Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-10432 State: PUBLISHED Published: 2024-10-27T23:31:04.374Z Last Updated: 2024-10-28T19:00:19.500Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: Project Worlds Products: Simple Web-Based Chat Application Problem Types: CWE-89 Description: A vulnerability has been found in Project Worlds Simple Web-Based Chat Application 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /index.php. The manipulation of the argument username leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - ht
it has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.281983 - https://vuldb.com/?ctiid.281983 - https://vuldb.com/?submit.432234 - https://github.com/jadu101/CVE/blob/main/project_worlds_simple_web_based_chat_app_index_sqli.md
CVE ID: CVE-2024-10433 State: PUBLISHED Published: 2024-10-28T00:00:09.444Z Last Updated: 2024-10-28T13:03:15.189Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: Project Worlds Products: Simple Web-Based Chat Application Problem Types: CWE-79 Description: A vulnerability was found in Project Worlds Simple Web-Based Chat Application 1.0 and classified as problematic. Affected by this issue is some unknown functionality of the file /index.php. The manipulation of the argument Name/Comment leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The initial researcher advisory mentions different parameters to b
oit has been disclosed to the public and may be used. The initial researcher advisory mentions different parameters to be affected which do not correlate with the screenshots of a successful attack. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.281984 - https://vuldb.com/?ctiid.281984 - https://vuldb.com/?submit.432236 - https://github.com/jadu101/CVE/blob/main/project_worlds_simple_web_based_chat_app_index_xss.md
CVE ID: CVE-2024-10434 State: PUBLISHED Published: 2024-10-28T00:31:05.947Z Last Updated: 2024-10-28T13:00:50.500Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C) Vendors: Tenda Products: AC1206 Problem Types: CWE-121 Description: A vulnerability was found in Tenda AC1206 up to 20241027. It has been classified as critical. This affects the function ate_Tenda_mfg_check_usb/ate_Tenda_mfg_check_usb3 of the file /goform/ate. The manipulation of the argument arg leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.2
to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.281985 - https://vuldb.com/?ctiid.281985 - https://vuldb.com/?submit.431291 - https://github.com/physicszq/Routers/blob/main/Tenda/README.md - https://www.tenda.com.cn/
CVE ID: CVE-2024-10435 State: PUBLISHED Published: 2024-10-28T00:31:07.560Z Last Updated: 2024-10-28T12:58:21.764Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: didi Products: Super-Jacoco Problem Types: CWE-77 Description: A vulnerability was found in didi Super-Jacoco 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /cov/triggerEnvCov. The manipulation of the argument uuid leads to command injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.281986 - https://vuldb.com/?ctiid.281986 - https:/
t Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.281986 - https://vuldb.com/?ctiid.281986 - https://vuldb.com/?submit.427381 - https://github.com/didi/super-jacoco/issues/48
CVE ID: CVE-2024-10436 State: PUBLISHED Published: 2024-10-29T09:31:29.768Z Last Updated: 2024-10-29T15:04:45.399Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: wpclever Products: WPC Smart Messages for WooCommerce Problem Types: CWE-98 Description: The WPC Smart Messages for WooCommerce plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.2.1 via the get_condition_value function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access c
rbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/0fd87512-def0-4e59-aa2d-b166919474f3?source=cve - https://wordpress.org/plugins/wpc-smart-messages/ - https://plugins.trac.wordpress.org/browser/wpc-smart-messages/tags/4.2.1/includes/class-backend.php#L418 - https://plugins.trac.wordpress.org/changeset/3177426/wpc-smart-messages/trunk/includes/class-backend.php?conte
hp#L418 - https://plugins.trac.wordpress.org/changeset/3177426/wpc-smart-messages/trunk/includes/class-backend.php?contextall=1
CVE ID: CVE-2024-10437 State: PUBLISHED Published: 2024-10-29T09:31:30.293Z Last Updated: 2024-10-29T14:51:17.490Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: wpclever Products: WPC Smart Messages for WooCommerce Problem Types: CWE-862 Description: The WPC Smart Messages for WooCommerce plugin for WordPress is vulnerable to unauthorized Smar Message activation/deactivation due to a missing capability check on the ajax_enable function in all versions up to, and including, 4.2.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to activate or deactivate smart messages. Additional Analyst Notes: - CISA ADP Vulnrich
bscriber-level access and above, to activate or deactivate smart messages. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/4acb4fda-0217-44b9-a85e-64807eb4a011?source=cve - https://plugins.trac.wordpress.org/browser/wpc-smart-messages/tags/4.2.1/includes/class-backend.php#L775 - https://plugins.trac.wordpress.org/changeset/3177426/wpc-smart-messages/trunk/includes/class-backend.php?contextall=1
CVE ID: CVE-2024-10438 State: PUBLISHED Published: 2024-10-28T02:46:33.258Z Last Updated: 2024-10-28T12:52:28.130Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Sunnet Products: eHRD CTMS Problem Types: CWE-288 Description: The eHRD CTMS from Sunnet has an Authentication Bypass vulnerability, allowing unauthenticated remote attackers to bypass authentication by satisfying specific conditions in order to access certain functionalities. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-8164-fe7c5-1.html - https://www.twcert.org.tw/en/cp-139-8165-7da2f-2.html
CVE ID: CVE-2024-10439 State: PUBLISHED Published: 2024-10-28T02:49:34.913Z Last Updated: 2024-10-28T12:50:33.935Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Sunnet Products: eHRD CTMS Problem Types: CWE-639 Description: The eHRD CTMS from Sunnet has an Insecure Direct Object Reference (IDOR) vulnerability, allowing unauthenticated remote attackers to modify a specific parameter to access arbitrary files uploaded by any user. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-8166-085c4-1.html - https://www.twcert.org.tw/en/cp-139-8167-a2c0d-2.html
CVE ID: CVE-2024-10440 State: PUBLISHED Published: 2024-10-28T02:53:00.553Z Last Updated: 2024-10-28T12:48:06.154Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Sunnet Products: eHRD CTMS Problem Types: CWE-89 Description: The eHDR CTMS from Sunnet has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary SQL command to read, modify, and delete database contents. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-8168-02720-1.html - https://www.twcert.org.tw/en/cp-139-8169-0632f-2.html
CVE ID: CVE-2024-10441 State: PUBLISHED Published: 2025-03-19T02:09:56.387Z Last Updated: 2025-03-28T01:06:48.075Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Synology Products: DiskStation Manager (DSM), BeeStation OS (BSM) Problem Types: CWE-116 Description: Improper encoding or escaping of output vulnerability in the system plugin daemon in Synology BeeStation OS (BSM) before 1.1-65374 and Synology DiskStation Manager (DSM) before 7.2-64570-4, 7.2.1-69057-6 and 7.2.2-72806-1 allows remote attackers to execute arbitrary code via unspecified vectors. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.synology.com/en-global/se
pecified vectors. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.synology.com/en-global/security/advisory/Synology_SA_24_20 - https://www.synology.com/en-global/security/advisory/Synology_SA_24_23
CVE ID: CVE-2024-10442 State: PUBLISHED Published: 2025-03-19T02:14:03.691Z Last Updated: 2025-03-19T14:13:16.719Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: Synology Products: Unified Controller (DSMUC), Replication Service Problem Types: CWE-193 Description: Off-by-one error vulnerability in the transmission component in Synology Replication Service before 1.0.12-0066, 1.2.2-0353 and 1.3.0-0423 and Synology Unified Controller (DSMUC) before 3.1.4-23079 allows remote attackers to execute arbitrary code, potentially leading to a broader impact across the system via unspecified vectors. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - ht
er impact across the system via unspecified vectors. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.synology.com/en-global/security/advisory/Synology_SA_24_22
CVE ID: CVE-2024-10443 State: PUBLISHED Published: 2024-11-15T10:23:51.233Z Last Updated: 2025-09-16T06:02:16.158Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Synology Products: BeePhotos, Synology Photos Problem Types: CWE-78 Description: Improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability in Task Manager component in Synology BeePhotos before 1.0.2-10026 and 1.1.0-10053 and Synology Photos before 1.6.2-0720 and 1.7.0-0795 allows remote attackers to execute arbitrary code via unspecified vectors. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.synology.com/en-global/secu
cified vectors. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.synology.com/en-global/security/advisory/Synology_SA_24_18 - https://www.synology.com/en-global/security/advisory/Synology_SA_24_19
CVE ID: CVE-2024-10444 State: PUBLISHED Published: 2025-03-19T02:07:02.228Z Last Updated: 2025-03-19T13:49:59.097Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Synology Products: DiskStation Manager (DSM) Problem Types: CWE-295 Description: Improper certificate validation vulnerability in the LDAP utilities in Synology DiskStation Manager (DSM) before 7.1.1-42962-8, 7.2.1-69057-7 and 7.2.2-72806-3 allows man-in-the-middle attackers to hijack the authentication of administrators via unspecified vectors. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.synology.com/en-global/security/advisory/Synology_SA_25_01
CVE ID: CVE-2024-10445 State: PUBLISHED Published: 2025-03-19T02:10:57.215Z Last Updated: 2025-03-28T01:14:46.531Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: Synology Products: DiskStation Manager (DSM), BeeStation OS (BSM) Problem Types: CWE-295 Description: Improper certificate validation vulnerability in the update functionality in Synology BeeStation OS (BSM) before 1.1-65374 and Synology DiskStation Manager (DSM) before 6.2.4-25556-8, 7.1.1-42962-7, 7.2-64570-4, 7.2.1-69057-6 and 7.2.2-72806-1 allow remote attackers to write limited files via unspecified vectors. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.synology.
ed files via unspecified vectors. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.synology.com/en-global/security/advisory/Synology_SA_24_20 - https://www.synology.com/en-global/security/advisory/Synology_SA_24_23
CVE ID: CVE-2024-10446 State: PUBLISHED Published: 2024-10-28T11:31:05.540Z Last Updated: 2024-10-28T11:59:31.911Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: Project Worlds Products: Online Time Table Generator Problem Types: CWE-89 Description: A vulnerability classified as critical has been found in Project Worlds Online Time Table Generator 1.0. Affected is an unknown function of the file /timetable/admin/admindashboard.php?info=add_course. The manipulation of the argument c leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - ht
it has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.282006 - https://vuldb.com/?ctiid.282006 - https://vuldb.com/?submit.432371 - https://github.com/jadu101/CVE/blob/main/project_worlds_online_time_table_generator_add_department_sqli.md
CVE ID: CVE-2024-10447 State: PUBLISHED Published: 2024-10-28T13:00:06.746Z Last Updated: 2024-10-28T13:38:45.802Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: Project Worlds Products: Online Time Table Generator Problem Types: CWE-89 Description: A vulnerability classified as critical was found in Project Worlds Online Time Table Generator 1.0. Affected by this vulnerability is an unknown functionality of the file /timetable/staff/staffdashboard.php?info=updateprofile. The manipulation of the argument n leads to sql injection. The attack can be launched remotely. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.282007 - https://vuldb.com
otely. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.282007 - https://vuldb.com/?ctiid.282007 - https://vuldb.com/?submit.432372 - https://github.com/jadu101/CVE/blob/main/project_worlds_online_time_table_generator_update_profile_sqli.md
CVE ID: CVE-2024-10448 State: PUBLISHED Published: 2024-10-28T13:31:05.071Z Last Updated: 2024-10-28T13:45:59.020Z Severity: N/A (CVSS 5 AV:N/AC:L/Au:N/C:N/I:P/A:N) Vendors: code-projects Products: Blood Bank Management System Problem Types: CWE-352 Description: A vulnerability, which was classified as problematic, has been found in code-projects Blood Bank Management System 1.0. Affected by this issue is some unknown functionality of the file /file/delete.php. The manipulation of the argument bid leads to cross-site request forgery. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Other endpoints might be affected as well. Additional Analyst
exploit has been disclosed to the public and may be used. Other endpoints might be affected as well. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.282008 - https://vuldb.com/?ctiid.282008 - https://vuldb.com/?submit.432501 - https://github.com/bevennyamande/bloodbank_delete_csrf_attack - https://code-projects.org/
CVE ID: CVE-2024-10449 State: PUBLISHED Published: 2024-10-28T14:31:04.312Z Last Updated: 2024-10-28T14:53:22.266Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: Codezips Products: Hospital Appointment System Problem Types: CWE-89 Description: A vulnerability, which was classified as critical, was found in Codezips Hospital Appointment System 1.0. This affects an unknown part of the file /loginAction.php. The manipulation of the argument Username leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.282009 - https
c and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.282009 - https://vuldb.com/?ctiid.282009 - https://vuldb.com/?submit.432564 - https://github.com/ppp-src/CVE/issues/25
CVE ID: CVE-2024-10450 State: PUBLISHED Published: 2024-10-28T15:00:07.091Z Last Updated: 2024-10-28T15:17:40.538Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: SourceCodester Products: Kortex Lite Advocate Office Management System Problem Types: CWE-89 Description: A vulnerability has been found in SourceCodester Kortex Lite Advocate Office Management System 1.0 and classified as critical. This vulnerability affects unknown code of the file /kortex_lite/control/edit_profile.php of the component POST Parameter Handler. The manipulation of the argument id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
s to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.282010 - https://vuldb.com/?ctiid.282010 - https://vuldb.com/?submit.432614 - https://github.com/will121351/wenqin.webray.com.cn/blob/main/CVE-project/Advocate-office-management-system.md - https://www.sourcecodester.com/
CVE ID: CVE-2024-10451 State: PUBLISHED Published: 2024-11-25T07:37:05.161Z Last Updated: 2025-11-11T16:08:35.556Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Red Hat Products: Red Hat build of Keycloak 24, Red Hat build of Keycloak 24.0.9, Red Hat build of Keycloak 26.0, Red Hat build of Keycloak 26.0.6, Red Hat JBoss Enterprise Application Platform 8, Red Hat Single Sign-On 7 Problem Types: CWE-798 Description: A flaw was found in Keycloak. This issue occurs because sensitive runtime values, such as passwords, may be captured during the Keycloak build process and embedded as default values in bytecode, leading to unintended information disclosure. In K
he Keycloak build process and embedded as default values in bytecode, leading to unintended information disclosure. In Keycloak 26, sensitive data specified directly in environment variables during the build process is also stored as a default values, making it accessible during runtime. Indirect usage of environment variables for SPI options and Quarkus properties is also vulnerable due to unconditional expansion by PropertyMapper logic, capturing sensitive data as default values in all Keycloak versions up to 26.0.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://access.redhat.com/errata/RHSA-2024:10175 - https://access.redhat.com/errata/RHSA-2024:10176 - https://
rences: - https://access.redhat.com/errata/RHSA-2024:10175 - https://access.redhat.com/errata/RHSA-2024:10176 - https://access.redhat.com/errata/RHSA-2024:10177 - https://access.redhat.com/errata/RHSA-2024:10178 - https://access.redhat.com/security/cve/CVE-2024-10451 - https://bugzilla.redhat.com/show_bug.cgi?id=2322096
CVE ID: CVE-2024-10452 State: PUBLISHED Published: 2024-10-29T15:16:22.405Z Last Updated: 2024-10-29T15:35:35.167Z Severity: LOW (CVSS 2.2 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N) Vendors: Grafana Products: Grafana Problem Types: CWE-639 Description: Organization admins can delete pending invites created in an organization they are not part of. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://grafana.com/security/security-advisories/cve-2024-10452
CVE ID: CVE-2024-10453 State: PUBLISHED Published: 2024-12-21T09:23:56.216Z Last Updated: 2024-12-28T00:48:53.160Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: elemntor Products: Elementor Website Builder – More Than Just a Page Builder Problem Types: CWE-79 Description: The Elementor Website Builder – More than Just a Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Typography Settings in all versions up to, and including, 3.25.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above,
user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/f23604b7-5a7f-4be7-bc73-cb4facdd1e73?source=cve - https://plugins.trac.wordpress.org/browser/elementor/tags/3.25.9/assets/js/editor.js
CVE ID: CVE-2024-10454 State: PUBLISHED Published: 2024-10-31T12:54:07.005Z Last Updated: 2024-10-31T13:45:32.722Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: Clibo Manager Products: Clibo Manager Problem Types: CWE-1021 Description: Clickjacking vulnerability in Clibo Manager v1.1.9.12 in the '/public/login' directory, a login panel. This vulnerability occurs due to the absence of an X-Frame-Options server-side header. An attacker could overlay a transparent iframe to perform click hijacking on victims. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/clickjacking-vulnerability-clibo-man
ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/clickjacking-vulnerability-clibo-manager
CVE ID: CVE-2024-10455 State: PUBLISHED Published: 2024-10-28T13:30:37.619Z Last Updated: 2024-10-28T13:47:59.719Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: D3TN Products: µD3TN Problem Types: CWE-617 Description: Reachable Assertion in BPv7 parser in µD3TN v0.14.0 allows attacker to disrupt service via malformed Extension Block Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitlab.com/d3tn/ud3tn/-/issues/227
CVE ID: CVE-2024-10456 State: PUBLISHED Published: 2024-10-30T18:04:52.786Z Last Updated: 2024-10-30T18:15:45.431Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Delta Electronics Products: InfraSuite Device Master Problem Types: CWE-502 Description: Delta Electronics InfraSuite Device Master versions prior to 1.0.12 are affected by a deserialization vulnerability that targets the Device-Gateway, which could allow deserialization of arbitrary .NET objects prior to authentication. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-24-303-03
CVE ID: CVE-2024-10457 State: PUBLISHED Published: 2025-03-20T10:11:37.407Z Last Updated: 2025-03-20T18:26:13.090Z Severity: MEDIUM (CVSS 6.5 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: significant-gravitas Products: significant-gravitas/autogpt Problem Types: CWE-918 Description: Multiple Server-Side Request Forgery (SSRF) vulnerabilities were identified in the significant-gravitas/autogpt repository, specifically in the GitHub Integration and Web Search blocks. These vulnerabilities affect version agpt-platform-beta-v0.1.1. The issues arise when block inputs are controlled by untrusted sources, leading to potential credential leakage, internal network scanning, and unauthorized