Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-24263 State: PUBLISHED Published: 2024-02-05T00:00:00.000Z Last Updated: 2025-06-12T14:52:12.336Z Vendors: n/a Products: n/a Problem Types: n/a Description: Lotos WebServer v0.1.1 was discovered to contain a Use-After-Free (UAF) vulnerability via the response_append_status_line function at /lotos/src/response.c. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/LuMingYinDetect/lotos_detects/blob/main/lotos_detect_1.md
CVE ID: CVE-2024-24265 State: PUBLISHED Published: 2024-02-05T00:00:00.000Z Last Updated: 2025-05-09T17:34:55.644Z Vendors: n/a Products: n/a Problem Types: n/a Description: gpac v2.2.1 was discovered to contain a memory leak via the dst_props variable in the gf_filter_pid_merge_properties_internal function. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/yinluming13579/gpac_defects/blob/main/gpac_1.md
CVE ID: CVE-2024-24266 State: PUBLISHED Published: 2024-02-05T00:00:00.000Z Last Updated: 2025-06-05T18:24:33.175Z Vendors: n/a Products: n/a Problem Types: n/a Description: gpac v2.2.1 was discovered to contain a Use-After-Free (UAF) vulnerability via the dasher_configure_pid function at /src/filters/dasher.c. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/yinluming13579/gpac_defects/blob/main/gpac_2.md
CVE ID: CVE-2024-24267 State: PUBLISHED Published: 2024-02-05T00:00:00.000Z Last Updated: 2025-09-15T14:02:04.654Z Vendors: n/a Products: n/a Problem Types: n/a Description: gpac v2.2.1 (fixed in v2.4.0) was discovered to contain a memory leak via the gfio_blob variable in the gf_fileio_from_blob function. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/yinluming13579/gpac_defects/blob/main/gpac_3.md - https://github.com/gpac/gpac/issues/2571 - https://github.com/gpac/gpac/commit/d28d9ba45cf4f628a7b2c351849a895e6fcf2234 - https://github.com/NixOS/nixpkgs/pull/305402
CVE ID: CVE-2024-24272 State: PUBLISHED Published: 2024-03-21T00:00:00.000Z Last Updated: 2025-03-27T19:41:19.304Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in iTop DualSafe Password Manager & Digital Vault before 1.4.24 allows a local attacker to obtain sensitive information via leaked credentials as plaintext in a log file that can be accessed by the local user without knowledge of the master secret. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://research.hisolutions.com/2024/03/cve-2024-24272-dualsafe-password-manager-leaks-credentials/
CVE ID: CVE-2024-24275 State: PUBLISHED Published: 2024-03-05T00:00:00.000Z Last Updated: 2025-03-27T20:16:47.135Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting vulnerability in Teamwire Windows desktop client v.2.0.1 through v.2.4.0 allows a remote attacker to obtain sensitive information via a crafted payload to the global search function. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://research.hisolutions.com/2020/08/web-vulnerabilities-are-coming-to-the-desktop-again-rces-and-other-vulnerabilities-in-teamwire/
CVE ID: CVE-2024-24276 State: PUBLISHED Published: 2024-03-05T00:00:00.000Z Last Updated: 2025-03-27T20:21:12.802Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting (XSS) vulnerability in Teamwire Windows desktop client v.2.0.1 through v.2.4.0 allows a remote attacker to obtain sensitive information via a crafted payload to the chat name, message preview, username and group name components. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://research.hisolutions.com/2020/08/web-vulnerabilities-are-coming-to-the-desktop-again-rces-and-other-vulnerabilities-in-teamwire/
CVE ID: CVE-2024-24278 State: PUBLISHED Published: 2024-03-05T00:00:00 Last Updated: 2024-08-27T20:20:08.323Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in Teamwire Windows desktop client v.2.0.1 through v.2.4.0 allows a remote attacker to obtain sensitive information via a crafted payload to the message function. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://research.hisolutions.com/2020/08/web-vulnerabilities-are-coming-to-the-desktop-again-rces-and-other-vulnerabilities-in-teamwire/
CVE ID: CVE-2024-24279 State: PUBLISHED Published: 2024-04-08T00:00:00 Last Updated: 2024-08-27T17:49:46.799Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in secdiskapp 1.5.1 (management program for NewQ Fingerprint Encryption Super Speed Flash Disk) allows attackers to gain escalated privileges via vsVerifyPassword and vsSetFingerPrintPower functions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/BossSecuLab/Vulnerability_Reporting/security/advisories/GHSA-9fj6-vr9p-px49
CVE ID: CVE-2024-24291 State: PUBLISHED Published: 2024-02-06T00:00:00.000Z Last Updated: 2025-04-24T15:51:28.453Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in the component /member/index/login of yzmcms v7.0 allows attackers to direct users to malicious sites via a crafted URL. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://gitee.com/wgd0ay/wgd0ay/issues/I8WSD1
CVE ID: CVE-2024-24292 State: PUBLISHED Published: 2025-03-28T00:00:00.000Z Last Updated: 2025-04-01T19:02:19.816Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Prototype Pollution issue in Aliconnect /sdk v.0.0.6 allows an attacker to execute arbitrary code via the aim function in the aim.js component. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gist.github.com/tariqhawis/a8b2c936622c885558173c37df0a77d9
CVE ID: CVE-2024-24293 State: PUBLISHED Published: 2024-05-20T17:26:31.851Z Last Updated: 2025-02-13T15:47:08.650Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Prototype Pollution issue in MiguelCastillo @bit/loader v.10.0.3 allows an attacker to execute arbitrary code via the M function e argument in index.js. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gist.github.com/tariqhawis/986fb1c9da6be526fb2656ba8d194b7f
CVE ID: CVE-2024-24294 State: PUBLISHED Published: 2024-05-20T16:25:50.992Z Last Updated: 2025-02-13T15:47:09.183Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Prototype Pollution issue in Blackprint @blackprint/engine v.0.9.0 allows an attacker to execute arbitrary code via the _utils.setDeepProperty function of engine.min.js. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://gist.github.com/mestrtee/d1eb6e1f7c6dd60d8838c3e56cab634d
CVE ID: CVE-2024-24300 State: PUBLISHED Published: 2024-02-14T00:00:00 Last Updated: 2024-08-16T18:22:20.145Z Vendors: n/a Products: n/a Problem Types: n/a Description: 4ipnet EAP-767 v3.42.00 is vulnerable to Incorrect Access Control. The device uses the same set of credentials, regardless of how many times a user logs in, the content of the cookie remains unchanged. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/yckuo-sdc/PoC
CVE ID: CVE-2024-24301 State: PUBLISHED Published: 2024-02-14T00:00:00 Last Updated: 2024-08-27T18:56:01.133Z Vendors: n/a Products: n/a Problem Types: n/a Description: Command Injection vulnerability discovered in 4ipnet EAP-767 device v3.42.00 within the web interface of the device allows attackers with valid credentials to inject arbitrary shell commands to be executed by the device with root privileges. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/yckuo-sdc/PoC
CVE ID: CVE-2024-24302 State: PUBLISHED Published: 2024-03-03T00:00:00 Last Updated: 2024-08-01T23:19:52.017Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Tunis Soft "Product Designer" (productdesigner) module for PrestaShop before version 1.178.36, allows remote attackers to execute arbitrary code, escalate privileges, and obtain sensitive information via the postProcess() method. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/friends-of-presta/security-advisories/blob/main/_posts/2024-02-29-productdesigner-502.md
CVE ID: CVE-2024-24303 State: PUBLISHED Published: 2024-02-07T00:00:00 Last Updated: 2024-08-22T19:06:04.443Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL Injection vulnerability in HiPresta "Gift Wrapping Pro" (hiadvancedgiftwrapping) module for PrestaShop before version 1.4.1, allows remote attackers to escalate privileges and obtain sensitive information via the HiAdvancedGiftWrappingGiftWrappingModuleFrontController::addGiftWrappingCartValue() method. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://security.friendsofpresta.org/modules/2024/02/06/hiadvancedgiftwrapping.html
CVE ID: CVE-2024-24304 State: PUBLISHED Published: 2024-02-07T00:00:00.000Z Last Updated: 2025-06-09T16:19:06.766Z Vendors: n/a Products: n/a Problem Types: n/a Description: In the module "Mailjet" (mailjet) from Mailjet for PrestaShop before versions 3.5.1, a guest can download technical information without restriction. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/mailjet/prestashop-mailjet-plugin-apiv3/releases/tag/v3.5.1 - https://security.friendsofpresta.org/modules/2024/02/06/mailjet.html
CVE ID: CVE-2024-24307 State: PUBLISHED Published: 2024-03-03T00:00:00 Last Updated: 2024-08-08T18:32:00.694Z Vendors: n/a Products: n/a Problem Types: n/a Description: Path Traversal vulnerability in Tunis Soft "Product Designer" (productdesigner) module for PrestaShop before version 1.178.36, allows a remote attacker to escalate privileges and obtain sensitive information via the ajaxProcessCropImage() method. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/friends-of-presta/security-advisories/blob/main/_posts/2024-02-29-productdesigner-22.md
CVE ID: CVE-2024-24308 State: PUBLISHED Published: 2024-02-09T00:00:00 Last Updated: 2024-08-19T16:28:40.786Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL Injection vulnerability in Boostmyshop (boostmyshopagent) module for Prestashop versions 1.1.9 and before, allows remote attackers to escalate privileges and obtain sensitive information via changeOrderCarrier.php, relayPoint.php, and shippingConfirmation.php. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://security.friendsofpresta.org/modules/2024/02/08/boostmyshopagent.html
CVE ID: CVE-2024-24309 State: PUBLISHED Published: 2024-02-23T00:00:00 Last Updated: 2024-08-01T23:19:52.016Z Vendors: n/a Products: n/a Problem Types: n/a Description: In the module "Survey TMA" (ecomiz_survey_tma) up to version 2.0.0 from Ecomiz for PrestaShop, a guest can download personal information without restriction. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.ecomiz.com/ - https://security.friendsofpresta.org/modules/2024/02/20/ecomiz_survey_tma.html
CVE ID: CVE-2024-24310 State: PUBLISHED Published: 2024-02-23T00:00:00 Last Updated: 2024-08-28T20:14:50.912Z Vendors: n/a Products: n/a Problem Types: n/a Description: In the module "Generate barcode on invoice / delivery slip" (ecgeneratebarcode) from Ether Creation <= 1.2.0 for PrestaShop, a guest can perform SQL injection. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://addons.prestashop.com/en/preparation-shipping/24123-generate-barcode-on-invoice-delivery-slip.html - https://security.friendsofpresta.org/modules/2024/02/20/ecgeneratebarcode.html
CVE ID: CVE-2024-24311 State: PUBLISHED Published: 2024-02-07T00:00:00.000Z Last Updated: 2025-06-05T18:28:23.471Z Vendors: n/a Products: n/a Problem Types: n/a Description: Path Traversal vulnerability in Linea Grafica "Multilingual and Multistore Sitemap Pro - SEO" (lgsitemaps) module for PrestaShop before version 1.6.6, a guest can download personal information without restriction. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://security.friendsofpresta.org/modules/2024/02/06/lgsitemaps.html
CVE ID: CVE-2024-24312 State: PUBLISHED Published: 2024-05-01T00:00:00 Last Updated: 2024-08-01T23:19:52.156Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in Vaales Technologies V_QRS v.2024-01-17 allows a remote attacker to obtain sensitive information via the Models/UserModel.php component. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www2.deloitte.com/xe/en/pages/about-deloitte/articles/sustainable-strategies/unveiling-vulnerabilities-in-cybersecurity.html
CVE ID: CVE-2024-24313 State: PUBLISHED Published: 2024-05-01T00:00:00 Last Updated: 2024-08-01T23:19:52.010Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in Vaales Technologies V_QRS v.2024-01-17 allows a remote attacker to obtain sensitive information via the Models/FormModel.php and QRModel.php component. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www2.deloitte.com/xe/en/pages/about-deloitte/articles/sustainable-strategies/unveiling-vulnerabilities-in-cybersecurity.html
CVE ID: CVE-2024-24320 State: PUBLISHED Published: 2024-06-14T00:00:00 Last Updated: 2024-08-21T13:54:40.516Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory Traversal vulnerability in Mgt-commerce CloudPanel v.2.0.0 thru v.2.4.0 allows a remote attacker to obtain sensitive information and execute arbitrary code via the service parameter of the load-logfiles function. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://datack.my/cloudpanel-v2-0-0-v2-4-0-authenticated-user-session-hijacking-cve-2024-24320/
CVE ID: CVE-2024-24321 State: PUBLISHED Published: 2024-02-08T00:00:00.000Z Last Updated: 2025-06-20T20:18:05.427Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in Dlink DIR-816A2 v.1.10CNB05 allows a remote attacker to execute arbitrary code via the wizardstep4_ssid_2 parameter in the sub_42DA54 function. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.dlink.com/en/security-bulletin/ - https://www.dlink.com/ - http://dir-816a2.com - https://github.com/dkjiayu/Vul/blob/main/DIR816A2-dir_setWanWifi.md
CVE ID: CVE-2024-24323 State: PUBLISHED Published: 2024-02-27T00:00:00 Last Updated: 2024-08-28T15:48:52.290Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in linlinjava litemall v.1.8.0 allows a remote attacker to obtain sensitive information via the nickname, consignee, orderSN, orderStatusArray parameters of the AdminOrdercontroller.java component. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/lousix/exp/blob/main/CVE-2024-24323/CVE-2024-24323.md
CVE ID: CVE-2024-24324 State: PUBLISHED Published: 2024-01-30T00:00:00.000Z Last Updated: 2025-06-20T19:54:03.106Z Vendors: n/a Products: n/a Problem Types: n/a Description: TOTOLINK A8000RU v7.1cu.643_B20200521 was discovered to contain a hardcoded password for root stored in /etc/shadow. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/funny-mud-peee/IoT-vuls/blob/main/TOTOLINK%20A8000RU/TOTOlink%20A8000RU%20hard%20code.md
CVE ID: CVE-2024-24325 State: PUBLISHED Published: 2024-01-30T00:00:00.000Z Last Updated: 2025-06-20T19:54:45.582Z Vendors: n/a Products: n/a Problem Types: n/a Description: TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the enable parameter in the setParentalRules function. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/funny-mud-peee/IoT-vuls/blob/main/TOTOLINK%20A3300R/11/TOTOlink%20A3300R%20setParentalRules.md
CVE ID: CVE-2024-24326 State: PUBLISHED Published: 2024-01-30T00:00:00 Last Updated: 2024-08-29T18:08:35.311Z Vendors: n/a Products: n/a Problem Types: n/a Description: TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the arpEnable parameter in the setStaticDhcpRules function. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/funny-mud-peee/IoT-vuls/blob/main/TOTOLINK%20A3300R/8/TOTOlink%20A3300R%20setStaticDhcpRules.md
CVE ID: CVE-2024-24327 State: PUBLISHED Published: 2024-01-30T00:00:00.000Z Last Updated: 2025-05-29T15:06:19.976Z Vendors: n/a Products: n/a Problem Types: n/a Description: TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the pppoePass parameter in the setIpv6Cfg function. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/funny-mud-peee/IoT-vuls/blob/main/TOTOLINK%20A3300R/7/TOTOlink%20A3300R%20setIpv6Cfg.md
CVE ID: CVE-2024-24328 State: PUBLISHED Published: 2024-01-30T00:00:00 Last Updated: 2024-08-28T15:22:42.345Z Vendors: n/a Products: n/a Problem Types: n/a Description: TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the enable parameter in the setMacFilterRules function. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/funny-mud-peee/IoT-vuls/blob/main/TOTOLINK%20A3300R/12/TOTOlink%20A3300R%20setMacFilterRules.md
CVE ID: CVE-2024-24329 State: PUBLISHED Published: 2024-01-30T00:00:00.000Z Last Updated: 2025-06-12T14:53:09.409Z Vendors: n/a Products: n/a Problem Types: n/a Description: TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the enable parameter in the setPortForwardRules function. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/funny-mud-peee/IoT-vuls/blob/main/TOTOLINK%20A3300R/10/TOTOlink%20A3300R%20setPortForwardRules.md
CVE ID: CVE-2024-24330 State: PUBLISHED Published: 2024-01-30T00:00:00.000Z Last Updated: 2025-06-09T18:34:26.045Z Vendors: n/a Products: n/a Problem Types: n/a Description: TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the port or enable parameter in the setRemoteCfg function. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/funny-mud-peee/IoT-vuls/blob/main/TOTOLINK%20A3300R/14/TOTOlink%20A3300R%20setRemoteCfg.md
CVE ID: CVE-2024-24331 State: PUBLISHED Published: 2024-01-30T00:00:00.000Z Last Updated: 2025-05-29T15:06:07.725Z Vendors: n/a Products: n/a Problem Types: n/a Description: TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the enable parameter in the setWiFiScheduleCfg function. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/funny-mud-peee/IoT-vuls/blob/main/TOTOLINK%20A3300R/13/TOTOlink%20A3300R%20setWiFiScheduleCfg.md
CVE ID: CVE-2024-24332 State: PUBLISHED Published: 2024-01-30T00:00:00.000Z Last Updated: 2025-05-30T19:08:06.478Z Vendors: n/a Products: n/a Problem Types: n/a Description: TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the url parameter in the setUrlFilterRules function. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/funny-mud-peee/IoT-vuls/blob/main/TOTOLINK%20A3300R/9/TOTOlink%20A3300R%20setUrlFilterRules.md
CVE ID: CVE-2024-24333 State: PUBLISHED Published: 2024-01-30T00:00:00.000Z Last Updated: 2025-06-12T14:55:00.400Z Vendors: n/a Products: n/a Problem Types: n/a Description: TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the desc parameter in the setWiFiAclRules function. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/funny-mud-peee/IoT-vuls/blob/main/TOTOLINK%20A3300R/15/TOTOlink%20A3300R%20setWiFiAclRules.md
CVE ID: CVE-2024-24334 State: PUBLISHED Published: 2024-03-27T00:00:00 Last Updated: 2024-08-01T23:19:52.143Z Vendors: n/a Products: n/a Problem Types: n/a Description: A heap buffer overflow occurs in dfs_v2 dfs_file in RT-Thread through 5.0.2. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/RT-Thread/rt-thread/issues/8282 - https://github.com/RT-Thread/rt-thread/pull/8305 - http://seclists.org/fulldisclosure/2024/Mar/28 - https://github.com/hnsecurity/vulns/blob/main/HNS-2024-05-rt-thread.txt - https://security.humanativaspa.it/multiple-vulnerabilities-in-rt-thread-rtos/ - http://www.openwall.com/lists/oss-security/2024/03/05/1
CVE ID: CVE-2024-24335 State: PUBLISHED Published: 2024-03-27T00:00:00.000Z Last Updated: 2025-11-04T18:29:03.023Z Vendors: n/a Products: n/a Problem Types: n/a Description: A heap buffer overflow occurs in the dfs_v2 romfs filesystem RT-Thread through 5.0.2. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/RT-Thread/rt-thread/issues/8271 - https://github.com/RT-Thread/rt-thread/pull/8278 - https://github.com/hnsecurity/vulns/blob/main/HNS-2024-05-rt-thread.txt - https://security.humanativaspa.it/multiple-vulnerabilities-in-rt-thread-rtos/ - https://seclists.org/fulldisclosure/2024/Mar/28 - http://www.openwall.com/lists/oss-security
lities-in-rt-thread-rtos/ - https://seclists.org/fulldisclosure/2024/Mar/28 - http://www.openwall.com/lists/oss-security/2024/03/05/1
CVE ID: CVE-2024-24336 State: PUBLISHED Published: 2024-03-19T00:00:00.000Z Last Updated: 2025-09-29T14:28:04.099Z Vendors: n/a Products: n/a Problem Types: n/a Description: A multiple Cross-site scripting (XSS) vulnerability in the '/members/moremember.pl', and ‘/members/members-home.pl’ endpoints within Koha Library Management System version 23.05.05 and earlier allows malicious staff users to carry out CSRF attacks, including unauthorized changes to usernames and passwords of users visiting the affected page, via the 'Circulation note' and ‘Patrons Restriction’ components. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://nitipoom-jar.github
s. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://nitipoom-jar.github.io/CVE-2024-24336/ - https://nitipoom-jaroonchaipipat.github.io/security-research-portal/2024-24336
CVE ID: CVE-2024-24337 State: PUBLISHED Published: 2024-02-12T00:00:00.000Z Last Updated: 2025-09-29T14:22:32.206Z Vendors: n/a Products: n/a Problem Types: n/a Description: CSV Injection vulnerability in '/members/moremember.pl' and '/admin/aqbudgets.pl' endpoints in Koha Library Management System version 23.05.05 and earlier allows attackers to to inject DDE commands into csv exports via the 'Budget' and 'Patrons Member' components. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://nitipoom-jar.github.io/CVE-2024-24337/ - https://nitipoom-jaroonchaipipat.github.io/security-research-portal/2024-24337