Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-48279 State: PUBLISHED Published: 2024-10-15T00:00:00 Last Updated: 2024-10-15T15:39:58.536Z Vendors: n/a Products: n/a Problem Types: n/a Description: A HTML Injection vulnerability was found in /search-result.php of PHPGurukul User Registration & Login and User Management System 3.2. This vulnerability allows remote attackers to execute arbitrary HTML code via the searchkey parameter in a POST HTTP request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/m14r41/Writeups/blob/main/CVE/phpGurukul/User%20Registration%20%26%20Login%20and%20User%20Management%20System%20With%20admin%20panel/HTML%20Injection%20-%20Search.md
CVE ID: CVE-2024-48280 State: PUBLISHED Published: 2024-10-15T00:00:00 Last Updated: 2024-10-15T15:24:11.428Z Vendors: n/a Products: n/a Problem Types: n/a Description: A SQL Injection vulnerability was found in /search-result.php of PHPGurukul User Registration & Login and User Management System 3.2, which allows remote attackers to execute arbitrary SQL command via the fromdate parameter in a POST HTTP request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/m14r41/Writeups/blob/main/CVE/phpGurukul/User%20Registration%20%26%20Login%20and%20User%20Management%20System%20With%20admin%20panel/SQL%20Injection%20-%20Bw%20Date%20Report%20%28%20fromdate%29.md
CVE ID: CVE-2024-48282 State: PUBLISHED Published: 2024-10-15T00:00:00 Last Updated: 2024-10-15T15:01:57.067Z Vendors: n/a Products: n/a Problem Types: n/a Description: A SQL Injection vulnerability was found in /password-recovery.php of PHPGurukul User Registration & Login and User Management System 3.2, which allows remote attackers to execute arbitrary SQL commands to get unauthorized database access via the femail parameter in a POST HTTP request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/m14r41/Writeups/blob/main/CVE/phpGurukul/User%20Registration%20%26%20Login%20and%20User%20Management%20System%20With%20admin%20panel/SQL%20Injection%20-%20Forge
/User%20Registration%20%26%20Login%20and%20User%20Management%20System%20With%20admin%20panel/SQL%20Injection%20-%20Forget%20Password.md
CVE ID: CVE-2024-48283 State: PUBLISHED Published: 2024-10-15T00:00:00 Last Updated: 2024-10-15T16:11:05.310Z Vendors: n/a Products: n/a Problem Types: n/a Description: Phpgurukul User Registration & Login and User Management System 3.2 is vulnerable to SQL Injection in /admin//search-result.php via the searchkey parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/m14r41/Writeups/blob/main/CVE/phpGurukul/User%20Registration%20%26%20Login%20and%20User%20Management%20System%20With%20admin%20panel/SQL%20Injection%20-%20Search.md
CVE ID: CVE-2024-48284 State: PUBLISHED Published: 2024-11-14T00:00:00 Last Updated: 2024-11-18T18:07:49.889Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Reflected Cross-Site Scripting (XSS) vulnerability was found in the /search-result.php page of the PHPGurukul User Registration & Login and User Management System 3.2. This vulnerability allows remote attackers to execute arbitrary scripts via the searchkey parameter in a POST HTTP request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/m14r41/Writeups/blob/main/CVE/phpGurukul/User%20Registration%20%26%20Login%20and%20User%20Management%20System%20With%20admin%20panel/Reflected%20XSS%20-%
Gurukul/User%20Registration%20%26%20Login%20and%20User%20Management%20System%20With%20admin%20panel/Reflected%20XSS%20-%20Search.md
CVE ID: CVE-2024-48286 State: PUBLISHED Published: 2024-11-21T00:00:00 Last Updated: 2024-11-21T20:59:57.455Z Vendors: n/a Products: n/a Problem Types: n/a Description: Linksys E3000 1.0.06.002_US is vulnerable to command injection via the diag_ping_start function. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/GroundCTL2MajorTom/pocs/blob/main/Cisco_Linksys_E3000_rce.md
CVE ID: CVE-2024-48288 State: PUBLISHED Published: 2024-11-21T00:00:00.000Z Last Updated: 2025-03-13T13:12:58.808Z Vendors: n/a Products: n/a Problem Types: n/a Description: TP-Link TL-IPC42C V4.0_20211227_1.0.16 is vulnerable to command injection due to the lack of malicious code verification on both the frontend and backend. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/GroundCTL2MajorTom/pocs/blob/main/Cisco_Linksys_E3000_rce.md - https://github.com/GroundCTL2MajorTom/pocs/blob/main/TP-Link_TL-IPC42C_RCE.md
CVE ID: CVE-2024-48289 State: PUBLISHED Published: 2024-11-01T00:00:00 Last Updated: 2024-11-04T19:21:42.072Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in the Bluetooth Low Energy implementation of Cypress Bluetooth SDK v3.66 allows attackers to cause a Denial of Service (DoS) via supplying a crafted LL_PAUSE_ENC_REQ packet. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://community.infineon.com/t5/PSoC-4/BLE-SDK-Integer-Overflow/m-p/888037#M49108
CVE ID: CVE-2024-48290 State: PUBLISHED Published: 2024-11-07T00:00:00 Last Updated: 2024-11-07T20:56:36.473Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in the Bluetooth Low Energy implementation of Realtek RTL8762E BLE SDK v1.4.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted ll_terminate_ind packet. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://realtek.com - https://gitee.com/guozhi123456/vulnerability-Report/blob/master/Realtek/Realtek.md
CVE ID: CVE-2024-48291 State: PUBLISHED Published: 2024-10-28T00:00:00 Last Updated: 2024-10-28T15:53:46.930Z Vendors: n/a Products: n/a Problem Types: n/a Description: dingfanzu CMS 1.0 was discovered to contain a Cross-Site Request Forgery (CSRF) via /admin/doAdminAction.php?act=editAdmin&id=17 Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Gxxxxxxxxxxxxxxxxxx/cms/tree/main/4/readme.md
CVE ID: CVE-2024-48292 State: PUBLISHED Published: 2024-11-18T00:00:00 Last Updated: 2024-11-19T15:29:24.426Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in the wssrvc.exe service of QuickHeal Antivirus Pro Version v24.0 and Quick Heal Total Security v24.0 allows authenticated attackers to escalate privileges. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.quickheal.com/download-free-antivirus/ - https://github.com/Nero22k/Disclosures/blob/main/QuickHealAV/CVE-2024-48292.md
CVE ID: CVE-2024-48293 State: PUBLISHED Published: 2024-11-18T00:00:00 Last Updated: 2024-11-19T15:25:28.711Z Vendors: n/a Products: n/a Problem Types: n/a Description: Incorrect access control in QuickHeal Antivirus Pro 24.1.0.182 and earlier allows authenticated attackers with low-level privileges to arbitrarily modify antivirus settings. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.quickheal.com/download-free-antivirus/ - https://github.com/Nero22k/Disclosures/blob/main/QuickHealAV/CVE-2024-48293.md
CVE ID: CVE-2024-48294 State: PUBLISHED Published: 2024-11-18T00:00:00 Last Updated: 2024-11-19T15:20:14.078Z Vendors: n/a Products: n/a Problem Types: n/a Description: A NULL pointer dereference in the component libPdfCore.dll of Wondershare PDF Reader v1.0.9.2544 allows attackers to cause a Denial of Service (DoS) via a crafted PDF file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://pdf.wondershare.com/pdf-reader.html - https://github.com/Nero22k/Disclosures/tree/main/Wondershare%20PDF%20Reader
CVE ID: CVE-2024-48307 State: PUBLISHED Published: 2024-10-31T00:00:00 Last Updated: 2024-10-31T18:33:55.964Z Vendors: n/a Products: n/a Problem Types: n/a Description: JeecgBoot v3.7.1 was discovered to contain a SQL injection vulnerability via the component /onlDragDatasetHead/getTotalData. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/jeecgboot - https://github.com/jeecgboot/JeecgBoot - https://github.com/jeecgboot/JeecgBoot/issues/7237
CVE ID: CVE-2024-48310 State: PUBLISHED Published: 2025-01-28T00:00:00.000Z Last Updated: 2025-03-25T13:25:29.259Z Vendors: n/a Products: n/a Problem Types: n/a Description: AutoLib Software Systems OPAC v20.10 was discovered to have multiple API keys exposed within the source code. Attackers may use these keys to access the backend API or other sensitive information. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://seclists.org/fulldisclosure/2025/Jan/11
CVE ID: CVE-2024-48311 State: PUBLISHED Published: 2024-10-31T00:00:00 Last Updated: 2024-10-31T16:01:21.329Z Vendors: n/a Products: n/a Problem Types: n/a Description: Piwigo v14.5.0 was discovered to contain a Cross-Site Request Forgery (CSRF) via the Edit album function. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/whiteshark2k/Piwigo-CSRF/blob/main/Piwigo-CSRF.md
CVE ID: CVE-2024-48312 State: PUBLISHED Published: 2024-11-05T00:00:00 Last Updated: 2024-11-05T19:41:14.454Z Vendors: n/a Products: n/a Problem Types: n/a Description: WebLaudos v20.8 (118) was discovered to contain a cross-site scripting (XSS) vulnerability via the login page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://medium.com/%40wagneralves_87750/poc-cve-weblaudos-d1ec40cfc183
CVE ID: CVE-2024-48322 State: PUBLISHED Published: 2024-11-11T00:00:00 Last Updated: 2024-11-12T16:33:44.829Z Vendors: n/a Products: n/a Problem Types: n/a Description: UsersController.php in Run.codes 1.5.2 and older has a reset password race condition vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/runcodes-icmc/server - https://github.com/runcodes-icmc/server/issues/12 - https://github.com/trqt/CVE-2024-48322 - https://github.com/runcodes-icmc/server/releases/tag/v1.5.3
CVE ID: CVE-2024-48325 State: PUBLISHED Published: 2024-11-06T00:00:00 Last Updated: 2024-11-07T15:10:25.146Z Vendors: n/a Products: n/a Problem Types: n/a Description: Portabilis i-Educar 2.8.0 is vulnerable to SQL Injection in the "getDocuments" function of the "InstituicaoDocumentacaoController" class. The "instituicao_id" parameter in "/module/Api/InstituicaoDocumentacao?oper=get&resource=getDocuments&instituicao_id" is not properly sanitized, allowing an unauthenticated remote attacker to inject malicious SQL commands. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/osvaldotenorio/cve-2024-48325
CVE ID: CVE-2024-48336 State: PUBLISHED Published: 2024-11-04T00:00:00 Last Updated: 2024-11-04T20:06:56.981Z Vendors: n/a Products: n/a Problem Types: n/a Description: The install() function of ProviderInstaller.java in Magisk App before canary version 27007 does not verify the GMS app before loading it, which allows a local untrusted app with no additional privileges to silently execute arbitrary code in the Magisk app and escalate privileges to root via a crafted package, aka Bug #8279. User interaction is not needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/canyie/MagiskEoP - https://github.com/topjohnwu/Magisk/commit/c2eb603957
Vulnrichment: References: - https://github.com/canyie/MagiskEoP - https://github.com/topjohnwu/Magisk/commit/c2eb6039579b8a2fb1e11a753cea7662c07bec02
CVE ID: CVE-2024-48341 State: PUBLISHED Published: 2025-09-08T00:00:00.000Z Last Updated: 2025-09-08T19:44:03.599Z Vendors: n/a Products: n/a Problem Types: n/a Description: dingfanzu CMS V1.0 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/doAdminAction.php?act=addShop Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Jiingh/cms/tree/main/6/readme.md
CVE ID: CVE-2024-48342 State: REJECTED Published: 2024-11-04T00:00:00 Last Updated: 2024-11-04T06:48:44.428879 Description: No description available.
CVE ID: CVE-2024-48343 State: PUBLISHED Published: 2024-10-25T00:00:00 Last Updated: 2024-10-29T19:04:57.804Z Vendors: n/a Products: n/a Problem Types: n/a Description: A SQL Injection vulnerability in ESAFENET CDG 5 and earlier allows an attacker to execute arbitrary code via the id parameter of the dataSearch.jsp page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://flowus.cn/share/d038084d-6370-4bcb-a268-6cca9e0f6615?code=G8A6P3
CVE ID: CVE-2024-48346 State: PUBLISHED Published: 2024-10-30T00:00:00 Last Updated: 2024-10-31T18:40:51.402Z Vendors: n/a Products: n/a Problem Types: n/a Description: xtreme1 <= v0.9.1 contains a Server-Side Request Forgery (SSRF) vulnerability in the /api/data/upload path. The vulnerability is triggered through the fileUrl parameter, which allows an attacker to make arbitrary requests to internal or external systems. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/xtreme1-io/xtreme1/issues/284
CVE ID: CVE-2024-48352 State: PUBLISHED Published: 2024-11-01T00:00:00 Last Updated: 2024-11-05T17:47:35.191Z Vendors: n/a Products: n/a Problem Types: n/a Description: Yealink Meeting Server before V26.0.0.67 is vulnerable to sensitive data exposure in the server response via sending HTTP request with enterprise ID. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://yealink.com - https://www.yealink.com/en/trust-center/security-advisories/e5c848c55b894231
CVE ID: CVE-2024-48353 State: PUBLISHED Published: 2024-11-01T00:00:00.000Z Last Updated: 2025-03-07T20:13:09.930Z Vendors: n/a Products: n/a Problem Types: n/a Description: Yealink Meeting Server before V26.0.0.67 allows attackers to obtain static key information from a front-end JS file and decrypt the plaintext passwords based on the obtained key information. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.yealink.com/en/trust-center/security-advisories/b1998ab629254ca3
CVE ID: CVE-2024-48356 State: PUBLISHED Published: 2024-10-28T00:00:00 Last Updated: 2024-10-30T17:02:31.984Z Vendors: n/a Products: n/a Problem Types: n/a Description: LyLme Spage <=1.6.0 is vulnerable to SQL Injection via /admin/group.php. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Jingyi-u/LyLme_Spage/blob/main/README.md
CVE ID: CVE-2024-48357 State: PUBLISHED Published: 2024-10-28T00:00:00 Last Updated: 2024-10-30T17:04:10.362Z Vendors: n/a Products: n/a Problem Types: n/a Description: LyLme Spage 1.2.0 through 1.6.0 is vulnerable to SQL Injection via /admin/apply.php. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Jingyi-u/LyLme_Spage_2/blob/main/README.md
CVE ID: CVE-2024-48359 State: PUBLISHED Published: 2024-10-31T00:00:00.000Z Last Updated: 2025-06-12T16:34:54.344Z Vendors: n/a Products: n/a Problem Types: n/a Description: Qualitor v8.24 was discovered to contain a remote code execution (RCE) vulnerability via the gridValoresPopHidden parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/OpenXP-Research/CVE-2024-48359 - https://www.qualitor.com.br/official-security-advisory-cve-2024-48359
CVE ID: CVE-2024-48360 State: PUBLISHED Published: 2024-10-31T00:00:00.000Z Last Updated: 2025-06-12T16:28:08.957Z Vendors: n/a Products: n/a Problem Types: n/a Description: Qualitor v8.24 was discovered to contain a Server-Side Request Forgery (SSRF) via the component /request/viewValidacao.php. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.qualitor.com.br/qualitor-8-20 - https://github.com/OpenXP-Research/CVE-2024-48360 - https://www.qualitor.com.br/official-security-advisory-cve-2024-48360
CVE ID: CVE-2024-48392 State: PUBLISHED Published: 2025-01-21T00:00:00.000Z Last Updated: 2025-01-22T21:53:34.918Z Vendors: n/a Products: n/a Problem Types: n/a Description: OrangeScrum v2.0.11 is vulnerable to Cross Site Scripting (XSS). An attacker can inject malicious JavaScript code into user email due to lack of input validation, which could lead to account takeover. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.orangescrum.com/ - https://github.com/Renzusclarke/CVE-2024-48392-PoC - https://github.com/Renzusclarke/CVE-2024-48392-PoC/blob/main/poc.txt
CVE ID: CVE-2024-48394 State: PUBLISHED Published: 2025-02-05T00:00:00.000Z Last Updated: 2025-03-19T14:22:27.626Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Time-of-Check to Time-of-Use (TOCTOU) vulnerability has been identified in the driver of the NDD Print solution, which could allow an unprivileged user to exploit this flaw and gain SYSTEM-level access on the device. The vulnerability affects version 5.24.3 and before of the software. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://helpcenter-nddprint.ndd.tech/pt/seguranca-e-compliance/Current/dezembro-2024#0
CVE ID: CVE-2024-48396 State: PUBLISHED Published: 2024-10-25T00:00:00 Last Updated: 2024-10-30T19:15:37.333Z Vendors: n/a Products: n/a Problem Types: n/a Description: AIML Chatbot 1.0 (fixed in 2.0) is vulnerable to Cross Site Scripting (XSS). The vulnerability is exploited through the message input field, where attackers can inject malicious HTML or JavaScript code. The chatbot fails to sanitize these inputs, leading to the execution of malicious scripts. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://jacobmasse.medium.com/reflected-xss-in-popular-ai-chatbot-application-79de74ea0cc8 - https://github.com/sohelamin/chatbot
CVE ID: CVE-2024-48406 State: PUBLISHED Published: 2024-11-29T00:00:00 Last Updated: 2024-12-04T17:04:52.273Z Vendors: n/a Products: n/a Problem Types: n/a Description: Buffer Overflow vulnerability in SunBK201 umicat through v.0.3.2 and fixed in v.0.3.3 allows an attacker to execute arbitrary code via the power(uct_int_t x, uct_int_t n) in src/uct_upstream.c. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/SunBK201/umicat/pull/3 - https://github.com/SunBK201/umicat/issues/2
CVE ID: CVE-2024-48410 State: PUBLISHED Published: 2024-11-01T00:00:00 Last Updated: 2024-11-04T20:55:57.137Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting vulnerability in Camtrace v.9.16.2.1 allows a remote attacker to execute arbitrary code via the login.php. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gist.github.com/Youns92/e7cd3f5d18ab089320f72c51fa3977de
CVE ID: CVE-2024-48411 State: PUBLISHED Published: 2024-10-15T00:00:00 Last Updated: 2024-10-16T18:18:10.087Z Vendors: n/a Products: n/a Problem Types: n/a Description: itsourcecode Online Tours and Travels Management System v1.0 is vulnerable to SQL Injection (SQLI) via a crafted payload to the val-email parameter in forget_password.php. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Comitora/CVEs/blob/main/CVE-2024-48411
CVE ID: CVE-2024-48415 State: PUBLISHED Published: 2024-10-22T00:00:00 Last Updated: 2024-10-23T15:56:14.946Z Vendors: n/a Products: n/a Problem Types: n/a Description: itsourcecode Loan Management System v1.0 is vulnerable to Cross Site Scripting (XSS) via a crafted payload to the lastname, firstname, middlename, address, contact_no, email and tax_id parameters in new borrowers functionality on the Borrowers page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/khaliquesX/CVE-2024-48415/blob/main/README.md
CVE ID: CVE-2024-48416 State: PUBLISHED Published: 2025-01-27T00:00:00.000Z Last Updated: 2025-01-28T19:45:05.776Z Vendors: n/a Products: n/a Problem Types: n/a Description: Edimax AC1200 Wi-Fi 5 Dual-Band Router BR-6476AC 1.06 is vulnerable to Buffer Overflow via /goform/fromSetLanDhcpsClientbinding. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://edimax.com - https://github.com/SpikeReply/advisories/blob/c271ddb997bc0263274118acc380bc71ce9c316b/cve/edimax/cve-2024-48416.md
CVE ID: CVE-2024-48417 State: PUBLISHED Published: 2025-01-27T00:00:00.000Z Last Updated: 2025-01-28T19:44:49.506Z Vendors: n/a Products: n/a Problem Types: n/a Description: Edimax AC1200 Wi-Fi 5 Dual-Band Router BR-6476AC 1.06 is vulnerable to Cross Site Scripting (XSS) in : /bin/goahead via /goform/setStaticRoute, /goform/fromSetFilterUrlFilter, and /goform/fromSetFilterClientFilter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://edimax.com - https://github.com/SpikeReply/advisories/blob/c271ddb997bc0263274118acc380bc71ce9c316b/cve/edimax/cve-2024-48417.md
CVE ID: CVE-2024-48418 State: PUBLISHED Published: 2025-01-27T00:00:00.000Z Last Updated: 2025-01-28T19:44:40.087Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Edimax AC1200 Wi-Fi 5 Dual-Band Router BR-6476AC 1.06, the request /goform/fromSetDDNS does not properly handle special characters in any of user provided parameters, allowing an attacker with access to the web interface to inject and execute arbitrary shell commands. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://edimax.com - https://github.com/SpikeReply/advisories/blob/c271ddb997bc0263274118acc380bc71ce9c316b/cve/edimax/cve-2024-48418.md
CVE ID: CVE-2024-48419 State: PUBLISHED Published: 2025-01-27T00:00:00.000Z Last Updated: 2025-01-28T19:44:29.312Z Vendors: n/a Products: n/a Problem Types: n/a Description: Edimax AC1200 Wi-Fi 5 Dual-Band Router BR-6476AC 1.06 suffers from Command Injection issues in /bin/goahead. Specifically, these issues can be triggered through /goform/tracerouteDiagnosis, /goform/pingDiagnosis, and /goform/fromSysToolPingCmd Each of these issues allows an attacker with access to the web interface to inject and execute arbitrary shell commands, with "root" privileges. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://edimax.com - https://github.com/SpikeReply/advisories/blob/c271dd
t Notes: - CISA ADP Vulnrichment: References: - http://edimax.com - https://github.com/SpikeReply/advisories/blob/c271ddb997bc0263274118acc380bc71ce9c316b/cve/edimax/cve-2024-48419.md
CVE ID: CVE-2024-48420 State: PUBLISHED Published: 2025-01-27T00:00:00.000Z Last Updated: 2025-01-28T19:44:57.375Z Vendors: n/a Products: n/a Problem Types: n/a Description: Edimax AC1200 Wi-Fi 5 Dual-Band Router BR-6476AC 1.06 is vulnerable to Buffer Overflow via /goform/getWifiBasic. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://edimax.com - https://github.com/SpikeReply/advisories/blob/c271ddb997bc0263274118acc380bc71ce9c316b/cve/edimax/cve-2024-48420.md
CVE ID: CVE-2024-48423 State: PUBLISHED Published: 2024-10-24T00:00:00 Last Updated: 2024-10-29T19:27:02.587Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in assimp v.5.4.3 allows a local attacker to execute arbitrary code via the CallbackToLogRedirector function within the Assimp library. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/assimp/assimp/issues/5788
CVE ID: CVE-2024-48424 State: PUBLISHED Published: 2024-10-24T00:00:00 Last Updated: 2024-10-28T17:54:22.076Z Vendors: n/a Products: n/a Problem Types: n/a Description: A heap-buffer-overflow vulnerability has been identified in the OpenDDLParser::parseStructure function within the Assimp library, specifically during the processing of OpenGEX files. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/assimp/assimp/issues/5787
CVE ID: CVE-2024-48425 State: PUBLISHED Published: 2024-10-24T00:00:00 Last Updated: 2024-10-28T18:22:52.021Z Vendors: n/a Products: n/a Problem Types: n/a Description: A segmentation fault (SEGV) was detected in the Assimp::SplitLargeMeshesProcess_Triangle::UpdateNode function within the Assimp library during fuzz testing using AddressSanitizer. The crash occurs due to a read access violation at address 0x000000000460, which points to the zero page, indicating a null or invalid pointer dereference. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/assimp/assimp/issues/5791