Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-12345 State: PUBLISHED Published: 2025-01-27T11:00:13.130Z Last Updated: 2025-02-12T16:53:39.127Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H) Vendors: INW Products: Krbyyyzo Problem Types: CWE-400, CWE-404 Description: A vulnerability classified as problematic was found in INW Krbyyyzo 25.2002. Affected by this vulnerability is an unknown functionality of the file /gbo.aspx of the component Daily Huddle Site. The manipulation of the argument s leads to resource consumption. It is possible to launch the attack on the local host. Other endpoints might be affected as well. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuld
Other endpoints might be affected as well. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.293509 - https://vuldb.com/?ctiid.293509
CVE ID: CVE-2024-12346 State: PUBLISHED Published: 2024-12-08T23:31:05.563Z Last Updated: 2024-12-09T15:46:53.793Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: n/a Products: Talentera Problem Types: CWE-79, CWE-94 Description: A vulnerability has been found in Talentera up to 20241128 and classified as problematic. This vulnerability affects unknown code of the file /app/control/byt_cv_manager. The manipulation of the argument redirect_url leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The provided PoC only works in Mozilla Firefox. The vendor was contacted early about this disclosure but did no
be used. The provided PoC only works in Mozilla Firefox. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.287266 - https://vuldb.com/?ctiid.287266 - https://vuldb.com/?submit.453609 - https://cloudphoto.ro/en/OVcHC1Pb3twmFC7
CVE ID: CVE-2024-12347 State: PUBLISHED Published: 2024-12-08T23:31:07.459Z Last Updated: 2024-12-09T15:44:23.504Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Guangzhou Huayi Intelligent Technology Products: Jeewms Problem Types: CWE-285, CWE-266 Description: A vulnerability was found in Guangzhou Huayi Intelligent Technology Jeewms up to 1.0.0 and classified as critical. This issue affects some unknown processing of the file /jeewms_war/webpage/system/druid/index.html of the component Druid Monitoring Interface. The manipulation leads to improper authorization. The attack may be initiated remotely. The exploit has been disclosed to the public and may be
to improper authorization. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.287267 - https://vuldb.com/?ctiid.287267 - https://vuldb.com/?submit.453917 - https://github.com/dycccccccc/JEEWMS/blob/main/JEEWMS%20Druid%20monitoring%20interface%20is%20not%20authorized.docx
CVE ID: CVE-2024-12348 State: PUBLISHED Published: 2024-12-09T00:00:12.081Z Last Updated: 2024-12-09T17:59:35.372Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: Guizhou Xiaoma Technology Products: jpress Problem Types: CWE-79, CWE-94 Description: A vulnerability was found in Guizhou Xiaoma Technology jpress 5.1.2. It has been classified as problematic. Affected is the function AttachmentUtils.isUnSafe of the file /commons/attachment/upload of the component Attachment Upload Handler. The manipulation of the argument files[] leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst
ossible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.287268 - https://vuldb.com/?ctiid.287268 - https://vuldb.com/?submit.454825 - https://github.com/dycccccccc/jpress/blob/main/JPRESS%20has%20XSS%20vulnerability.docx
CVE ID: CVE-2024-12349 State: PUBLISHED Published: 2024-12-09T00:00:16.701Z Last Updated: 2024-12-09T17:57:33.573Z Severity: N/A (CVSS 5 AV:N/AC:L/Au:N/C:N/I:P/A:N) Vendors: n/a Products: JFinalCMS Problem Types: CWE-352, CWE-862 Description: A vulnerability was found in JFinalCMS 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /admin/tag/save. The manipulation leads to cross-site request forgery. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.287269 - https://vuldb.com/?ctiid.287269 - https
yst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.287269 - https://vuldb.com/?ctiid.287269 - https://vuldb.com/?submit.456042 - https://github.com/hadagaga/vuln/blob/master/JFinalCMS/Cross_Site_Request_Forgery/Cross-Site-Request-Forgery.md
CVE ID: CVE-2024-12350 State: PUBLISHED Published: 2024-12-09T00:31:05.003Z Last Updated: 2024-12-09T15:33:39.069Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: n/a Products: JFinalCMS Problem Types: CWE-77, CWE-74 Description: A vulnerability was found in JFinalCMS 1.0. It has been rated as critical. Affected by this issue is the function update of the file \src\main\java\com\cms\controller\admin\TemplateController.java of the component Template Handler. The manipulation of the argument content leads to command injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: Refere
The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.287270 - https://vuldb.com/?ctiid.287270 - https://vuldb.com/?submit.456047 - https://github.com/hadagaga/vuln/blob/master/JFinalCMS/Server_Side%20_Template_Injection/Server-Side-Template-Injection.md
CVE ID: CVE-2024-12351 State: PUBLISHED Published: 2024-12-09T00:31:06.456Z Last Updated: 2024-12-10T14:09:20.540Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: n/a Products: JFinalCMS Problem Types: CWE-89, CWE-74 Description: A vulnerability classified as critical has been found in JFinalCMS 1.0. This affects the function findPage of the file src\main\java\com\cms\entity\ContentModel.java of the component File Content Handler. The manipulation of the argument name leads to sql injection. It is possible to initiate the attack remotely. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.287271 - https://vuldb.com/?ctiid.287271 - https://vuld
es: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.287271 - https://vuldb.com/?ctiid.287271 - https://vuldb.com/?submit.456048 - https://github.com/hadagaga/vuln/blob/master/JFinalCMS/sql-1/SQL_injection_vulnerability.md
CVE ID: CVE-2024-12352 State: PUBLISHED Published: 2024-12-09T01:00:16.961Z Last Updated: 2024-12-09T20:19:48.365Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: TOTOLINK Products: EX1800T Problem Types: CWE-121, CWE-119 Description: A vulnerability classified as problematic was found in TOTOLINK EX1800T 9.1.0cu.2112_B20220316. This vulnerability affects the function sub_40662C of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument ssid leads to stack-based buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://v
been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.287272 - https://vuldb.com/?ctiid.287272 - https://vuldb.com/?submit.457392 - https://github.com/zheng0064/cve/blob/main/StackOverFlow-CVE.md - https://www.totolink.net/
CVE ID: CVE-2024-12353 State: PUBLISHED Published: 2024-12-09T01:00:19.368Z Last Updated: 2024-12-12T13:45:05.477Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: SourceCodester Products: Phone Contact Manager System Problem Types: CWE-20 Description: A vulnerability, which was classified as problematic, has been found in SourceCodester Phone Contact Manager System 1.0. This issue affects the function UserInterface::MenuDisplayStart of the component User Menu. The manipulation of the argument name leads to improper input validation. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA
locally is a requirement. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.287273 - https://vuldb.com/?ctiid.287273 - https://vuldb.com/?submit.457438 - https://github.com/jasontimwong/CVE/issues/1 - https://www.sourcecodester.com/
CVE ID: CVE-2024-12354 State: PUBLISHED Published: 2024-12-09T01:31:05.768Z Last Updated: 2024-12-09T20:12:30.989Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: SourceCodester Products: Phone Contact Manager System Problem Types: CWE-120, CWE-119 Description: A vulnerability, which was classified as critical, was found in SourceCodester Phone Contact Manager System 1.0. Affected is the function UserInterface::MenuDisplayStart of the component User Menu. The manipulation leads to buffer overflow. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichm
local host. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.287274 - https://vuldb.com/?ctiid.287274 - https://vuldb.com/?submit.457477 - https://github.com/jasontimwong/CVE/issues/2 - https://www.sourcecodester.com/
CVE ID: CVE-2024-12355 State: PUBLISHED Published: 2024-12-09T01:31:07.752Z Last Updated: 2024-12-12T13:45:10.433Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: SourceCodester Products: Phone Contact Manager System Problem Types: CWE-20 Description: A vulnerability has been found in SourceCodester Phone Contact Manager System 1.0 and classified as problematic. Affected by this vulnerability is the function ContactBook::adding of the file ContactBook.cpp. The manipulation leads to improper input validation. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment:
ocally. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.287275 - https://vuldb.com/?ctiid.287275 - https://vuldb.com/?submit.457864 - https://github.com/TinkAnet/cve/blob/main/BOF2.md - https://www.sourcecodester.com/
CVE ID: CVE-2024-12356 State: PUBLISHED Published: 2024-12-17T04:29:07.883Z Last Updated: 2025-10-21T22:55:34.239Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: BeyondTrust Products: Remote Support, Privileged Remote Access Problem Types: CWE-77 Description: A critical vulnerability has been discovered in Privileged Remote Access (PRA) and Remote Support (RS) products which can allow an unauthenticated attacker to inject commands that are run as a site user. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.cve.org/CVERecord?id=CVE-2024-12356 - https://nvd.nist.gov/vuln/detail/CVE-2024-12356 - https://w
erences: - https://www.cve.org/CVERecord?id=CVE-2024-12356 - https://nvd.nist.gov/vuln/detail/CVE-2024-12356 - https://www.beyondtrust.com/trust-center/security-advisories/bt24-10
CVE ID: CVE-2024-12357 State: PUBLISHED Published: 2024-12-09T04:31:09.257Z Last Updated: 2024-12-09T19:58:49.115Z Severity: N/A (CVSS 5 AV:N/AC:L/Au:N/C:N/I:P/A:N) Vendors: SourceCodester Products: Best House Rental Management System Problem Types: CWE-73 Description: A vulnerability was found in SourceCodester Best House Rental Management System 1.0 and classified as problematic. Affected by this issue is some unknown functionality of the file /index.php. The manipulation of the argument page leads to file inclusion. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vul
en disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.287276 - https://vuldb.com/?ctiid.287276 - https://vuldb.com/?submit.457505 - https://pastebin.com/Qupf8YbH - https://www.sourcecodester.com/
CVE ID: CVE-2024-12358 State: PUBLISHED Published: 2024-12-09T04:31:11.396Z Last Updated: 2024-12-09T19:57:29.558Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: WeiYe-Jing Products: datax-web Problem Types: CWE-78, CWE-77 Description: A vulnerability was found in WeiYe-Jing datax-web 2.1.1. It has been classified as critical. This affects an unknown part of the file /api/job/add/. The manipulation of the argument glueSource leads to os command injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.287277 - https://vuldb.com/?c
ed. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.287277 - https://vuldb.com/?ctiid.287277 - https://vuldb.com/?submit.457865 - https://github.com/jxp98/VulResearch/blob/main/2024/12/1.Datax-Web%20-%20Remote%20Code%20Execution.md
CVE ID: CVE-2024-12359 State: PUBLISHED Published: 2024-12-09T05:00:13.606Z Last Updated: 2024-12-09T19:52:55.986Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: code-projects Products: Admin Dashboard Problem Types: CWE-79, CWE-94 Description: A vulnerability was found in code-projects Admin Dashboard 1.0. It has been declared as problematic. This vulnerability affects unknown code of the file /vendor_management.php. The manipulation of the argument username leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The initial researcher advisory mentions contradicting product names. Additional Analyst Note
he public and may be used. The initial researcher advisory mentions contradicting product names. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.287278 - https://vuldb.com/?ctiid.287278 - https://vuldb.com/?submit.458634 - https://hackmd.io/@salt9487/HyTgLR-V1l - https://code-projects.org/
CVE ID: CVE-2024-12360 State: PUBLISHED Published: 2024-12-09T05:00:17.841Z Last Updated: 2024-12-09T19:51:21.613Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: code-projects Products: Online Class and Exam Scheduling System Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in code-projects Online Class and Exam Scheduling System 1.0. It has been rated as critical. This issue affects some unknown processing of the file class_update.php. The manipulation of the argument id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: -
loit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.287279 - https://vuldb.com/?ctiid.287279 - https://vuldb.com/?submit.458891 - https://github.com/bjtyyy/CVE/blob/main/Online%20Class%20and%20Exam%20Scheduling%20System.docx - https://code-projects.org/
CVE ID: CVE-2024-12362 State: PUBLISHED Published: 2024-12-16T10:00:18.068Z Last Updated: 2024-12-16T15:54:15.410Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: n/a Products: InvoicePlane Problem Types: CWE-22 Description: A vulnerability was found in InvoicePlane up to 1.6.1. It has been classified as problematic. This affects the function download of the file invoices.php. The manipulation of the argument invoice leads to path traversal. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.6.2-beta-1 is able to address this issue. It is recommended to upgrade the affected com
be used. Upgrading to version 1.6.2-beta-1 is able to address this issue. It is recommended to upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.288537 - https://vuldb.com/?ctiid.288537 - https://vuldb.com/?submit.459908 - https://github.com/InvoicePlane/InvoicePlane/pull/1127 - https://github.com/InvoicePlane/InvoicePlane/releases/tag/v1.6.2-beta-1
CVE ID: CVE-2024-12363 State: PUBLISHED Published: 2024-12-11T09:32:04.370Z Last Updated: 2024-12-11T15:24:16.973Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H) Vendors: TeamViewer Products: Patch & Asset Management Problem Types: CWE-732 Description: Insufficient permissions in the TeamViewer Patch & Asset Management component prior to version 24.12 on Windows allows a local authenticated user to delete arbitrary files. TeamViewer Patch & Asset Management is part of TeamViewer Remote Management. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.teamviewer.com/en/resources/trust-center/security-bulletins/tv-2024-1008/
CVE ID: CVE-2024-12364 State: PUBLISHED Published: 2025-06-27T16:13:51.955Z Last Updated: 2025-09-23T07:43:57.911Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Mavi Yeşil Software Products: Guest Tracking Software Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Mavi Yeşil Software Guest Tracking Software allows SQL Injection.This issue affects Guest Tracking Software. NOTE: The vendor did not inform about the completion of the fixing process within the specified time. The CVE will be updated when new information becomes available. Additional Analyst Notes: - CISA AD
the specified time. The CVE will be updated when new information becomes available. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.usom.gov.tr/bildirim/tr-25-0140
CVE ID: CVE-2024-12365 State: PUBLISHED Published: 2025-01-14T07:05:40.307Z Last Updated: 2025-01-14T14:47:45.794Z Severity: HIGH (CVSS 8.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N) Vendors: boldgrid Products: W3 Total Cache Problem Types: CWE-862 Description: The W3 Total Cache plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the is_w3tc_admin_page function in all versions up to, and including, 2.8.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to obtain the plugin's nonce value and perform unauthorized actions, resulting in information disclosure, service plan limits consumption as wel
once value and perform unauthorized actions, resulting in information disclosure, service plan limits consumption as well as making web requests to arbitrary locations originating from the web application that can be used to query information from internal services, including instance metadata on cloud-based applications. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/196e629f-7c77-4bcb-8224-305a0108b630?source=cve - https://plugins.trac.wordpress.org/browser/w3-total-cache/tags/2.8.0/w3-total-cache.php#L71 - https://plugins.trac.wordpress.org/browser/w3-total-cache/tags/2.8.0/Root_Loader.php#L269 - https://plugins.t
.php#L71 - https://plugins.trac.wordpress.org/browser/w3-total-cache/tags/2.8.0/Root_Loader.php#L269 - https://plugins.trac.wordpress.org/browser/w3-total-cache/tags/2.8.0/Generic_Plugin_Admin.php#L55 - https://plugins.trac.wordpress.org/browser/w3-total-cache/tags/2.8.0/Generic_Plugin_Admin.php#L385 - https://plugins.trac.wordpress.org/browser/w3-total-cache/tags/2.8.0/Generic_Plugin_Admin.php#L516 - https://plugins.trac.wordpress.org/browser/w3-total-cache/tags/2.8.0/Util_Admin.php#L822 - https://plugins.trac.wordpress.org/browser/w3-total-cache/tags/2.8.0/inc/options/common/top_nav_bar.php#L217 - https://plugins.trac.wordpress.org/browser/w3-total-cache/tags/2.8.0/inc/options/common/foote
mon/top_nav_bar.php#L217 - https://plugins.trac.wordpress.org/browser/w3-total-cache/tags/2.8.0/inc/options/common/footer.php#L49 - https://plugins.trac.wordpress.org/browser/w3-total-cache/tags/2.8.0/Extensions_Plugin_Admin.php#L55 - https://plugins.trac.wordpress.org/browser/w3-total-cache/tags/2.8.0/Extensions_Plugin_Admin.php#L246 - https://plugins.trac.wordpress.org/browser/w3-total-cache/tags/2.8.0/Extension_ImageService_Plugin_Admin.php#L200 - https://plugins.trac.wordpress.org/browser/w3-total-cache/tags/2.8.0/UsageStatistics_Plugin_Admin.php#L10 - https://plugins.trac.wordpress.org/browser/w3-total-cache/tags/2.8.0/UsageStatistics_Plugin_Admin.php#L94
CVE ID: CVE-2024-12366 State: PUBLISHED Published: 2025-02-11T12:42:11.882Z Last Updated: 2025-02-11T19:28:21.551Z Vendors: Sinaptik AI Products: PandasAI Problem Types: CWE-94 Improper Control of Generation of Code ('Code Injection') Description: PandasAI uses an interactive prompt function that is vulnerable to prompt injection and run arbitrary Python code that can lead to Remote Code Execution (RCE) instead of the intended explanation of the natural language processing by the LLM. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://docs.pandas-ai.com/advanced-security-agent - https://docs.getpanda.ai/v3/privacy-security
CVE ID: CVE-2024-12367 State: PUBLISHED Published: 2025-09-16T07:46:32.825Z Last Updated: 2025-09-23T07:36:49.773Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H) Vendors: Vegagrup Software Products: Vega Master Problem Types: CWE-497 Description: Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Vegagrup Software Vega Master allows Directory Indexing.This issue affects Vega Master: from v.1.12.35 through 20250916. NOTE: The vendor did not inform about the completion of the fixing process within the specified time. The CVE will be updated when new information becomes available. Additional Analyst Notes: - CISA ADP Vulnrichment:
time. The CVE will be updated when new information becomes available. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.usom.gov.tr/bildirim/tr-25-0249
CVE ID: CVE-2024-12368 State: PUBLISHED Published: 2025-02-25T18:10:12.109Z Last Updated: 2025-02-25T18:59:46.305Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) Vendors: Odoo Products: Odoo Community, Odoo Enterprise Problem Types: CWE-284 Description: Improper access control in the auth_oauth module of Odoo Community 15.0 and Odoo Enterprise 15.0 allows an internal user to export the OAuth tokens of other users. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/odoo/odoo/issues/193854