Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
cated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/88dc08ff-3966-4606-855c-57c25552599e?source=cve - https://plugins.trac.wordpress.org/browser/wp-events-manager/trunk/inc/class-wpems-post-types.php#L461 - https://plugins.trac.wordpress.org/browser/wp-events-manager/tags/2.2.0/inc/class-wpems-post-types.php?rev=3144021
CVE ID: CVE-2024-7720 State: PUBLISHED Published: 2024-08-27T17:28:11.272Z Last Updated: 2024-08-28T13:46:40.617Z Vendors: HP Inc. Products: HP Security Manager Description: HP Security Manager is potentially vulnerable to Remote Code Execution as a result of code vulnerability within the product's solution open-source libraries. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.hp.com/us-en/document/ish_11074404-11074432-16/
CVE ID: CVE-2024-7721 State: PUBLISHED Published: 2024-09-11T04:31:20.309Z Last Updated: 2024-09-11T13:16:50.214Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: bplugins Products: HTML5 Video Player – mp4 Video Player Plugin and Block Problem Types: CWE-862 Description: The HTML5 Video Player – mp4 Video Player Plugin and Block plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'save_password' function in all versions up to, and including, 2.5.34. This makes it possible for authenticated attackers, with Subscriber-level access and above, to set any options that are not explicitly checked as false
enticated attackers, with Subscriber-level access and above, to set any options that are not explicitly checked as false to an array, including enabling user registration if it has been disabled. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/6dc3f308-d1e1-430b-bccd-168c0972fe7c?source=cve - https://plugins.trac.wordpress.org/browser/html5-video-player/trunk/inc/Model/Ajax.php#L79 - https://plugins.trac.wordpress.org/changeset/3148088/
CVE ID: CVE-2024-7722 State: PUBLISHED Published: 2024-08-21T16:04:21.233Z Last Updated: 2024-09-03T14:50:24.619Z Severity: LOW (CVSS 3.3 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) Vendors: Foxit Products: PDF Reader Problem Types: CWE-416 Description: Foxit PDF Reader Doc Object Use-After-Free Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit PDF Reader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of Doc objects. The issue results from the lack of validating
icious file. The specific flaw exists within the handling of Doc objects. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-23702. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-24-1124/ - https://www.foxit.com/support/security-bulletins.html
CVE ID: CVE-2024-7723 State: PUBLISHED Published: 2024-08-21T16:04:27.035Z Last Updated: 2024-09-03T14:50:01.584Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Foxit Products: PDF Reader Problem Types: CWE-416 Description: Foxit PDF Reader AcroForm Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of AcroForms. The issue results from the lack of validating the existenc
e. The specific flaw exists within the handling of AcroForms. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-23736. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-24-1125/ - https://www.foxit.com/support/security-bulletins.html
CVE ID: CVE-2024-7724 State: PUBLISHED Published: 2024-08-21T16:04:31.514Z Last Updated: 2024-09-03T14:43:31.238Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Foxit Products: PDF Reader Problem Types: CWE-416 Description: Foxit PDF Reader AcroForm Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of AcroForms. The issue results from the lack of validating the existenc
e. The specific flaw exists within the handling of AcroForms. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-23900. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-24-1126/ - https://www.foxit.com/support/security-bulletins.html
CVE ID: CVE-2024-7725 State: PUBLISHED Published: 2024-08-21T16:04:35.984Z Last Updated: 2024-09-03T14:41:34.101Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Foxit Products: PDF Reader Problem Types: CWE-416 Description: Foxit PDF Reader AcroForm Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of AcroForms. The issue results from the lack of validating the existenc
e. The specific flaw exists within the handling of AcroForms. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-23928. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-24-1127/ - https://www.foxit.com/support/security-bulletins.html
CVE ID: CVE-2024-7726 State: PUBLISHED Published: 2024-12-20T11:02:17.309Z Last Updated: 2024-12-20T15:51:09.904Z Vendors: Kioxia Products: CM6, PM7, PM6 Problem Types: CWE-306 Description: There exists an unauthenticated accessible JTAG port on the Kioxia PM6, PM7 and CM6 devices - On the Kioxia CM6, PM6 and PM7 disk drives it was discovered that the 2 main CPU cores of the SoC can be accessed via an open JTAG debug port that is exposed on the drive’s circuit board. Due to the wide cutout of the enclosures, the JTAG port can be accessed without having to open the disk enclosure. Utilizing the JTAG debug port, an attacker with (temporary) physical access can get full access to the firmware a
osure. Utilizing the JTAG debug port, an attacker with (temporary) physical access can get full access to the firmware and memory on the 2 main CPU cores within the drive including the execution of arbitrary code, the modification of firmware execution flow and data or bypassing the firmware signature verification during boot-up. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/google/security-research/security/advisories/GHSA-3hh8-94j4-62rh
CVE ID: CVE-2024-7727 State: PUBLISHED Published: 2024-09-11T04:31:20.937Z Last Updated: 2024-09-11T18:12:22.682Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: bplugins Products: HTML5 Video Player – mp4 Video Player Plugin and Block Problem Types: CWE-862 Description: The HTML5 Video Player – mp4 Video Player Plugin and Block plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on multiple functions called via the 'h5vp_ajax_handler' ajax action in all versions up to, and including, 2.5.32. This makes it possible for unauthenticated attackers to call these functions to manipulate data. Additional Analyst Note
This makes it possible for unauthenticated attackers to call these functions to manipulate data. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/908df18e-7178-4d40-becb-86e1a714a7da?source=cve - https://plugins.trac.wordpress.org/browser/html5-video-player/trunk/inc/Model/ImportData.php#L4 - https://plugins.trac.wordpress.org/browser/html5-video-player/trunk/inc/Model/Ajax.php#L5 - https://plugins.trac.wordpress.org/changeset/3139559/
CVE ID: CVE-2024-7728 State: PUBLISHED Published: 2024-08-14T03:26:50.771Z Last Updated: 2024-08-14T13:51:41.394Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: CAYIN Technology Products: CMS-SE(22.04), CMS-SE(18.04), CMS-SE Problem Types: CWE-78 Description: The specific CGI of the CAYIN Technology CMS does not properly validate user input, allowing a remote attacker with administrator privileges to inject OS commands into the specific parameter and execute them on the remote server. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/en/cp-139-8002-b6167-2.html - https://www.twcert.org.tw/tw/cp-132-8001-8416d-1.html -
nces: - https://www.twcert.org.tw/en/cp-139-8002-b6167-2.html - https://www.twcert.org.tw/tw/cp-132-8001-8416d-1.html - https://resource1.cayintech.com/patch/
CVE ID: CVE-2024-7729 State: PUBLISHED Published: 2024-08-14T03:52:43.673Z Last Updated: 2024-08-16T15:46:19.420Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: CAYIN Technology Products: SMP-2100, SMP-2200, SMP-2210, SMP-2300, SMP-2310, SMP-6000, SMP-8000, SMP-8000QD, CMS-20, CMS-60, CMS-SE, CMS-SE(18.04), CMS-SE(22.04), SMP-8100, SMP-2400 Problem Types: CWE-552 Description: The CAYIN Technology CMS lacks proper access control, allowing unauthenticated remote attackers to download arbitrary CGI files. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-8003-5543e-1.html - https://www.twcert.org.tw/en/cp-139-80
lnrichment: References: - https://www.twcert.org.tw/tw/cp-132-8003-5543e-1.html - https://www.twcert.org.tw/en/cp-139-8004-ed9aa-2.html - https://resource1.cayintech.com/patch/
CVE ID: CVE-2024-7730 State: PUBLISHED Published: 2024-11-14T12:11:50.456Z Last Updated: 2024-11-14T19:32:39.807Z Severity: HIGH (CVSS 7.4 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Red Hat Products: Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 8 Advanced Virtualization, Red Hat Enterprise Linux 9 Problem Types: CWE-122 Description: A heap buffer overflow was found in the virtio-snd device in QEMU. When reading input audio in the virtio-snd input callback, virtio_snd_pcm_in_cb, the function did not check whether the iov can fit the data buffer. This issue can trigger an out-of-bounds write if the size of the virtio q
check whether the iov can fit the data buffer. This issue can trigger an out-of-bounds write if the size of the virtio queue element is equal to virtio_snd_pcm_status, which makes the available space for audio data zero. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://access.redhat.com/security/cve/CVE-2024-7730 - https://bugzilla.redhat.com/show_bug.cgi?id=2304289
CVE ID: CVE-2024-7731 State: PUBLISHED Published: 2024-08-14T06:30:58.938Z Last Updated: 2024-08-14T13:23:19.734Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: SECOM Products: Dr.ID Access control system Problem Types: CWE-89 Description: Dr.ID Access Control System from SECOM does not properly validate a specific page parameter, allowing unauthenticated remote attackers to inject SQL commands to read, modify, and delete database contents. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-8005-c3c94-1.html - https://www.twcert.org.tw/en/cp-139-8006-036f5-2.html
CVE ID: CVE-2024-7732 State: PUBLISHED Published: 2024-08-14T06:55:59.726Z Last Updated: 2024-08-16T17:30:08.971Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: SECOM Products: Dr.ID Attendance system Problem Types: CWE-89 Description: Dr.ID Access Control System from SECOM does not properly validate a specific page parameter, allowing unauthenticated remote attackers to inject SQL commands to read, modify, and delete database contents. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-8007-803d6-1.html - https://www.twcert.org.tw/en/cp-139-8008-32677-2.html
CVE ID: CVE-2024-7733 State: PUBLISHED Published: 2024-08-13T18:00:11.066Z Last Updated: 2024-08-13T18:44:31.529Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: n/a Products: FastCMS Problem Types: CWE-79 Description: A vulnerability, which was classified as problematic, was found in FastCMS up to 0.1.5. Affected is an unknown function of the component New Article Category Page. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.274350 - https://vuldb.com/?ctiid.274350 - https://gitee.com/xj
SA ADP Vulnrichment: References: - https://vuldb.com/?id.274350 - https://vuldb.com/?ctiid.274350 - https://gitee.com/xjd2020/fastcms/issues/IAI8T6
CVE ID: CVE-2024-7734 State: PUBLISHED Published: 2024-09-10T08:03:19.477Z Last Updated: 2024-09-10T16:00:45.691Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: PHOENIX CONTACT Products: FL MGUARD 2102, FL MGUARD 2105, FL MGUARD 4102 PCI, FL MGUARD 4102 PCIE, FL MGUARD 4302, FL MGUARD 4305, FL MGUARD CENTERPORT VPN-1000, FL MGUARD CORE TX, FL MGUARD CORE TX VPN, FL MGUARD DELTA TX/TX, FL MGUARD DELTA TX/TX VPN, FL MGUARD GT/GT, FL MGUARD GT/GT VPN, FL MGUARD PCI4000, FL MGUARD PCI4000 VPN, FL MGUARD PCIE4000, FL MGUARD PCIE4000 VPN, FL MGUARD RS2000 TX/TX-B, FL MGUARD RS2000 TX/TX VPN, FL MGUARD RS2005 TX VPN, FL MGUARD RS4000 TX/TX, FL MGUARD RS4000 TX/TX-
ARD RS2000 TX/TX-B, FL MGUARD RS2000 TX/TX VPN, FL MGUARD RS2005 TX VPN, FL MGUARD RS4000 TX/TX, FL MGUARD RS4000 TX/TX-M, FL MGUARD RS4000 TX/TX-P, FL MGUARD RS4000 TX/TX VPN, FL MGUARD RS4004 TX/DTX, FL MGUARD RS4004 TX/DTX VPN, FL MGUARD SMART2, FL MGUARD SMART2 VPN, TC MGUARD RS2000 3G VPN, TC MGUARD RS2000 4G ATT VPN, TC MGUARD RS2000 4G VPN, TC MGUARD RS2000 4G VZW VPN, TC MGUARD RS4000 3G VPN, TC MGUARD RS4000 4G ATT VPN, TC MGUARD RS4000 4G VPN, TC MGUARD RS4000 4G VZW VPN Problem Types: CWE-770 Description: An unauthenticated remote attacker can exploit the behavior of the pathfinder TCP encapsulation service by establishing a high number of TCP connections to the pathfinder TCP enc
r of the pathfinder TCP encapsulation service by establishing a high number of TCP connections to the pathfinder TCP encapsulation service. The impact is limited to blocking of valid IPsec VPN peers. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert.vde.com/en/advisories/VDE-2024-052
CVE ID: CVE-2024-7735 State: PUBLISHED Published: 2024-09-23T11:20:55.139Z Last Updated: 2024-09-23T17:33:09.836Z Vendors: Exnet Informatics Software Products: Ferry Reservation System Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Exnet Informatics Software Ferry Reservation System allows SQL Injection.This issue affects Ferry Reservation System: before 240805-002. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.usom.gov.tr/bildirim/tr-24-1518
CVE ID: CVE-2024-7736 State: PUBLISHED Published: 2024-09-19T15:18:28.106Z Last Updated: 2024-09-19T18:09:00.818Z Severity: HIGH (CVSS 8.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N) Vendors: Dassault Systèmes Products: ENOVIA Collaborative Industry Innovator Problem Types: CWE-79 Description: A reflected Cross-site Scripting (XSS) vulnerability affecting ENOVIA Collaborative Industry Innovator from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024x allows an attacker to execute arbitrary script code in user's browser session. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.3ds.com/vulnerability/advisories
CVE ID: CVE-2024-7737 State: PUBLISHED Published: 2024-09-19T15:19:58.861Z Last Updated: 2024-09-19T17:11:41.088Z Severity: HIGH (CVSS 8.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N) Vendors: Dassault Systèmes Products: 3DSwymer Problem Types: CWE-79 Description: A stored Cross-site Scripting (XSS) vulnerability affecting 3DSwym in 3DSwymer from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024x allows an attacker to execute arbitrary script code in user's browser session. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.3ds.com/vulnerability/advisories
CVE ID: CVE-2024-7738 State: PUBLISHED Published: 2024-08-13T19:00:08.048Z Last Updated: 2024-08-13T19:39:18.425Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: yzane Products: vscode-markdown-pdf Problem Types: CWE-21 Description: A vulnerability, which was classified as problematic, has been found in yzane vscode-markdown-pdf 1.5.0. Affected by this issue is some unknown functionality of the component Markdown File Handler. The manipulation leads to pathname traversal. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.274358
e public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.274358 - https://vuldb.com/?ctiid.274358 - https://vuldb.com/?submit.385634 - https://github.com/abhi-ingle/Vulnerability-Research/blob/main/POC/Arbitrary%20File%20Read/file_read_report.md - https://github.com/abhi-ingle/Vulnerability-Research/blob/main/POC/Arbitrary%20File%20Read/poc_arbitrary_file_read.mp4
CVE ID: CVE-2024-7739 State: PUBLISHED Published: 2024-08-13T19:00:10.511Z Last Updated: 2024-08-13T20:09:53.132Z Severity: N/A (CVSS 5 AV:N/AC:L/Au:N/C:N/I:P/A:N) Vendors: yzane Products: vscode-markdown-pdf Problem Types: CWE-79 Description: A vulnerability, which was classified as problematic, was found in yzane vscode-markdown-pdf 1.5.0. This affects an unknown part. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.274359 - https://vuldb.com/?ctiid.274359 - https://vuldb.com/?submit.385635 - htt
t: References: - https://vuldb.com/?id.274359 - https://vuldb.com/?ctiid.274359 - https://vuldb.com/?submit.385635 - https://github.com/abhi-ingle/Vulnerability-Research/blob/main/POC/Script%20Injection/script_injection_report.md - https://github.com/abhi-ingle/Vulnerability-Research/blob/main/POC/Script%20Injection/poc_script_inject.mp4
CVE ID: CVE-2024-7740 State: PUBLISHED Published: 2024-08-13T20:00:06.233Z Last Updated: 2024-08-13T20:20:34.145Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: wanglongcn Products: ltcms Problem Types: CWE-918 Description: A vulnerability has been found in wanglongcn ltcms 1.0.20 and classified as critical. This vulnerability affects the function download of the file /api/test/download of the component API Endpoint. The manipulation of the argument url leads to server-side request forgery. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
o the public and may be used. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.274360 - https://vuldb.com/?ctiid.274360 - https://vuldb.com/?submit.386432 - https://github.com/DeepMountains/Mirage/blob/main/CVE14-1.md
CVE ID: CVE-2024-7741 State: PUBLISHED Published: 2024-08-13T20:00:07.891Z Last Updated: 2024-08-14T13:45:13.783Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: wanglongcn Products: ltcms Problem Types: CWE-22 Description: A vulnerability was found in wanglongcn ltcms 1.0.20 and classified as critical. This issue affects the function downloadFile of the file /api/file/downloadfile of the component API Endpoint. The manipulation of the argument file leads to path traversal. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. NOTE: The vendor was contacted early about this disclosure but did not respond in any w
d to the public and may be used. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.274361 - https://vuldb.com/?ctiid.274361 - https://vuldb.com/?submit.386433 - https://github.com/DeepMountains/Mirage/blob/main/CVE14-2.md
CVE ID: CVE-2024-7742 State: PUBLISHED Published: 2024-08-13T21:00:04.827Z Last Updated: 2024-08-15T18:36:28.889Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: wanglongcn Products: ltcms Problem Types: CWE-918 Description: A vulnerability was found in wanglongcn ltcms 1.0.20. It has been classified as critical. Affected is the function multiDownload of the file /api/file/multiDownload of the component API Endpoint. The manipulation of the argument file leads to server-side request forgery. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. NOTE: The vendor was contacted early about this disclosure but did not respond in
closed to the public and may be used. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.274362 - https://vuldb.com/?ctiid.274362 - https://vuldb.com/?submit.386434 - https://github.com/DeepMountains/Mirage/blob/main/CVE14-3.md
CVE ID: CVE-2024-7743 State: PUBLISHED Published: 2024-08-13T21:00:06.369Z Last Updated: 2024-08-16T14:36:42.789Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: wanglongcn Products: ltcms Problem Types: CWE-918 Description: A vulnerability was found in wanglongcn ltcms 1.0.20. It has been declared as critical. Affected by this vulnerability is the function downloadUrl of the file /api/file/downloadUrl of the component API Endpoint. The manipulation of the argument file leads to server-side request forgery. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. NOTE: The vendor was contacted early about this disclosure but did not resp
een disclosed to the public and may be used. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.274363 - https://vuldb.com/?ctiid.274363 - https://vuldb.com/?submit.386435 - https://github.com/DeepMountains/Mirage/blob/main/CVE14-4.md