Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-41435 State: PUBLISHED Published: 2024-09-03T00:00:00 Last Updated: 2024-09-03T20:15:08.289Z Vendors: n/a Products: n/a Problem Types: n/a Description: YugabyteDB v2.21.1.0 was discovered to contain a buffer overflow via the "insert into" parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/yugabyte/yugabyte-db/issues/22967 - https://gist.github.com/ycybfhb/1427881e7db911786837d32b0669e06b
CVE ID: CVE-2024-41436 State: PUBLISHED Published: 2024-09-03T00:00:00 Last Updated: 2024-09-03T19:27:45.417Z Vendors: n/a Products: n/a Problem Types: n/a Description: ClickHouse v24.3.3.102 was discovered to contain a buffer overflow via the component DB::evaluateConstantExpressionImpl. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/ClickHouse/ClickHouse/issues/65520 - https://gist.github.com/ycybfhb/db127ae9d105a4d20edc9f010a959016
CVE ID: CVE-2024-41437 State: PUBLISHED Published: 2024-07-30T00:00:00.000Z Last Updated: 2025-03-13T18:56:53.736Z Vendors: n/a Products: n/a Problem Types: n/a Description: A heap buffer overflow in the function cp_unfilter() (/vendor/cute_png.h) of hicolor v0.5.0 allows attackers to cause a Denial of Service (DoS) via a crafted PNG file. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/Helson-S/FuzzyTesting/tree/master/hicolor/heapof-r1-cp_unfilter-cute_png-1019c11 - https://github.com/Helson-S/FuzzyTesting/blob/master/hicolor/heapof-r1-cp_unfilter-cute_png-1019c11/vulDescription.md - https://github.com/Helson-S/FuzzyTesting/tree/
master/hicolor/heapof-r1-cp_unfilter-cute_png-1019c11/vulDescription.md - https://github.com/Helson-S/FuzzyTesting/tree/master/hicolor/heapof-r1-cp_unfilter-cute_png-1019c11/poc - https://github.com/Helson-S/FuzzyTesting/blob/master/hicolor/heapof-r1-cp_unfilter-cute_png-1019c11/poc/sample6.png - https://github.com/Helson-S/FuzzyTesting/blob/master/hicolor/heapof-r1-cp_unfilter-cute_png-1019c11/vulDescription.assets/image-20240530183857985.png
CVE ID: CVE-2024-41438 State: PUBLISHED Published: 2024-07-30T00:00:00 Last Updated: 2024-08-02T04:46:52.318Z Vendors: n/a Products: n/a Problem Types: n/a Description: A heap buffer overflow in the function cp_stored() (/vendor/cute_png.h) of hicolor v0.5.0 allows attackers to cause a Denial of Service (DoS) via a crafted PNG file. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/Helson-S/FuzzyTesting/blob/master/hicolor/heapof-r65280-cp_stored-cute_png-543c2 - https://github.com/Helson-S/FuzzyTesting/blob/master/hicolor/heapof-r65280-cp_stored-cute_png-543c2/vulDescription.md - https://github.com/Helson-S/FuzzyTesting/tree/master/
hicolor/heapof-r65280-cp_stored-cute_png-543c2/vulDescription.md - https://github.com/Helson-S/FuzzyTesting/tree/master/hicolor/heapof-r65280-cp_stored-cute_png-543c2/poc - https://github.com/Helson-S/FuzzyTesting/tree/master/hicolor/heapof-r65280-cp_stored-cute_png-543c2/poc/sample10.png - https://github.com/Helson-S/FuzzyTesting/blob/master/hicolor/heapof-r65280-cp_stored-cute_png-543c2/vulDescription.assets/image-20240530184723547.png - https://github.com/Helson-S/FuzzyTesting/blob/master/hicolor/heapof-r65280-cp_stored-cute_png-543c2/vulDescription.assets/image-20240530184848743.png - https://github.com/Helson-S/FuzzyTesting/blob/master/hicolor/heapof-r65280-cp_stored-cute_png-543c2/vulD
184848743.png - https://github.com/Helson-S/FuzzyTesting/blob/master/hicolor/heapof-r65280-cp_stored-cute_png-543c2/vulDescription.assets/image-20240530185015780.png
CVE ID: CVE-2024-41439 State: PUBLISHED Published: 2024-07-30T00:00:00 Last Updated: 2024-10-22T20:06:12.147Z Vendors: n/a Products: n/a Problem Types: n/a Description: A heap buffer overflow in the function cp_block() (/vendor/cute_png.h) of hicolor v0.5.0 allows attackers to cause a Denial of Service (DoS) via a crafted PNG file. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/Helson-S/FuzzyTesting/blob/master/hicolor/heapof-w98-cp_block-5c0-cute_png-642c5 - https://github.com/Helson-S/FuzzyTesting/blob/master/hicolor/heapof-w98-cp_block-5c0-cute_png-642c5/vulDescription.md - https://github.com/Helson-S/FuzzyTesting/blob/master/h
icolor/heapof-w98-cp_block-5c0-cute_png-642c5/vulDescription.md - https://github.com/Helson-S/FuzzyTesting/blob/master/hicolor/heapof-w98-cp_block-5c0-cute_png-642c5/poc - https://github.com/Helson-S/FuzzyTesting/blob/master/hicolor/heapof-w98-cp_block-5c0-cute_png-642c5/poc/sample13.png - https://github.com/Helson-S/FuzzyTesting/blob/master/hicolor/heapof-w98-cp_block-5c0-cute_png-642c5/vulDescription.assets/image-20240530192505615.png - https://github.com/Helson-S/FuzzyTesting/blob/master/hicolor/heapof-w98-cp_block-5c0-cute_png-642c5/vulDescription.assets/image-20240531002753478.png
CVE ID: CVE-2024-41440 State: PUBLISHED Published: 2024-07-30T00:00:00 Last Updated: 2024-08-02T04:46:52.372Z Vendors: n/a Products: n/a Problem Types: n/a Description: A heap buffer overflow in the function png_quantize() of hicolor v0.5.0 allows attackers to cause a Denial of Service (DoS) via a crafted PNG file. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/Helson-S/FuzzyTesting/blob/master/hicolor/heapof-w1-png_quantize-cli-220c32 - https://github.com/Helson-S/FuzzyTesting/blob/master/hicolor/heapof-w1-png_quantize-cli-220c32/vulDescription.md - https://github.com/Helson-S/FuzzyTesting/blob/master/hicolor/heapof-w1-png_quanti
uantize-cli-220c32/vulDescription.md - https://github.com/Helson-S/FuzzyTesting/blob/master/hicolor/heapof-w1-png_quantize-cli-220c32/poc - https://github.com/Helson-S/FuzzyTesting/blob/master/hicolor/heapof-w1-png_quantize-cli-220c32/poc/sample18.png - https://github.com/Helson-S/FuzzyTesting/blob/master/hicolor/heapof-w1-png_quantize-cli-220c32/vulDescription.assets/image-20240530225208577.png
CVE ID: CVE-2024-41443 State: PUBLISHED Published: 2024-07-30T00:00:00.000Z Last Updated: 2025-03-19T18:04:48.291Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stack overflow in the function cp_dynamic() (/vendor/cute_png.h) of hicolor v0.5.0 allows attackers to cause a Denial of Service (DoS) via a crafted PNG file. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/Helson-S/FuzzyTesting/blob/master/hicolor/stkof-w133-cp_dynamic-cute_png-603 - https://github.com/Helson-S/FuzzyTesting/blob/master/hicolor/stkof-w133-cp_dynamic-cute_png-603/vulDescription.md - https://github.com/Helson-S/FuzzyTesting/blob/master/hicolor/
lor/stkof-w133-cp_dynamic-cute_png-603/vulDescription.md - https://github.com/Helson-S/FuzzyTesting/blob/master/hicolor/stkof-w133-cp_dynamic-cute_png-603/poc - https://github.com/Helson-S/FuzzyTesting/blob/master/hicolor/stkof-w133-cp_dynamic-cute_png-603/poc/sample16.png - https://github.com/Helson-S/FuzzyTesting/blob/master/hicolor/stkof-w133-cp_dynamic-cute_png-603/vulDescription.assets/image-20240530223831738.png - https://github.com/Helson-S/FuzzyTesting/blob/master/hicolor/stkof-w133-cp_dynamic-cute_png-603/vulDescription.assets/image-20240530223921086.png
CVE ID: CVE-2024-41444 State: PUBLISHED Published: 2024-08-26T00:00:00 Last Updated: 2024-08-26T18:01:45.092Z Vendors: n/a Products: n/a Problem Types: n/a Description: SeaCMS v12.9 has a SQL injection vulnerability in the key parameter of /js/player/dmplayer/dmku/index.php?ac=so. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/seacms-net/CMS - https://www.seacms.net/p-549 - https://gist.github.com/looppppp/fa328c81ce19c1097d10f95c763d0d50
CVE ID: CVE-2024-41445 State: PUBLISHED Published: 2024-09-25T00:00:00.000Z Last Updated: 2025-03-25T16:20:43.778Z Vendors: n/a Products: n/a Problem Types: n/a Description: Library MDF (mdflib) v2.1 is vulnerable to a heap-based buffer overread via a crafted mdf4 file is parsed using the ReadData function Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/g0ku704/vulnerabilities/tree/main/CVE-2024-41445
CVE ID: CVE-2024-41446 State: PUBLISHED Published: 2025-04-21T00:00:00.000Z Last Updated: 2025-04-21T14:55:02.810Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stored cross-site scripting (XSS) vulnerability in Alkacon OpenCMS v17.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the image parameter under the Create/Modify article function. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://alkacon.com - http://opencms.com - https://github.com/Sidd545-cr/CVE/blob/main/CVE-2024-41446%20-%20Stored%20XSS%20in%20image%20copyright%20attribute.pdf
CVE ID: CVE-2024-41447 State: PUBLISHED Published: 2025-04-18T00:00:00.000Z Last Updated: 2025-04-18T19:27:33.691Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stored cross-site scripting (XSS) vulnerability in Alkacon OpenCMS v17.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the author parameter under the Create/Modify article function. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.exploit-db.com/exploits/52209
CVE ID: CVE-2024-41453 State: PUBLISHED Published: 2025-01-15T00:00:00 Last Updated: 2025-01-16T17:18:03.443Z Vendors: n/a Products: n/a Problem Types: n/a Description: A cross-site scripting (XSS) vulnerability in Process Maker pm4core-docker 4.1.21-RC7 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/php-lover-boy/processmaker
CVE ID: CVE-2024-41454 State: PUBLISHED Published: 2025-01-15T00:00:00.000Z Last Updated: 2025-02-03T18:34:54.765Z Vendors: n/a Products: n/a Problem Types: n/a Description: An arbitrary file upload vulnerability in the UI login page logo upload function of Process Maker pm4core-docker 4.1.21-RC7 allows attackers to execute arbitrary code via uploading a crafted PHP or HTML file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/php-lover-boy/processmaker
CVE ID: CVE-2024-41459 State: PUBLISHED Published: 2024-07-24T00:00:00 Last Updated: 2024-08-02T04:46:52.423Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda FH1201 v1.2.0.14 was discovered to contain a stack-based buffer overflow vulnerability via the PPPOEPassword parameter at ip/goform/QuickIndex. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/iotresearch/iot-vuln/blob/main/Tenda/FH1201/QuickIndex/QuickIndex.md
CVE ID: CVE-2024-41460 State: PUBLISHED Published: 2024-07-24T00:00:00 Last Updated: 2024-08-02T04:46:51.664Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda FH1201 v1.2.0.14 was discovered to contain a stack-based buffer overflow vulnerability via the entrys parameter at ip/goform/RouteStatic. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/iotresearch/iot-vuln/blob/main/Tenda/FH1201/RouteStatic/README.md
CVE ID: CVE-2024-41461 State: PUBLISHED Published: 2024-07-24T00:00:00 Last Updated: 2024-10-25T17:29:39.129Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda FH1201 v1.2.0.14 was discovered to contain a stack-based buffer overflow vulnerability via the list1 parameter at ip/goform/DhcpListClient. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/iotresearch/iot-vuln/blob/main/Tenda/FH1201/DhcpListClient/README.md
CVE ID: CVE-2024-41462 State: PUBLISHED Published: 2024-07-24T00:00:00 Last Updated: 2024-08-02T04:46:52.305Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda FH1201 v1.2.0.14 was discovered to contain a stack-based buffer overflow vulnerability via the page parameter at ip/goform/DhcpListClient. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/iotresearch/iot-vuln/blob/main/Tenda/FH1201/DhcpListClient2/README.md
CVE ID: CVE-2024-41463 State: PUBLISHED Published: 2024-07-24T00:00:00 Last Updated: 2024-08-02T04:46:52.331Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda FH1201 v1.2.0.14 was discovered to contain a stack-based buffer overflow vulnerability via the entrys parameter at ip/goform/addressNat. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/iotresearch/iot-vuln/blob/main/Tenda/FH1201/addressNat/README.md
CVE ID: CVE-2024-41464 State: PUBLISHED Published: 2024-07-24T00:00:00 Last Updated: 2024-08-02T04:46:52.417Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda FH1201 v1.2.0.14 was discovered to contain a stack-based buffer overflow vulnerability via the mitInterface parameter in ip/goform/RouteStatic Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/iotresearch/iot-vuln/tree/main/Tenda/FH1201/RouteStatic2
CVE ID: CVE-2024-41465 State: PUBLISHED Published: 2024-07-24T00:00:00 Last Updated: 2024-08-02T04:46:52.496Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda FH1201 v1.2.0.14 was discovered to contain a stack-based buffer overflow vulnerability via the funcpara1 parameter at ip/goform/setcfm. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/iotresearch/iot-vuln/tree/main/Tenda/FH1201/setcfm
CVE ID: CVE-2024-41466 State: PUBLISHED Published: 2024-07-24T00:00:00 Last Updated: 2024-08-02T04:46:51.665Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda FH1201 v1.2.0.14 was discovered to contain a stack-based buffer overflow vulnerability via the page parameter at ip/goform/NatStaticSetting. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/iotresearch/iot-vuln/blob/main/Tenda/FH1201/NatStaticSetting/README.md
CVE ID: CVE-2024-41468 State: PUBLISHED Published: 2024-07-25T00:00:00 Last Updated: 2024-08-02T04:46:52.378Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda FH1201 v1.2.0.14 was discovered to contain a command injection vulnerability via the cmdinput parameter at /goform/exeCommand Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/iotresearch/iot-vuln/blob/main/Tenda/FH1201/exeCommand/README.md
CVE ID: CVE-2024-41473 State: PUBLISHED Published: 2024-07-25T00:00:00 Last Updated: 2024-08-02T04:46:52.635Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda FH1201 v1.2.0.14 was discovered to contain a command injection vulnerability via the mac parameter at ip/goform/WriteFacMac Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/iotresearch/iot-vuln/tree/main/Tenda/FH1201/WriteFacMac
CVE ID: CVE-2024-41475 State: PUBLISHED Published: 2024-08-12T00:00:00 Last Updated: 2024-08-13T14:35:05.349Z Vendors: n/a Products: n/a Problem Types: n/a Description: Gnuboard g6 6.0.7 is vulnerable to Session hijacking due to a CORS misconfiguration. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gist.github.com/AkiaCode/7c878b1699931314246d6589d86b1e89
CVE ID: CVE-2024-41476 State: PUBLISHED Published: 2024-08-09T00:00:00 Last Updated: 2024-08-10T14:37:22.044Z Vendors: n/a Products: n/a Problem Types: n/a Description: AMTT Hotel Broadband Operation System (HiBOS) V3.0.3.151204 and before is vulnerable to SQL Injection via /manager/card/card_detail.php. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.amttgroup.com/ - https://gist.github.com/lidy4x1/3314fbd82c3d72831c16f9c47a9bfb11
CVE ID: CVE-2024-41481 State: PUBLISHED Published: 2024-08-08T00:00:00.000Z Last Updated: 2025-03-20T13:16:49.876Z Vendors: n/a Products: n/a Problem Types: n/a Description: Typora before 1.9.3 Markdown editor has a cross-site scripting (XSS) vulnerability via the Mermaid component. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.typora.io/What%27s-New-1.9/
CVE ID: CVE-2024-41482 State: PUBLISHED Published: 2024-08-08T00:00:00.000Z Last Updated: 2025-03-25T16:30:47.296Z Vendors: n/a Products: n/a Problem Types: n/a Description: Typora before 1.9.3 Markdown editor has a cross-site scripting (XSS) vulnerability via the MathJax component. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.typora.io/What%27s-New-1.9/
CVE ID: CVE-2024-41492 State: PUBLISHED Published: 2024-07-19T00:00:00 Last Updated: 2024-08-02T04:46:52.377Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stack overflow in Tenda AX1806 v1.0.0.1 allows attackers to cause a Denial of Service (DoS) via a crafted input. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://gist.github.com/Swind1er/4176fdc25e415296904c9fb19e2f8293
CVE ID: CVE-2024-41502 State: PUBLISHED Published: 2025-06-10T00:00:00.000Z Last Updated: 2025-06-11T13:46:58.498Z Vendors: n/a Products: n/a Problem Types: n/a Description: Jetimob Plataforma Imobiliaria 20240627-0 is vulnerable to Cross Site Scripting (XSS) via the form field "Observaces" (observances) in the "Pessoas" (persons) section when creating or editing either a legal or a natural person. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://jetimob.com - https://github.com/rafaelbaldasso/CVE-2024-41502
CVE ID: CVE-2024-41503 State: PUBLISHED Published: 2025-06-10T00:00:00.000Z Last Updated: 2025-06-11T13:46:18.152Z Vendors: n/a Products: n/a Problem Types: n/a Description: Jetimob Plataforma Imobiliaria 20240627-0 is vulnerable to Cross Site Scripting (XSS) in the field "Ttulo" (title) inside the filter Save option in the "Busca" (search) function. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://jetimob.com - https://github.com/rafaelbaldasso/CVE-2024-41503
CVE ID: CVE-2024-41504 State: PUBLISHED Published: 2025-06-10T00:00:00.000Z Last Updated: 2025-06-11T13:45:47.823Z Vendors: n/a Products: n/a Problem Types: n/a Description: Jetimob Plataforma Imobiliaria 20240627-0 is vulnerable to Cross Site Scripting (XSS). In the "Oportunidades" (opportunities) section of the application when creating or editing an "Atividade" (activity), the form field "Descrico" allows injection of JavaScript. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://jetimob.com - https://github.com/rafaelbaldasso/CVE-2024-41504
CVE ID: CVE-2024-41505 State: PUBLISHED Published: 2025-06-10T00:00:00.000Z Last Updated: 2025-06-11T13:43:46.155Z Vendors: n/a Products: n/a Problem Types: n/a Description: Jetimob Plataforma Imobiliaria 20240627-0 is vulnerable to Cross Site Scripting (XSS) in the "Pessoas" (persons) section via the field "Profisso" (professor). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://jetimob.com - https://github.com/rafaelbaldasso/CVE-2024-41505
CVE ID: CVE-2024-41511 State: PUBLISHED Published: 2024-10-04T00:00:00.000Z Last Updated: 2025-03-26T14:21:23.810Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Path Traversal (Local File Inclusion) vulnerability in "BinaryFileRedirector.ashx" in CADClick v1.11.0 and before allows remote attackers to retrieve arbitrary local files via the "path" parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://cadclick.de/ - http://kimweb.de/ - https://piuswalter.de/blog/multiple-critical-vulnerabilities-in-cadclick/
CVE ID: CVE-2024-41512 State: PUBLISHED Published: 2024-10-04T00:00:00 Last Updated: 2024-10-04T20:40:34.963521 Vendors: n/a Products: n/a Problem Types: n/a Description: A SQL Injection vulnerability in "ccHandler.aspx" in all versions of CADClick v.1.11.0 and before allows remote attackers to execute arbitrary SQL commands via the "bomid" parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://cadclick.de/ - http://kimweb.de/ - https://piuswalter.de/blog/multiple-critical-vulnerabilities-in-cadclick/
CVE ID: CVE-2024-41513 State: PUBLISHED Published: 2024-10-04T00:00:00 Last Updated: 2024-10-04T20:39:59.981833 Vendors: n/a Products: n/a Problem Types: n/a Description: A reflected cross-site scripting (XSS) vulnerability in "Artikel.aspx" in CADClick v1.11.0 and before allows remote attackers to inject arbitrary web script or HTML via the "searchindex" parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://cadclick.de/ - http://kimweb.de/ - https://piuswalter.de/blog/multiple-critical-vulnerabilities-in-cadclick/
CVE ID: CVE-2024-41514 State: PUBLISHED Published: 2024-10-04T00:00:00 Last Updated: 2024-10-04T20:39:28.355881 Vendors: n/a Products: n/a Problem Types: n/a Description: A reflected cross-site scripting (XSS) vulnerability in "PrevPgGroup.aspx" in CADClick v1.11.0 and before allows remote attackers to inject arbitrary web script or HTML via the "wer" parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://cadclick.de/ - http://kimweb.de/ - https://piuswalter.de/blog/multiple-critical-vulnerabilities-in-cadclick/
CVE ID: CVE-2024-41515 State: PUBLISHED Published: 2024-10-04T00:00:00 Last Updated: 2024-10-04T18:27:34.692Z Vendors: n/a Products: n/a Problem Types: n/a Description: A reflected cross-site scripting (XSS) vulnerability in "ccHandlerResource.ashx" in CADClick <= 1.11.0 allows remote attackers to inject arbitrary web script or HTML via the "res_url" parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://cadclick.de/ - http://kimweb.de/ - https://piuswalter.de/blog/multiple-critical-vulnerabilities-in-cadclick/
CVE ID: CVE-2024-41516 State: PUBLISHED Published: 2024-10-04T00:00:00 Last Updated: 2024-10-04T18:27:48.227Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Reflected cross-site scripting (XSS) vulnerability in "ccHandler.aspx" CADClick <= 1.11.0 allows remote attackers to inject arbitrary web script or HTML via the "bomid" parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://cadclick.de/ - http://kimweb.de/ - https://piuswalter.de/blog/multiple-critical-vulnerabilities-in-cadclick/
CVE ID: CVE-2024-41517 State: PUBLISHED Published: 2024-08-02T00:00:00 Last Updated: 2024-10-28T20:28:52.391Z Vendors: n/a Products: n/a Problem Types: n/a Description: An Incorrect Access Control vulnerability in "/admin/benutzer/institution/rechteverwaltung/uebersicht" in Feripro <= v2.2.3 allows remote attackers to get a list of all users and their corresponding privileges. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://piuswalter.de/blog/multiple-vulnerabilities-in-feripro/ - http://feripro.de - http://mecodia.de
CVE ID: CVE-2024-41518 State: PUBLISHED Published: 2024-08-02T00:00:00 Last Updated: 2024-09-03T19:23:21.467450 Vendors: n/a Products: n/a Problem Types: n/a Description: An Incorrect Access Control vulnerability in "/admin/programm/<program_id>/export/statistics" in Feripro <= v2.2.3 allows remote attackers to export an XLSX file with information about registrations and participants. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://piuswalter.de/blog/multiple-vulnerabilities-in-feripro/ - http://feripro.de - http://mecodia.de
CVE ID: CVE-2024-41519 State: PUBLISHED Published: 2024-08-02T00:00:00 Last Updated: 2024-10-29T20:38:55.501Z Vendors: n/a Products: n/a Problem Types: n/a Description: Feripro <= v2.2.3 is vulnerable to Cross Site Scripting (XSS) via "/admin/programm/<program_id>/zuordnung/veranstaltungen/<event_id>" through the "school" input field. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://piuswalter.de/blog/multiple-vulnerabilities-in-feripro/ - http://feripro.de - http://mecodia.de