Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-39126 State: PUBLISHED Published: 2024-07-17T00:00:00.000Z Last Updated: 2025-03-13T13:37:49.457Z Vendors: n/a Products: n/a Problem Types: n/a Description: Roundup before 2.4.0 allows XSS via JavaScript in PDF, XML, and SVG documents. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.roundup-tracker.org - https://www.roundup-tracker.org/docs/security.html#cve-announcements
CVE ID: CVE-2024-39129 State: PUBLISHED Published: 2024-06-27T00:00:00 Last Updated: 2024-12-06T21:03:35.795Z Vendors: n/a Products: n/a Problem Types: n/a Description: Heap Buffer Overflow vulnerability in DumpTS v0.1.0-nightly allows attackers to cause a denial of service via the function PushTSBuf() at /src/PayloadBuf.cpp. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/wangf1978/DumpTS/issues/19
CVE ID: CVE-2024-39130 State: PUBLISHED Published: 2024-06-27T00:00:00 Last Updated: 2024-08-02T04:19:20.591Z Vendors: n/a Products: n/a Problem Types: n/a Description: A NULL Pointer Dereference discovered in DumpTS v0.1.0-nightly allows attackers to cause a denial of service via the function DumpOneStream() at /src/DumpStream.cpp. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/wangf1978/DumpTS/issues/20
CVE ID: CVE-2024-39132 State: PUBLISHED Published: 2024-06-27T00:00:00 Last Updated: 2024-08-12T18:06:09.869Z Vendors: n/a Products: n/a Problem Types: n/a Description: A NULL Pointer Dereference vulnerability in DumpTS v0.1.0-nightly allows attackers to cause a denial of service via the function VerifyCommandLine() at /src/DumpTS.cpp. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/wangf1978/DumpTS/issues/22
CVE ID: CVE-2024-39133 State: PUBLISHED Published: 2024-06-27T00:00:00 Last Updated: 2024-08-02T04:19:20.563Z Vendors: n/a Products: n/a Problem Types: n/a Description: Heap Buffer Overflow vulnerability in zziplib v0.13.77 allows attackers to cause a denial of service via the __zzip_parse_root_directory() function at /zzip/zip.c. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/gdraheim/zziplib/issues/164
CVE ID: CVE-2024-39134 State: PUBLISHED Published: 2024-06-27T00:00:00 Last Updated: 2024-08-02T04:19:20.490Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Stack Buffer Overflow vulnerability in zziplibv 0.13.77 allows attackers to cause a denial of service via the __zzip_fetch_disk_trailer() function at /zzip/zip.c. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/gdraheim/zziplib/issues/165
CVE ID: CVE-2024-39143 State: PUBLISHED Published: 2024-07-02T00:00:00 Last Updated: 2024-10-27T21:30:13.907Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stored cross-site scripting (XSS) vulnerability exists in ResidenceCMS 2.10.1 that allows a low-privilege user to create malicious property content with HTML inside which acts as a stored XSS payload. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/Coderberg/ResidenceCMS/issues/128
CVE ID: CVE-2024-39150 State: PUBLISHED Published: 2024-07-05T00:00:00 Last Updated: 2024-11-13T17:17:13.337Z Vendors: n/a Products: n/a Problem Types: n/a Description: vditor v.3.9.8 and before is vulnerable to Arbitrary file read via a crafted data packet. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://b3log.org/vditor/
CVE ID: CVE-2024-39152 State: REJECTED Published: N/A Last Updated: 2024-07-18T19:04:06.258276 Description: No description available.
CVE ID: CVE-2024-39153 State: PUBLISHED Published: 2024-06-27T00:00:00 Last Updated: 2024-08-02T04:19:20.568Z Vendors: n/a Products: n/a Problem Types: n/a Description: idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/info_deal.php?mudi=del&dataType=news&dataTypeCN. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/Thirtypenny77/cms2/blob/main/50/csrf.md
CVE ID: CVE-2024-39154 State: PUBLISHED Published: 2024-06-27T00:00:00 Last Updated: 2024-08-02T04:19:20.638Z Vendors: n/a Products: n/a Problem Types: n/a Description: idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/keyWord_deal.php?mudi=del&dataType=word&dataTypeCN. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/Thirtypenny77/cms2/blob/main/54/csrf.md
CVE ID: CVE-2024-39155 State: PUBLISHED Published: 2024-06-27T00:00:00 Last Updated: 2024-08-02T04:19:20.649Z Vendors: n/a Products: n/a Problem Types: n/a Description: idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/ipRecord_deal.php?mudi=add. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/Thirtypenny77/cms2/blob/main/56/csrf.md
CVE ID: CVE-2024-39156 State: PUBLISHED Published: 2024-06-27T00:00:00 Last Updated: 2024-08-02T04:19:20.616Z Vendors: n/a Products: n/a Problem Types: n/a Description: idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/keyWord_deal.php?mudi=add. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/Thirtypenny77/cms2/blob/main/55/csrf.md
CVE ID: CVE-2024-39157 State: PUBLISHED Published: 2024-06-27T00:00:00 Last Updated: 2024-08-02T04:19:20.638Z Vendors: n/a Products: n/a Problem Types: n/a Description: idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/ipRecord_deal.php?mudi=del&dataType=&dataID=1. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/Thirtypenny77/cms2/blob/main/57/csrf.md
CVE ID: CVE-2024-39158 State: PUBLISHED Published: 2024-06-27T00:00:00 Last Updated: 2024-08-12T13:01:20.469Z Vendors: n/a Products: n/a Problem Types: n/a Description: idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/userSys_deal.php?mudi=infoSet. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/Thirtypenny77/cms2/blob/main/58/csrf.md
CVE ID: CVE-2024-39162 State: PUBLISHED Published: 2024-11-29T00:00:00 Last Updated: 2024-11-29T14:58:51.458Z Vendors: n/a Products: n/a Problem Types: n/a Description: pyspider through 0.3.10 allows /update XSS. NOTE: This vulnerability only affects products that are no longer supported by the maintainer Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://docs.pyspider.org/en/latest/ - https://www.sonarsource.com/blog/basic-http-authentication-risk-uncovering-pyspider-vulnerabilities/ - https://github.com/binux/pyspider
CVE ID: CVE-2024-39163 State: PUBLISHED Published: 2024-12-04T00:00:00 Last Updated: 2024-12-11T15:51:03.525Z Vendors: n/a Products: n/a Problem Types: n/a Description: binux pyspider up to v0.3.10 was discovered to contain a Cross-Site Request Forgery (CSRF) via the Flask endpoints. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/binux/pyspider/blob/master/pyspider/webui/debug.py#L39 - https://www.sonarsource.com/blog/basic-http-authentication-risk-uncovering-pyspider-vulnerabilities/
CVE ID: CVE-2024-39165 State: PUBLISHED Published: 2024-07-04T00:00:00.000Z Last Updated: 2025-09-02T15:14:32.026Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AC:L/AV:N/A:H/C:H/I:H/PR:N/S:U/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: QR/demoapp/qr_image.php in Asial JpGraph Professional through 4.2.6-pro allows remote attackers to execute arbitrary code via a PHP payload in the data parameter in conjunction with a .php file name in the filename parameter. This occurs because an unnecessary QR/demoapp folder.is shipped with the product. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://synacktiv.com/en/advisories/jpgraph-professio
s: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://synacktiv.com/en/advisories/jpgraph-professional-version-pre-authenticated-remote-code-execution
CVE ID: CVE-2024-39171 State: PUBLISHED Published: 2024-07-09T00:00:00 Last Updated: 2024-08-02T04:19:20.533Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory Travel in PHPVibe v11.0.46 due to incomplete blacklist checksums and directory checks, which can lead to code execution via writing specific statements to .htaccess and code to a file with a .png suffix. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - http://phpvibe.com - https://github.com/751897386/PHPVibe_vulnerability_Directory-Traversal
CVE ID: CVE-2024-39173 State: PUBLISHED Published: 2024-07-18T00:00:00 Last Updated: 2024-08-02T04:19:20.583Z Vendors: n/a Products: n/a Problem Types: n/a Description: calculator-boilerplate v1.0 was discovered to contain a remote code execution (RCE) vulnerability via the eval function at /routes/calculator.js. This vulnerability allows attackers to execute arbitrary code via a crafted payload injected into the input field. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - http://kropov.com/calculator-boilerplate-cve.txt
CVE ID: CVE-2024-39174 State: PUBLISHED Published: 2024-07-05T00:00:00 Last Updated: 2024-08-02T04:19:20.623Z Vendors: n/a Products: n/a Problem Types: n/a Description: A cross-site scripting (XSS) vulnerability in the Publish Article function of yzmcms v7.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into a published article. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/0x1ang/cvepbulic/issues/1
CVE ID: CVE-2024-39178 State: PUBLISHED Published: 2024-07-05T00:00:00 Last Updated: 2024-11-18T18:35:28.371463 Vendors: n/a Products: n/a Problem Types: n/a Description: MyPower vc8100 V100R001C00B030 was discovered to contain an arbitrary file read vulnerability via the component /tcpdump/tcpdump.php?menu_uuid. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/WarmBrew/web_vul/blob/main/Maipu/MyPower%20vc8100/MyPower_vc8100.md - https://github.com/WarmBrew/web_vul/blob/main/CVES/CVE-2024-39178.md
CVE ID: CVE-2024-39181 State: PUBLISHED Published: 2024-07-09T00:00:00 Last Updated: 2024-11-20T16:05:02.873Z Vendors: n/a Products: n/a Problem Types: n/a Description: Shenzhen Libituo Technology Co., Ltd LBT-T300-T400 v3.2 was discovered to contain a buffer overflow via the ApCliSsid parameter in thegenerate_conf_router() function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/SunsetR/Vulnerability-information/blob/main/LBT-T300-T400_ApCliSsid_Buffer%20overflow.md
CVE ID: CVE-2024-39182 State: PUBLISHED Published: 2024-07-05T00:00:00 Last Updated: 2024-08-08T14:05:00.837Z Vendors: n/a Products: n/a Problem Types: n/a Description: An information disclosure vulnerability in ISPmanager v6.98.0 allows attackers to access sensitive details of the root user's session via an arbitrary command (ISP6-1779). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://ispmanager.com/changelog
CVE ID: CVE-2024-39202 State: PUBLISHED Published: 2024-07-08T00:00:00 Last Updated: 2024-08-02T04:19:20.522Z Vendors: n/a Products: n/a Problem Types: n/a Description: D-Link DIR-823X firmware - 240126 was discovered to contain a remote command execution (RCE) vulnerability via the dhcpd_startip parameter at /goform/set_lan_settings. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://gist.github.com/Swind1er/40c33f1b1549028677cb4e2e5ef69109
CVE ID: CVE-2024-39203 State: PUBLISHED Published: 2024-07-08T00:00:00.000Z Last Updated: 2025-03-13T12:32:18.552Z Vendors: n/a Products: n/a Problem Types: n/a Description: A cross-site scripting (XSS) vulnerability in the Backend Theme Management module of Z-BlogPHP v1.7.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/5r1an/CVE-2024-39203/issues/1
CVE ID: CVE-2024-39205 State: PUBLISHED Published: 2024-10-28T00:00:00 Last Updated: 2024-10-30T20:56:49.427Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in pyload-ng v0.5.0b3.dev85 running under python3.11 or below allows attackers to execute arbitrary code via a crafted HTTP request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/pyload/pyload - https://github.com/pyload/pyload/security/advisories/GHSA-r9pp-r4xf-597r - https://github.com/Marven11/CVE-2024-39205-Pyload-RCE/tree/main
CVE ID: CVE-2024-39206 State: PUBLISHED Published: 2024-07-02T00:00:00 Last Updated: 2024-08-02T04:19:20.577Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue discovered in MSP360 Backup Agent v7.8.5.15 and v7.9.4.84 allows attackers to obtain network share credentials used in a backup due to enginesettings.list being encrypted with a hard coded key. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.proactivelabs.com.au/2024/06/19/cloudberry.html
CVE ID: CVE-2024-39207 State: PUBLISHED Published: 2024-06-27T00:00:00 Last Updated: 2024-08-23T15:16:26.619Z Vendors: n/a Products: n/a Problem Types: n/a Description: lua-shmem v1.0-1 was discovered to contain a buffer overflow via the shmem_write function. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/yanggao017/vuln/blob/main/lua-shmem.md - https://gist.github.com/yanggao017/5ca24da711cf893bedac38518ec448f1
CVE ID: CVE-2024-39208 State: PUBLISHED Published: 2024-06-27T00:00:00 Last Updated: 2024-08-02T04:19:20.596Z Vendors: n/a Products: n/a Problem Types: n/a Description: luci-app-lucky v2.8.3 was discovered to contain hardcoded credentials. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/yanggao017/vuln/blob/main/luci-app-lucky.md - https://gist.github.com/yanggao017/9e64b97f4de708360db08db01f0bb980
CVE ID: CVE-2024-39209 State: PUBLISHED Published: 2024-06-27T00:00:00 Last Updated: 2024-08-02T04:19:20.677Z Vendors: n/a Products: n/a Problem Types: n/a Description: luci-app-sms-tool v1.9-6 was discovered to contain a command injection vulnerability via the score parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/yanggao017/vuln/blob/main/luci-app-sms-tool.md - https://gist.github.com/yanggao017/e392a633b8cee6f42c514b125860081c
CVE ID: CVE-2024-39210 State: PUBLISHED Published: 2024-07-05T00:00:00 Last Updated: 2024-08-02T04:19:20.635Z Vendors: n/a Products: n/a Problem Types: n/a Description: Best House Rental Management System v1.0 was discovered to contain an arbitrary file read vulnerability via the Page parameter at index.php. This vulnerability allows attackers to read arbitrary PHP files and access other sensitive information within the application. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/KRookieSec/CVE-2024-39210
CVE ID: CVE-2024-39211 State: PUBLISHED Published: 2024-07-04T00:00:00 Last Updated: 2024-08-22T18:26:47.365Z Vendors: n/a Products: n/a Problem Types: n/a Description: Kaiten 57.128.8 allows remote attackers to enumerate user accounts via a crafted POST request, because a login response contains a user_email field only if the user account exists. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://kaiten.ru - https://github.com/artemy-ccrsky/CVE-2024-39211/blob/main/CVE-2024-39211.sh - https://github.com/artemy-ccrsky/CVE-2024-39211
CVE ID: CVE-2024-39219 State: PUBLISHED Published: 2024-12-04T00:00:00 Last Updated: 2024-12-11T16:49:52.467Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in Aginode GigaSwitch V5 before version 7.06G allows authenticated attackers with Administrator privileges to upload an earlier firmware version, exposing the device to previously patched vulnerabilities. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.aginode.support/support/documentation/ - https://blog.hackvens.fr/advisories/CVE-2024-39967-CVE-2024-39219-GigaSwitch.html
CVE ID: CVE-2024-39220 State: PUBLISHED Published: 2024-07-03T00:00:00 Last Updated: 2024-08-02T04:19:20.684Z Vendors: n/a Products: n/a Problem Types: n/a Description: BAS-IP AV-01D, AV-01MD, AV-01MFD, AV-01ED, AV-01KD, AV-01BD, AV-01KBD, AV-02D, AV-02IDE, AV-02IDR, AV-02IPD, AV-02FDE, AV-02FDR, AV-03D, AV-03BD, AV-04AFD, AV-04ASD, AV-04FD, AV-04SD, AV-05FD, AV-05SD, AA-07BD, AA-07BDI, BA-04BD, BA-04MD, BA-08BD, BA-08MD, BA-12BD, BA-12MD, CR-02BD before firmware v3.9.2 allows authenticated attackers to read SIP account passwords via a crafted GET request. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://bas-ip.com/bsa-000001 - https://github.
t Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://bas-ip.com/bsa-000001 - https://github.com/DrieVlad/BAS-IP-vulnerabilities
CVE ID: CVE-2024-39223 State: PUBLISHED Published: 2024-07-03T00:00:00 Last Updated: 2024-10-25T18:01:00.433Z Vendors: n/a Products: n/a Problem Types: n/a Description: An authentication bypass in the SSH service of gost v2.11.5 allows attackers to intercept communications via setting the HostKeyCallback function to ssh.InsecureIgnoreHostKey Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/ginuerzh/gost/issues/1034 - https://github.com/ginuerzh/gost/blob/729d0e70005607dc7c69fc1de62fd8fe21f85355/ssh.go#L229 - https://gist.github.com/nyxfqq/a7242170b1118e78436a62dee4e09e8a
CVE ID: CVE-2024-39225 State: PUBLISHED Published: 2024-08-06T00:00:00 Last Updated: 2024-08-15T15:31:54.275410 Vendors: n/a Products: n/a Problem Types: n/a Description: GL-iNet products AR750/AR750S/AR300M/AR300M16/MT300N-V2/B1300/MT1300/SFT1200/X750 v4.3.11, MT3000/MT2500/AXT1800/AX1800/A1300/X300B v4.5.16, XE300 v4.3.16, E750 v4.3.12, AP1300/S1300 v4.3.13, and XE3000/X3000 v4.4 were discovered to contain a remote code execution (RCE) vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/gl-inet/CVE-issues/blob/main/4.0.0/Bypass%20the%20login%20mechanism.md
CVE ID: CVE-2024-39226 State: PUBLISHED Published: 2024-08-06T00:00:00 Last Updated: 2024-11-12T17:08:43.264Z Vendors: n/a Products: n/a Problem Types: n/a Description: GL-iNet products AR750/AR750S/AR300M/AR300M16/MT300N-V2/B1300/MT1300/SFT1200/X750 v4.3.11, MT3000/MT2500/AXT1800/AX1800/A1300/X300B v4.5.16, XE300 v4.3.16, E750 v4.3.12, AP1300/S1300 v4.3.13, and XE3000/X3000 v4.4 were discovered to contain a vulnerability can be exploited to manipulate routers by passing malicious shell commands through the s2s API. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/gl-inet/CVE-issues/blob/main/4.0.0/s2s%20interface%20shell%20injection.md
CVE ID: CVE-2024-39227 State: PUBLISHED Published: 2024-08-06T00:00:00 Last Updated: 2024-08-15T15:40:35.188511 Vendors: n/a Products: n/a Problem Types: n/a Description: GL-iNet products AR750/AR750S/AR300M/AR300M16/MT300N-V2/B1300/MT1300/SFT1200/X750 v4.3.11, MT3000/MT2500/AXT1800/AX1800/A1300/X300B v4.5.16, XE300 v4.3.16, E750 v4.3.12, AP1300/S1300 v4.3.13, and XE3000/X3000 v4.4 were discovered to contain insecure permissions in the endpoint /cgi-bin/glc. This vulnerability allows unauthenticated attackers to execute arbitrary code or possibly a directory traversal via crafted JSON data. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/gl-inet/CVE-issues
rafted JSON data. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/gl-inet/CVE-issues/blob/main/4.0.0/Access%20to%20the%20C%20library%20without%20logging%20in.md
CVE ID: CVE-2024-39228 State: PUBLISHED Published: 2024-08-06T00:00:00 Last Updated: 2024-08-15T15:36:52.684349 Vendors: n/a Products: n/a Problem Types: n/a Description: GL-iNet products AR750/AR750S/AR300M/AR300M16/MT300N-V2/B1300/MT1300/SFT1200/X750 v4.3.11, MT3000/MT2500/AXT1800/AX1800/A1300/X300B v4.5.16, XE300 v4.3.16, E750 v4.3.12, AP1300/S1300 v4.3.13, and XE3000/X3000 v4.4 were discovered to contain a shell injection vulnerability via the interface check_ovpn_client_config and check_config. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/gl-inet/CVE-issues/blob/main/4.0.0/Ovpn%20interface%20shell%20injection.md
CVE ID: CVE-2024-39229 State: PUBLISHED Published: 2024-08-06T00:00:00 Last Updated: 2024-11-21T18:43:08.245Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in GL-iNet products AR750/AR750S/AR300M/AR300M16/MT300N-V2/B1300/MT1300/SFT1200/X750 v4.3.11, MT3000/MT2500/AXT1800/AX1800/A1300/X300B v4.5.16, XE300 v4.3.16, E750 v4.3.12, AP1300/S1300 v4.3.13, XE3000/X3000 v4, and B2200/MV1000/MV1000W/USB150/N300/SF1200 v3.216 allows attackers to intercept communications via a man-in-the-middle attack when DDNS clients are reporting data to the server. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/gl-inet/CVE-issues/blob/main/4.0.0/DDNS%20data%
Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/gl-inet/CVE-issues/blob/main/4.0.0/DDNS%20data%20is%20not%20encrypted.md
CVE ID: CVE-2024-39236 State: PUBLISHED Published: 2024-07-01T00:00:00 Last Updated: 2024-08-02T04:19:20.702Z Vendors: n/a Products: n/a Problem Types: n/a Description: Gradio v4.36.1 was discovered to contain a code injection vulnerability via the component /gradio/component_meta.py. This vulnerability is triggered via a crafted input. NOTE: the supplier disputes this because the report is about a user attacking himself. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/Aaron911/PoC/blob/main/Gradio.md - https://github.com/gradio-app/gradio/issues/8853 - https://github.com/advisories/GHSA-9v2f-6vcg-3hgv
CVE ID: CVE-2024-39241 State: PUBLISHED Published: 2024-06-26T00:00:00.000Z Last Updated: 2025-03-18T19:07:06.595Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting (XSS) vulnerability in skycaiji 2.8 allows attackers to run arbitrary code via /admin/tool/preview. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://fushuling.com/index.php/2024/06/19/test3/
CVE ID: CVE-2024-39242 State: PUBLISHED Published: 2024-06-26T00:00:00.000Z Last Updated: 2025-03-26T20:05:17.472Z Vendors: n/a Products: n/a Problem Types: n/a Description: A cross-site scripting (XSS) vulnerability in skycaiji v2.8 allows attackers to execute arbitrary web scripts or HTML via a crafted payload using eval(String.fromCharCode()). Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://fushuling.com/index.php/2024/06/13/test2/
CVE ID: CVE-2024-39243 State: PUBLISHED Published: 2024-06-26T00:00:00 Last Updated: 2024-08-02T04:19:20.654Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue discovered in skycaiji 2.8 allows attackers to run arbitrary code via crafted POST request to /index.php?s=/admin/develop/editor_save. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://fushuling.com/index.php/2024/06/11/test/