0.1. This makes it possible for authenticated attackers, with contributor-level permissions and above, to import a registration form with a default user role of administrator. If an administrator approves or publishes a post or page with the shortcode to the imported form, any user can register as an administrator. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/710574a8-a6e2-4ee6-9ea7-03a34994fec7?source=cve - https://plugins.trac.wordpress.org/changeset/3095484/user-registration/tags/3.2.1/includes/class-ur-ajax.php
CVE ID: CVE-2024-4959 State: PUBLISHED Published: 2024-06-26T06:00:03.926Z Last Updated: 2024-08-01T20:55:10.320Z Vendors: Unknown Products: Frontend Checklist Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Frontend Checklist WordPress plugin through 2.3.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://wpscan.com/vulnerability/449e4da8-beae-4ff6-9ddc-0e17781c0391/
CVE ID: CVE-2024-4960 State: PUBLISHED Published: 2024-05-16T05:31:06.328Z Last Updated: 2024-08-01T20:55:10.441Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: D-Link Products: DAR-7000-40 Problem Types: CWE-434 Description: ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability classified as critical has been found in D-Link DAR-7000-40 V31R02B1413C. Affected is an unknown function of the file interface/sysmanage/licenseauthorization.php. The manipulation of the argument file_upload leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-264528. NOTE: This vu
loit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-264528. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: Vendor was contacted early and confirmed immediately that the product is end-of-life. It should be retired and replaced. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.264528 - https://vuldb.com/?ctiid.264528 - https://vuldb.com/?submit.333777 - https://github.com/h0e4a0r1t/h0e4a0r1t.github.io/blob/master/2024/%3CWHB%7Cj%5CIbSU0m4%3A_/D-LINK-DAR-7000_upload_%20licenseauthorization.php.php.pdf - https://supportannouncement.u
2024/%3CWHB%7Cj%5CIbSU0m4%3A_/D-LINK-DAR-7000_upload_%20licenseauthorization.php.php.pdf - https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10354
CVE ID: CVE-2024-4961 State: PUBLISHED Published: 2024-05-16T06:00:06.797Z Last Updated: 2024-08-23T17:42:36.505Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: D-Link Products: DAR-7000-40 Problem Types: CWE-434 Description: ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability classified as critical was found in D-Link DAR-7000-40 V31R02B1413C. Affected by this vulnerability is an unknown functionality of the file /user/onlineuser.php. The manipulation of the argument file_upload leads to unrestricted upload. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-264529 was assigned to this vulnerability. NOTE: This vul
en disclosed to the public and may be used. The identifier VDB-264529 was assigned to this vulnerability. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: Vendor was contacted early and confirmed immediately that the product is end-of-life. It should be retired and replaced. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.264529 - https://vuldb.com/?ctiid.264529 - https://vuldb.com/?submit.333779 - https://github.com/h0e4a0r1t/h0e4a0r1t.github.io/blob/master/2024/%3CWHB%7Cj%5CIbSU0m4%3A_/D-LINK-DAR-7000_upload_%20onlineuser.php.pdf - https://supportannouncement.us.dlink.com/sec
024/%3CWHB%7Cj%5CIbSU0m4%3A_/D-LINK-DAR-7000_upload_%20onlineuser.php.pdf - https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10354
CVE ID: CVE-2024-4962 State: PUBLISHED Published: 2024-05-16T06:31:04.878Z Last Updated: 2024-08-01T20:55:10.358Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: D-Link Products: DAR-7000-40 Problem Types: CWE-434 Description: ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability, which was classified as critical, has been found in D-Link DAR-7000-40 V31R02B1413C. Affected by this issue is some unknown functionality of the file /useratte/resmanage.php. The manipulation of the argument file leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-264530 is the identifier assigned to this vulnerability. NOTE: Th
has been disclosed to the public and may be used. VDB-264530 is the identifier assigned to this vulnerability. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: Vendor was contacted early and confirmed immediately that the product is end-of-life. It should be retired and replaced. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.264530 - https://vuldb.com/?ctiid.264530 - https://vuldb.com/?submit.333780 - https://github.com/h0e4a0r1t/h0e4a0r1t.github.io/blob/master/2024/%3CWHB%7Cj%5CIbSU0m4%3A_/D-LINK-DAR-7000_upload_%20resmanage.php.pdf - https://supportannouncement.us.dlink.co
ster/2024/%3CWHB%7Cj%5CIbSU0m4%3A_/D-LINK-DAR-7000_upload_%20resmanage.php.pdf - https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10354
CVE ID: CVE-2024-4963 State: PUBLISHED Published: 2024-05-16T07:00:05.986Z Last Updated: 2024-08-01T20:55:10.367Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: D-Link Products: DAR-7000-40 Problem Types: CWE-434 Description: ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability, which was classified as critical, was found in D-Link DAR-7000-40 V31R02B1413C. This affects an unknown part of the file /url/url.php. The manipulation of the argument file_upload leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-264531. NOTE: This vulnerability onl
the public and may be used. The associated identifier of this vulnerability is VDB-264531. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: Vendor was contacted early and confirmed immediately that the product is end-of-life. It should be retired and replaced. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.264531 - https://vuldb.com/?ctiid.264531 - https://vuldb.com/?submit.333781 - https://github.com/h0e4a0r1t/h0e4a0r1t.github.io/blob/master/2024/%3CWHB%7Cj%5CIbSU0m4%3A_/D-LINK-DAR-7000_upload_%20url.php.pdf - https://supportannouncement.us.dlink.com/security/publication.asp
%5CIbSU0m4%3A_/D-LINK-DAR-7000_upload_%20url.php.pdf - https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10354
CVE ID: CVE-2024-4964 State: PUBLISHED Published: 2024-05-16T07:31:05.221Z Last Updated: 2024-08-01T20:55:10.492Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: D-Link Products: DAR-7000-40 Problem Types: CWE-434 Description: ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability has been found in D-Link DAR-7000-40 V31R02B1413C and classified as critical. This vulnerability affects unknown code of the file /firewall/urlblist.php. The manipulation of the argument file leads to unrestricted upload. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-264532. NOTE: This vulnerability only affects