Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-24455 State: PUBLISHED Published: 2024-11-15T00:00:00.000Z Last Updated: 2025-08-26T21:10:12.027Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Hewlett Packard Enterprise (HPE) Products: HPE Athonet Core Description: An invalid memory access when handling a UE Context Release message containing an invalid UE identifier in Athonet vEPC MME v11.4.0 allows attackers to cause a Denial of Service (DoS) to the cellular network by repeatedly initiating connections and sending a crafted payload. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04780en_us&docLocale=en_US
CVE ID: CVE-2024-24456 State: PUBLISHED Published: 2025-03-31T20:33:05.688Z Last Updated: 2025-04-03T17:42:17.133Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Hewlett Packard Enterprise (HPE) Products: HPE Athonet Core Description: An E-RAB Release Command packet containing a malformed NAS PDU will cause the Athonet MME to immediately crash, potentially due to a buffer overflow. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04780en_us&docLocale=en_US
CVE ID: CVE-2024-24457 State: PUBLISHED Published: 2024-11-15T00:00:00.000Z Last Updated: 2025-08-26T21:10:55.385Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Hewlett Packard Enterprise (HPE) Products: HPE Athonet Core Description: An invalid memory access when handling the ProtocolIE_ID field of E-RAB Setup List Context SURes messages in Athonet vEPC MME v11.4.0 allows attackers to cause a Denial of Service (DoS) to the cellular network by repeatedly initiating connections and sending a crafted payload. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04780en_us&docLocale=en_US
CVE ID: CVE-2024-24458 State: PUBLISHED Published: 2024-11-15T00:00:00.000Z Last Updated: 2025-08-26T21:11:30.537Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Hewlett Packard Enterprise (HPE) Products: HPE Athonet Core Description: An invalid memory access when handling the ENB Configuration Transfer messages containing invalid PLMN Identities in Athonet vEPC MME v11.4.0 allows attackers to cause a Denial of Service (DoS) to the cellular network by repeatedly initiating connections and sending a crafted payload. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04780en_us&docLoca
: - CISA ADP Vulnrichment: References: - https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04780en_us&docLocale=en_US
CVE ID: CVE-2024-24459 State: PUBLISHED Published: 2024-11-15T00:00:00.000Z Last Updated: 2025-08-26T21:11:48.846Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Hewlett Packard Enterprise (HPE) Products: HPE Athonet Core Description: An invalid memory access when handling the ProtocolIE_ID field of S1Setup Request messages in Athonet vEPC MME v11.4.0 allows attackers to cause a Denial of Service (DoS) to the cellular network by repeatedly initiating connections and sending a crafted payload. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04780en_us&docLocale=en_US
CVE ID: CVE-2024-24468 State: PUBLISHED Published: 2024-02-05T00:00:00.000Z Last Updated: 2025-05-15T19:48:10.700Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Request Forgery vulnerability in flusity-CMS v.2.33 allows a remote attacker to execute arbitrary code via the add_customblock.php. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/tang-0717/cms/blob/main/3.md
CVE ID: CVE-2024-24469 State: PUBLISHED Published: 2024-02-05T00:00:00 Last Updated: 2024-08-26T18:28:58.147Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Request Forgery vulnerability in flusity-CMS v.2.33 allows a remote attacker to execute arbitrary code via the delete_post .php. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/tang-0717/cms/blob/main/2.md
CVE ID: CVE-2024-24470 State: PUBLISHED Published: 2024-02-02T00:00:00.000Z Last Updated: 2025-06-20T20:03:29.521Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Request Forgery vulnerability in flusity-CMS v.2.33 allows a remote attacker to execute arbitrary code via the update_post.php component. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/tang-0717/cms/blob/main/1.md
CVE ID: CVE-2024-24474 State: PUBLISHED Published: 2024-02-20T00:00:00 Last Updated: 2024-08-15T20:20:15.400Z Vendors: n/a Products: n/a Problem Types: n/a Description: QEMU before 8.2.0 has an integer underflow, and resultant buffer overflow, via a TI command when an expected non-DMA transfer length is less than the length of the available FIFO data. This occurs in esp_do_nodma in hw/scsi/esp.c because of an underflow of async_len. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gitlab.com/qemu-project/qemu/-/issues/1810 - https://github.com/qemu/qemu/commit/77668e4b9bca03a856c27ba899a2513ddf52bb52 - https://gist.github.com/1047524396/5ce07b
https://github.com/qemu/qemu/commit/77668e4b9bca03a856c27ba899a2513ddf52bb52 - https://gist.github.com/1047524396/5ce07b9d387095c276b1cd234ae5615e - https://security.netapp.com/advisory/ntap-20240510-0012/
CVE ID: CVE-2024-24475 State: REJECTED Published: N/A Last Updated: 2024-02-21T00:54:50.129413 Description: No description available.
CVE ID: CVE-2024-24476 State: PUBLISHED Published: 2024-02-21T00:00:00.000Z Last Updated: 2025-11-04T18:29:04.239Z Vendors: n/a Products: n/a Problem Types: n/a Description: A buffer overflow in Wireshark before 4.2.0 allows a remote attacker to cause a denial of service via the pan/addr_resolv.c, and ws_manuf_lookup_str(), size components. NOTE: this is disputed by the vendor because neither release 4.2.0 nor any other release was affected. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gitlab.com/wireshark/wireshark/-/issues/19344 - https://github.com/wireshark/wireshark/commit/108217f4bb1afb8b25fc705c2722b3e328b1ad78 - https://gist.github
ues/19344 - https://github.com/wireshark/wireshark/commit/108217f4bb1afb8b25fc705c2722b3e328b1ad78 - https://gist.github.com/1047524396/369ba0ccffe255cf8142208b6142be2b - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZT2BX7UARZVVWKITSZMHW7BHXGIKRSR2/
CVE ID: CVE-2024-24478 State: PUBLISHED Published: 2024-02-21T00:00:00 Last Updated: 2024-08-01T23:19:52.890Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in Wireshark before 4.2.0 allows a remote attacker to cause a denial of service via the packet-bgp.c, dissect_bgp_open(tvbuff_t*tvb, proto_tree*tree, packet_info*pinfo), optlen components. NOTE: this is disputed by the vendor because neither release 4.2.0 nor any other release was affected. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/wireshark/wireshark/commit/80a4dc55f4d2fa33c2b36a99406500726d3faaef - https://gitlab.com/wireshark/wireshark/-/issues/193
ireshark/wireshark/commit/80a4dc55f4d2fa33c2b36a99406500726d3faaef - https://gitlab.com/wireshark/wireshark/-/issues/19347 - https://gist.github.com/1047524396/e82c55147cd3cb62ef20cbdb0ec83694
CVE ID: CVE-2024-24479 State: PUBLISHED Published: 2024-02-21T00:00:00.000Z Last Updated: 2025-11-04T18:29:05.434Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Buffer Overflow in Wireshark before 4.2.0 allows a remote attacker to cause a denial of service via the wsutil/to_str.c, and format_fractional_part_nsecs components. NOTE: this is disputed by the vendor because neither release 4.2.0 nor any other release was affected. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/wireshark/wireshark/commit/c3720cff158c265dec2a0c6104b1d65954ae6bfd - https://gist.github.com/1047524396/c50ad17e9a1a18990043a7cd27814c78 - https:
/c3720cff158c265dec2a0c6104b1d65954ae6bfd - https://gist.github.com/1047524396/c50ad17e9a1a18990043a7cd27814c78 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZT2BX7UARZVVWKITSZMHW7BHXGIKRSR2/
CVE ID: CVE-2024-24482 State: PUBLISHED Published: 2024-02-02T00:00:00 Last Updated: 2024-08-29T20:13:24.229Z Vendors: n/a Products: n/a Problem Types: n/a Description: Aprktool before 2.9.3 on Windows allows ../ and /.. directory traversal. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/iBotPeaches/Apktool/security/advisories/GHSA-vgwr-4w3p-xmjv
CVE ID: CVE-2024-24485 State: PUBLISHED Published: 2024-04-15T00:00:00 Last Updated: 2024-08-01T23:19:52.593Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue discovered in silex technology DS-600 Firmware v.1.4.1 allows a remote attacker to obtain sensitive information via the GET EEP_DATA command. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/MostafaSoliman/Security-Advisories/blob/master/CVE-2024-24485
CVE ID: CVE-2024-24486 State: PUBLISHED Published: 2024-04-15T00:00:00 Last Updated: 2024-08-01T23:19:52.467Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue discovered in silex technology DS-600 Firmware v.1.4.1 allows a remote attacker to edit device settings via the SAVE EEP_DATA command. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://raw.githubusercontent.com/MostafaSoliman/Security-Advisories/master/CVE-2024-24486
CVE ID: CVE-2024-24487 State: PUBLISHED Published: 2024-04-15T00:00:00 Last Updated: 2024-08-01T23:19:52.623Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue discovered in silex technology DS-600 Firmware v.1.4.1 allows a remote attacker to cause a denial of service via crafted UDP packets using the EXEC REBOOT SYSTEM command. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://raw.githubusercontent.com/MostafaSoliman/Security-Advisories/master/CVE-2024-24487
CVE ID: CVE-2024-24488 State: PUBLISHED Published: 2024-02-07T00:00:00.000Z Last Updated: 2025-06-05T18:27:22.232Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in Shenzen Tenda Technology CP3V2.0 V11.10.00.2311090948 allows a local attacker to obtain sensitive information via the password component. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/minj-ae/CVE-2024-24488
CVE ID: CVE-2024-24494 State: PUBLISHED Published: 2024-02-08T00:00:00.000Z Last Updated: 2025-05-15T19:41:44.807Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting vulnerability in Daily Habit Tracker v.1.0 allows a remote attacker to execute arbitrary code via the day, exercise, pray, read_book, vitamins, laundry, alcohol and meat parameters in the add-tracker.php and update-tracker.php components. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/0xQRx/VunerabilityResearch/blob/master/2024/DailyHabitTracker-Stored_XSS.md
CVE ID: CVE-2024-24495 State: PUBLISHED Published: 2024-02-08T00:00:00.000Z Last Updated: 2025-05-15T19:41:37.271Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL Injection vulnerability in delete-tracker.php in Daily Habit Tracker v.1.0 allows a remote attacker to execute arbitrary code via crafted GET request. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/0xQRx/VulnerabilityResearch/blob/master/2024/DailyHabitTracker-SQL_Injection.md
CVE ID: CVE-2024-24496 State: PUBLISHED Published: 2024-02-08T00:00:00 Last Updated: 2024-08-19T16:45:05.846Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in Daily Habit Tracker v.1.0 allows a remote attacker to manipulate trackers via the home.php, add-tracker.php, delete-tracker.php, update-tracker.php components. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/0xQRx/VunerabilityResearch/blob/master/2024/DailyHabitTracker-Broken_Access_Control.md
CVE ID: CVE-2024-24497 State: REJECTED Published: N/A Last Updated: 2024-04-24T21:05:53.592544 Description: No description available.
CVE ID: CVE-2024-24498 State: REJECTED Published: N/A Last Updated: 2024-04-24T21:08:28.874845 Description: No description available.
CVE ID: CVE-2024-24499 State: REJECTED Published: N/A Last Updated: 2024-04-24T21:07:05.373328 Description: No description available.
CVE ID: CVE-2024-24506 State: PUBLISHED Published: 2024-04-03T00:00:00 Last Updated: 2024-08-15T20:11:13.215Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting (XSS) vulnerability in Lime Survey Community Edition Version v.5.3.32+220817, allows remote attackers to execute arbitrary code via the Administrator email address parameter in the General Setting function. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://bugs.limesurvey.org/bug_relationship_graph.php?bug_id=19364&graph=relation - https://www.exploit-db.com/exploits/51926
CVE ID: CVE-2024-24507 State: PUBLISHED Published: 2024-07-22T00:00:00.000Z Last Updated: 2025-03-13T13:17:54.570Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting vulnerability in Act-On 2023 allows a remote attacker to execute arbitrary code via the newUser parameter in the login.jsp component. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://gist.github.com/Xandsz/2b409acb81e846fc3478600f984785a1
CVE ID: CVE-2024-24510 State: PUBLISHED Published: 2024-09-09T00:00:00 Last Updated: 2024-11-05T20:59:33.851Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting vulnerability in Alinto SOGo before 5.10.0 allows a remote attacker to execute arbitrary code via the import function to the mail component. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://book.hacktricks.xyz/pentesting-web/xs-search/css-injection - https://github.com/Alinto/sogo/commit/21468700718ed71774eaf2979ee59330fc569424
CVE ID: CVE-2024-24511 State: PUBLISHED Published: 2024-03-01T00:00:00 Last Updated: 2024-08-06T15:13:53.112Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting vulnerability in Pkp OJS v.3.4 allows an attacker to execute arbitrary code via the Input Title component. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://drive.google.com/file/d/1IhU9tNhc6enKL1Dgq9--R05biJBjodKv/view?usp=sharing - https://github.com/machisri/CVEs-and-Vulnerabilities/blob/main/CVE-2024-24511%20-%3E%20Stored%20XSS%20in%20input%20Title%20of%20the%20Component
CVE ID: CVE-2024-24512 State: PUBLISHED Published: 2024-03-01T00:00:00 Last Updated: 2024-08-15T20:46:24.067Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting vulnerability in Pkp OJS v.3.4 allows an attacker to execute arbitrary code via the input subtitle component. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://drive.google.com/file/d/1jRsltje5PRkgigcY5qLWB3GhF0e9j6aF/view?usp=sharing - https://github.com/machisri/CVEs-and-Vulnerabilities/blob/main/CVE-2024-24512%20-%3E%20Stored%20XSS%20in%20input%20SubTitle%20of%20the%20Component
CVE ID: CVE-2024-24520 State: PUBLISHED Published: 2024-02-29T00:00:00 Last Updated: 2024-08-01T23:19:52.452Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in Lepton CMS v.7.0.0 allows a local attacker to execute arbitrary code via the upgrade.php file in the languages place. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - http://lepton.com - https://github.com/xF9979/LEPTON-CMS - https://packetstormsecurity.com/files/176647/Lepton-CMS-7.0.0-Remote-Code-Execution.html - https://github.com/capture0x/leptoncms - https://www.exploit-db.com/exploits/51949
CVE ID: CVE-2024-24524 State: PUBLISHED Published: 2024-02-02T00:00:00 Last Updated: 2024-08-01T23:19:52.632Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Request Forgery (CSRF) vulnerability in flusity-CMS v.2.33, allows remote attackers to execute arbitrary code via the add_menu.php component. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/harryrabbit5651/cms/blob/main/1.md
CVE ID: CVE-2024-24525 State: PUBLISHED Published: 2024-02-29T00:00:00 Last Updated: 2024-08-29T18:32:53.308Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in EpointWebBuilder 5.1.0-sp1, 5.2.1-sp1, 5.4.1 and 5.4.2 allows a remote attacker to execute arbitrary code via the infoid parameter of the URL. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://l3v3lforall.github.io/EpointWebBuilder_v5.x_VULN/
CVE ID: CVE-2024-24528 State: REJECTED Published: N/A Last Updated: 2024-02-26T18:10:41.749569 Description: No description available.
CVE ID: CVE-2024-24539 State: PUBLISHED Published: 2024-03-18T00:00:00 Last Updated: 2024-11-14T20:16:06.204Z Vendors: n/a Products: n/a Problem Types: n/a Description: FusionPBX before 5.2.0 does not validate a session. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/fusionpbx/fusionpbx/commit/ee202cd61dc9a79fb2d634b1ad21ff2416d531cb - https://github.com/fusionpbx/fusionpbx/commit/2f8bed375c124c1d7e36138acc6903fcfcf15a8f
CVE ID: CVE-2024-24543 State: PUBLISHED Published: 2024-02-05T00:00:00.000Z Last Updated: 2025-05-15T19:47:57.882Z Vendors: n/a Products: n/a Problem Types: n/a Description: Buffer Overflow vulnerability in the function setSchedWifi in Tenda AC9 v.3.0, firmware version v.15.03.06.42_multi allows a remote attacker to cause a denial of service or run arbitrary code via crafted overflow data. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/TimeSeg/IOT_CVE/blob/main/tenda/AC9V3/0130/setSchedWifi.md
CVE ID: CVE-2024-24548 State: PUBLISHED Published: 2024-02-01T06:31:20.445Z Last Updated: 2024-08-01T23:19:52.359Z Vendors: Simplesite Products: Payment EX Problem Types: Information disclosure Description: Payment EX Ver1.1.5b and earlier allows a remote unauthenticated attacker to obtain the information of the user who purchases merchandise using Payment EX. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://jvn.jp/en/jp/JVN41129639/
CVE ID: CVE-2024-24549 State: PUBLISHED Published: 2024-03-13T15:46:53.085Z Last Updated: 2025-10-29T11:56:23.336Z Vendors: Apache Software Foundation Products: Apache Tomcat Problem Types: CWE-20 Description: Denial of Service due to improper input validation vulnerability for HTTP/2 requests in Apache Tomcat. When processing an HTTP/2 request, if the request exceeded any of the configured limits for headers, the associated HTTP/2 stream was not reset until after all of the headers had been processed.This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M16, from 10.1.0-M1 through 10.1.18, from 9.0.0-M1 through 9.0.85, from 8.5.0 through 8.5.98. Other, older, EOL versions may also
10.1.0-M1 through 10.1.18, from 9.0.0-M1 through 9.0.85, from 8.5.0 through 8.5.98. Other, older, EOL versions may also be affected. Users are recommended to upgrade to version 11.0.0-M17, 10.1.19, 9.0.86 or 8.5.99 which fix the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://lists.apache.org/thread/4c50rmomhbbsdgfjsgwlb51xdwfjdcvg
CVE ID: CVE-2024-24550 State: PUBLISHED Published: 2024-06-24T07:05:50.655Z Last Updated: 2024-08-01T23:19:52.559Z Vendors: Bludit Products: Bludit Problem Types: CWE-77, CWE-502, CWE-434 Description: A security vulnerability has been identified in Bludit, allowing attackers with knowledge of the API token to upload arbitrary files through the File API which leads to arbitrary code execution on the server. This vulnerability arises from improper handling of file uploads, enabling malicious actors to upload and execute PHP files. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.redguard.ch/blog/2024/06/20/security-advisory-bludit/
CVE ID: CVE-2024-24551 State: PUBLISHED Published: 2024-06-24T07:08:22.514Z Last Updated: 2024-08-01T23:19:52.659Z Vendors: Bludit Products: Bludit Problem Types: CWE-77, CWE-502, CWE-434 Description: A security vulnerability has been identified in Bludit, allowing authenticated attackers to execute arbitrary code through the Image API. This vulnerability arises from improper handling of file uploads, enabling malicious actors to upload and execute PHP files. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.redguard.ch/blog/2024/06/20/security-advisory-bludit/
CVE ID: CVE-2024-24552 State: PUBLISHED Published: 2024-06-24T07:09:18.368Z Last Updated: 2024-08-01T23:19:52.951Z Vendors: Bludit Products: Bludit Problem Types: CWE-384 Description: A session fixation vulnerability in Bludit allows an attacker to bypass the server's authentication if they can trick an administrator or any other user into authorizing a session ID of their choosing. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.redguard.ch/blog/2024/06/20/security-advisory-bludit/
CVE ID: CVE-2024-24553 State: PUBLISHED Published: 2024-06-24T07:10:03.585Z Last Updated: 2024-08-01T23:19:52.892Z Vendors: Bludit Products: Bludit Problem Types: CWE-916 Description: Bludit uses the SHA-1 hashing algorithm to compute password hashes. Thus, attackers could determine cleartext passwords with brute-force attacks due to the inherent speed of SHA-1. In addition, the salt that is computed by Bludit is generated with a non-cryptographically secure function. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.redguard.ch/blog/2024/06/20/security-advisory-bludit/
CVE ID: CVE-2024-24554 State: PUBLISHED Published: 2024-06-24T07:11:36.377Z Last Updated: 2024-08-01T23:19:52.903Z Vendors: Bludit Products: Bludit Problem Types: CWE-338, CWE-287 Description: Bludit uses predictable methods in combination with the MD5 hashing algorithm to generate sensitive tokens such as the API token and the user token. This allows attackers to authenticate against the Bludit API. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.redguard.ch/blog/2024/06/20/security-advisory-bludit/
CVE ID: CVE-2024-24556 State: PUBLISHED Published: 2024-01-30T17:21:19.964Z Last Updated: 2025-05-29T15:04:39.987Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) Vendors: urql-graphql Products: urql Problem Types: CWE-79 Description: urql is a GraphQL client that exposes a set of helpers for several frameworks. The `@urql/next` package is vulnerable to XSS. To exploit this an attacker would need to ensure that the response returns `html` tags and that the web-application is using streamed responses (non-RSC). This vulnerability is due to improper escaping of html-like characters in the response-stream. To fix this vulnerability upgrade to version 1.1.1 Additional Anal