Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-23837 State: PUBLISHED Published: 2024-02-26T16:17:24.372Z Last Updated: 2025-11-03T18:08:14.608Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: OISF Products: libhtp Problem Types: CWE-770 Description: LibHTP is a security-aware parser for the HTTP protocol. Crafted traffic can cause excessive processing time of HTTP headers, leading to denial of service. This issue is addressed in 0.5.46. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/OISF/libhtp/security/advisories/GHSA-f9wf-rrjj-qx8m - https://github.com/OISF/libhtp/commit/20ac301d801cdf01b3f021cca08a22a87f477c4a - https://redm
ries/GHSA-f9wf-rrjj-qx8m - https://github.com/OISF/libhtp/commit/20ac301d801cdf01b3f021cca08a22a87f477c4a - https://redmine.openinfosecfoundation.org/issues/6444 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GOCOBFUTIFHOP2PZOH4ENRFXRBHIRKK4/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZXJIT7R53ZXROO3I256RFUWTIW4ECK6P/
CVE ID: CVE-2024-23838 State: PUBLISHED Published: 2024-01-30T16:26:00.413Z Last Updated: 2024-08-23T18:22:14.639Z Severity: HIGH (CVSS 8.6 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N) Vendors: TrueLayer Products: truelayer-dotnet Problem Types: CWE-918 Description: TrueLayer.NET is the .Net client for TrueLayer. The vulnerability could potentially allow a malicious actor to gain control over the destination URL of the HttpClient used in the API classes. For applications using the SDK, requests to unexpected resources on local networks or to the internet could be made which could lead to information disclosure. The issue can be mitigated by having strict egress rules limiting the destinatio
h could lead to information disclosure. The issue can be mitigated by having strict egress rules limiting the destinations to which requests can be made, and applying strict validation to any user input passed to the `truelayer-dotnet` library. Versions of TrueLayer.Client `v1.6.0` and later are not affected. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/TrueLayer/truelayer-dotnet/security/advisories/GHSA-67m4-qxp3-j6hh - https://github.com/TrueLayer/truelayer-dotnet/commit/75e436ed5360faa73d6e7ce3a9903a3c49505e3e
CVE ID: CVE-2024-23839 State: PUBLISHED Published: 2024-02-26T15:48:16.120Z Last Updated: 2025-02-13T17:39:56.397Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H) Vendors: OISF Products: suricata Problem Types: CWE-416 Description: Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 7.0.3, specially crafted traffic can cause a heap use after free if the ruleset uses the http.request_header or http.response_header keyword. The vulnerability has been patched in 7.0.3. To work around the vulnerability, avoid the http.request_header and http.response_header keywords. Additional Analyst Notes: - CVE
und the vulnerability, avoid the http.request_header and http.response_header keywords. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/OISF/suricata/security/advisories/GHSA-qxj6-hr2p-mmc7 - https://github.com/OISF/suricata/commit/cd731fcaf42e5f7078c9be643bfa0cee2ad53e8f - https://redmine.openinfosecfoundation.org/issues/6657 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GOCOBFUTIFHOP2PZOH4ENRFXRBHIRKK4/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZXJIT7R53ZXROO3I256RFUWTIW4ECK6P/
CVE ID: CVE-2024-23840 State: PUBLISHED Published: 2024-01-30T16:39:09.284Z Last Updated: 2025-05-29T15:04:48.029Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: goreleaser Products: goreleaser Problem Types: CWE-532 Description: GoReleaser builds Go binaries for several platforms, creates a GitHub release and then pushes a Homebrew formula to a tap repository. `goreleaser release --debug` log shows secret values used in the in the custom publisher. This vulnerability is fixed in 1.24.0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/goreleaser/goreleaser/security/advisories/GHSA-h3q2-8whx-c29h -
CISA ADP Vulnrichment: References: - https://github.com/goreleaser/goreleaser/security/advisories/GHSA-h3q2-8whx-c29h - https://github.com/goreleaser/goreleaser/commit/d5b6a533ca1dc3366983d5d31ee2d2b6232b83c0
CVE ID: CVE-2024-23841 State: PUBLISHED Published: 2024-01-30T17:14:12.023Z Last Updated: 2025-06-17T21:29:18.891Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N) Vendors: apollographql Products: apollo-client-nextjs Problem Types: CWE-80 Description: apollo-client-nextjs is the Apollo Client support for the Next.js App Router. The @apollo/experimental-apollo-client-nextjs NPM package is vulnerable to a cross-site scripting vulnerability. To exploit this vulnerability, an attacker would need to either inject malicious input (e.g. by redirecting a user to a specifically-crafted link) or arrange to have malicious input be returned by a GraphQL server (e.g. by persisting
to a specifically-crafted link) or arrange to have malicious input be returned by a GraphQL server (e.g. by persisting it in a database). To fix this issue, please update to version 0.7.0 or later. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/apollographql/apollo-client-nextjs/security/advisories/GHSA-rv8p-rr2h-fgpg - https://github.com/apollographql/apollo-client-nextjs/commit/b92bc42abd5f8e17d4db361c36bd08e4f541a46b
CVE ID: CVE-2024-23842 State: PUBLISHED Published: 2024-01-23T04:56:41.242Z Last Updated: 2025-09-15T13:58:10.062Z Severity: HIGH (CVSS 7.4 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H) Vendors: Hitron Systems DVR Products: DVR LGUVR-16H Problem Types: CWE-20 Description: Improper Input Validation in Hitron Systems DVR LGUVR-16H 1.02~4.02 allows an attacker to cause network attack in case of using defalut admin ID/PW. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://www.hitron.co.kr/firmware/
CVE ID: CVE-2024-23843 State: PUBLISHED Published: 2024-10-28T02:07:20.161Z Last Updated: 2024-10-28T12:54:11.310Z Severity: LOW (CVSS 2.2 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N) Vendors: Genians Products: Genian NAC V5.0, Genian NAC LTS V5.0 Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Genians Genian NAC V5.0, Genians Genian NAC LTS V5.0.This issue affects Genian NAC V5.0: from V5.0.0 through V5.0.60; Genian NAC LTS V5.0: from 5.0.0 LTS through 5.0.55 LTS(Revision 125558), from 5.0.0 LTS through 5.0.56 LTS(Revision 125560). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https:
m 5.0.0 LTS through 5.0.56 LTS(Revision 125560). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://docs.genians.com/release/ko/advisories/GN-SA-2024-001.html
CVE ID: CVE-2024-23847 State: PUBLISHED Published: 2024-05-31T06:11:15.428Z Last Updated: 2025-04-08T04:36:31.500Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Yokogawa Rental & Lease Corporation Products: Unifier, Unifier Cast Problem Types: CWE-276 Description: Incorrect default permissions issue exists in Unifier and Unifier Cast. If this vulnerability is exploited, arbitrary code may be executed with LocalSystem privilege. As a result, a malicious program may be installed, data may be altered or deleted. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.yrl.com/fwp_support/info/khvu7f00000000q7.html -
A ADP Vulnrichment: - CVE Program Container: References: - https://www.yrl.com/fwp_support/info/khvu7f00000000q7.html - https://www.yrl.com/fwp_support/info/khvu7f00000007j8.html - https://www.yrl.com/fwp_support/info/khvu7f0000000auf.html - https://jvn.jp/en/jp/JVN17680667/
CVE ID: CVE-2024-23848 State: PUBLISHED Published: 2024-01-23T00:00:00.000Z Last Updated: 2025-05-30T14:21:34.120Z Vendors: n/a Products: n/a Problem Types: n/a Description: In the Linux kernel through 6.7.1, there is a use-after-free in cec_queue_msg_fh, related to drivers/media/cec/core/cec-adap.c and drivers/media/cec/core/cec-api.c. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://lore.kernel.org/lkml/e9f42704-2f99-4f2c-ade5-f952e5fd53e5%40xs4all.nl/
CVE ID: CVE-2024-23849 State: PUBLISHED Published: 2024-01-23T00:00:00.000Z Last Updated: 2025-11-04T18:28:54.659Z Vendors: n/a Products: n/a Problem Types: n/a Description: In rds_recv_track_latency in net/rds/af_rds.c in the Linux kernel through 6.7.1, there is an off-by-one error for an RDS_MSG_RX_DGRAM_TRACE_MAX comparison, resulting in out-of-bounds access. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://lore.kernel.org/netdev/CALGdzuoVdq-wtQ4Az9iottBqC5cv9ZhcE5q8N7LfYFvkRsOVcw%40mail.gmail.com - https://lore.kernel.org/netdev/1705715319-19199-1-git-send-email-sharath.srinivasan%40oracle.com/ - https://lists.fedoraproject.org/archives/li
/netdev/1705715319-19199-1-git-send-email-sharath.srinivasan%40oracle.com/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7LSPIOMIJYTLZB6QKPQVVAYSUETUWKPF/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LBVHM4LGMFIHBN4UBESYRFMYX3WUICV5/ - https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=13e788deb7348cc88df34bed736c3b3b9927ea52 - https://bugzilla.suse.com/show_bug.cgi?id=1219127 - https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html - https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html
CVE ID: CVE-2024-23850 State: PUBLISHED Published: 2024-01-23T00:00:00.000Z Last Updated: 2025-11-04T18:28:55.847Z Vendors: n/a Products: n/a Problem Types: n/a Description: In btrfs_get_root_ref in fs/btrfs/disk-io.c in the Linux kernel through 6.7.1, there can be an assertion failure and crash because a subvolume can be read out too soon after its root item is inserted upon subvolume creation. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://lore.kernel.org/lkml/CALGdzuo6awWdau3X=8XK547x2vX_-VoFmH1aPsqosRTQ5WzJVA%40mail.gmail.com/ - https://lore.kernel.org/all/6a80cb4b32af89787dadee728310e5e2ca85343f.1705741883.git.wqu%40suse.com/ - https://
il.com/ - https://lore.kernel.org/all/6a80cb4b32af89787dadee728310e5e2ca85343f.1705741883.git.wqu%40suse.com/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EZOU3745CWCDZ7EMKMXB2OEEIB5Q3IWM/ - https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html
CVE ID: CVE-2024-23851 State: PUBLISHED Published: 2024-01-23T00:00:00.000Z Last Updated: 2025-11-04T18:28:57.019Z Vendors: n/a Products: n/a Problem Types: n/a Description: copy_params in drivers/md/dm-ioctl.c in the Linux kernel through 6.7.1 can attempt to allocate more than INT_MAX bytes, and crash, because of a missing param_kernel->data_size check. This is related to ctl_ioctl. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.spinics.net/lists/dm-devel/msg56574.html - https://www.spinics.net/lists/dm-devel/msg56694.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EZOU3745CWCDZ7EM
html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EZOU3745CWCDZ7EMKMXB2OEEIB5Q3IWM/ - https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html - https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html
CVE ID: CVE-2024-23854 State: REJECTED Published: N/A Last Updated: 2024-01-23T15:25:23.427490Z Description: No description available.
CVE ID: CVE-2024-23855 State: PUBLISHED Published: 2024-01-25T14:09:01.575Z Last Updated: 2025-05-29T15:19:23.939Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N) Vendors: Cups Easy Products: Cups Easy (Purchase & Inventory) Problem Types: CWE-79 Description: A vulnerability has been reported in Cups Easy (Purchase & Inventory), version 1.0, whereby user-controlled inputs are not sufficiently encoded, resulting in a Cross-Site Scripting (XSS) vulnerability via /cupseasylive/taxcodemodify.php, in multiple parameters. Exploitation of this vulnerability could allow a remote attacker to send a specially crafted URL to an authenticated user and steal their session cookie cr
could allow a remote attacker to send a specially crafted URL to an authenticated user and steal their session cookie credentials. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-cups-easy
CVE ID: CVE-2024-23856 State: PUBLISHED Published: 2024-01-26T09:03:53.927Z Last Updated: 2025-05-29T15:17:10.226Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N) Vendors: Cups Easy Products: Cups Easy (Purchase & Inventory) Problem Types: CWE-79 Description: A vulnerability has been reported in Cups Easy (Purchase & Inventory), version 1.0, whereby user-controlled inputs are not sufficiently encoded, resulting in a Cross-Site Scripting (XSS) vulnerability via /cupseasylive/itemlist.php, in the description parameter. Exploitation of this vulnerability could allow a remote attacker to send a specially crafted URL to an authenticated user and steal their session cookie c
CVE ID: CVE-2024-23857 State: PUBLISHED Published: 2024-01-26T09:04:16.835Z Last Updated: 2025-05-29T15:17:01.049Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N) Vendors: Cups Easy Products: Cups Easy (Purchase & Inventory) Problem Types: CWE-79 Description: A vulnerability has been reported in Cups Easy (Purchase & Inventory), version 1.0, whereby user-controlled inputs are not sufficiently encoded, resulting in a Cross-Site Scripting (XSS) vulnerability via /cupseasylive/grnlinecreate.php, in the batchno parameter. Exploitation of this vulnerability could allow a remote attacker to send a specially crafted URL to an authenticated user and steal their session cookie
y could allow a remote attacker to send a specially crafted URL to an authenticated user and steal their session cookie credentials. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-cups-easy
CVE ID: CVE-2024-23858 State: PUBLISHED Published: 2024-01-26T09:04:37.099Z Last Updated: 2025-05-29T15:16:54.071Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N) Vendors: Cups Easy Products: Cups Easy (Purchase & Inventory) Problem Types: CWE-79 Description: A vulnerability has been reported in Cups Easy (Purchase & Inventory), version 1.0, whereby user-controlled inputs are not sufficiently encoded, resulting in a Cross-Site Scripting (XSS) vulnerability via /cupseasylive/stockissuancelinecreate.php, in the batchno parameter. Exploitation of this vulnerability could allow a remote attacker to send a specially crafted URL to an authenticated user and steal their sessi
lnerability could allow a remote attacker to send a specially crafted URL to an authenticated user and steal their session cookie credentials. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-cups-easy
CVE ID: CVE-2024-23859 State: PUBLISHED Published: 2024-01-26T09:05:08.207Z Last Updated: 2025-06-17T21:29:15.357Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N) Vendors: Cups Easy Products: Cups Easy (Purchase & Inventory) Problem Types: CWE-79 Description: A vulnerability has been reported in Cups Easy (Purchase & Inventory), version 1.0, whereby user-controlled inputs are not sufficiently encoded, resulting in a Cross-Site Scripting (XSS) vulnerability via /cupseasylive/taxstructurelinecreate.php, in the flatamount parameter. Exploitation of this vulnerability could allow a remote attacker to send a specially crafted URL to an authenticated user and steal their ses
vulnerability could allow a remote attacker to send a specially crafted URL to an authenticated user and steal their session cookie credentials. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-cups-easy
CVE ID: CVE-2024-23860 State: PUBLISHED Published: 2024-01-26T09:05:45.078Z Last Updated: 2025-05-29T15:16:47.179Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N) Vendors: Cups Easy Products: Cups Easy (Purchase & Inventory) Problem Types: CWE-79 Description: A vulnerability has been reported in Cups Easy (Purchase & Inventory), version 1.0, whereby user-controlled inputs are not sufficiently encoded, resulting in a Cross-Site Scripting (XSS) vulnerability via /cupseasylive/currencylist.php, in the description parameter. Exploitation of this vulnerability could allow a remote attacker to send a specially crafted URL to an authenticated user and steal their session cook
lity could allow a remote attacker to send a specially crafted URL to an authenticated user and steal their session cookie credentials. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-cups-easy
CVE ID: CVE-2024-23861 State: PUBLISHED Published: 2024-01-26T09:06:08.652Z Last Updated: 2025-05-29T15:16:38.810Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N) Vendors: Cups Easy Products: Cups Easy (Purchase & Inventory) Problem Types: CWE-79 Description: A vulnerability has been reported in Cups Easy (Purchase & Inventory), version 1.0, whereby user-controlled inputs are not sufficiently encoded, resulting in a Cross-Site Scripting (XSS) vulnerability via /cupseasylive/unitofmeasurementcreate.php, in the unitofmeasurementid parameter. Exploitation of this vulnerability could allow a remote attacker to send a specially crafted URL to an authenticated user and steal
n of this vulnerability could allow a remote attacker to send a specially crafted URL to an authenticated user and steal their session cookie credentials. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-cups-easy
CVE ID: CVE-2024-23862 State: PUBLISHED Published: 2024-01-26T09:06:34.048Z Last Updated: 2025-05-29T15:16:30.506Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N) Vendors: Cups Easy Products: Cups Easy (Purchase & Inventory) Problem Types: CWE-79 Description: A vulnerability has been reported in Cups Easy (Purchase & Inventory), version 1.0, whereby user-controlled inputs are not sufficiently encoded, resulting in a Cross-Site Scripting (XSS) vulnerability via /cupseasylive/grndisplay.php, in the grnno parameter. Exploitation of this vulnerability could allow a remote attacker to send a specially crafted URL to an authenticated user and steal their session cookie crede
ld allow a remote attacker to send a specially crafted URL to an authenticated user and steal their session cookie credentials. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-cups-easy
CVE ID: CVE-2024-23863 State: PUBLISHED Published: 2024-01-26T09:06:53.297Z Last Updated: 2025-05-29T15:16:24.245Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N) Vendors: Cups Easy Products: Cups Easy (Purchase & Inventory) Problem Types: CWE-79 Description: A vulnerability has been reported in Cups Easy (Purchase & Inventory), version 1.0, whereby user-controlled inputs are not sufficiently encoded, resulting in a Cross-Site Scripting (XSS) vulnerability via /cupseasylive/taxstructuredisplay.php, in the description parameter. Exploitation of this vulnerability could allow a remote attacker to send a specially crafted URL to an authenticated user and steal their sessi
CVE ID: CVE-2024-23864 State: PUBLISHED Published: 2024-01-26T09:07:14.092Z Last Updated: 2025-05-29T15:16:17.115Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N) Vendors: Cups Easy Products: Cups Easy (Purchase & Inventory) Problem Types: CWE-79 Description: A vulnerability has been reported in Cups Easy (Purchase & Inventory), version 1.0, whereby user-controlled inputs are not sufficiently encoded, resulting in a Cross-Site Scripting (XSS) vulnerability via /cupseasylive/countrylist.php, in the description parameter. Exploitation of this vulnerability could allow a remote attacker to send a specially crafted URL to an authenticated user and steal their session cooki
ity could allow a remote attacker to send a specially crafted URL to an authenticated user and steal their session cookie credentials. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-cups-easy
CVE ID: CVE-2024-23865 State: PUBLISHED Published: 2024-01-26T09:07:31.075Z Last Updated: 2025-05-29T15:16:11.027Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N) Vendors: Cups Easy Products: Cups Easy (Purchase & Inventory) Problem Types: CWE-79 Description: A vulnerability has been reported in Cups Easy (Purchase & Inventory), version 1.0, whereby user-controlled inputs are not sufficiently encoded, resulting in a Cross-Site Scripting (XSS) vulnerability via /cupseasylive/taxstructurelist.php, in the description parameter. Exploitation of this vulnerability could allow a remote attacker to send a specially crafted URL to an authenticated user and steal their session
rability could allow a remote attacker to send a specially crafted URL to an authenticated user and steal their session cookie credentials. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-cups-easy
CVE ID: CVE-2024-23866 State: PUBLISHED Published: 2024-01-26T09:08:31.904Z Last Updated: 2025-05-29T15:16:02.546Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N) Vendors: Cups Easy Products: Cups Easy (Purchase & Inventory) Problem Types: CWE-79 Description: A vulnerability has been reported in Cups Easy (Purchase & Inventory), version 1.0, whereby user-controlled inputs are not sufficiently encoded, resulting in a Cross-Site Scripting (XSS) vulnerability via /cupseasylive/countrycreate.php, in the countryid parameter. Exploitation of this vulnerability could allow a remote attacker to send a specially crafted URL to an authenticated user and steal their session cooki
CVE ID: CVE-2024-23867 State: PUBLISHED Published: 2024-01-26T09:08:49.757Z Last Updated: 2025-05-29T15:15:55.586Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N) Vendors: Cups Easy Products: Cups Easy (Purchase & Inventory) Problem Types: CWE-79 Description: A vulnerability has been reported in Cups Easy (Purchase & Inventory), version 1.0, whereby user-controlled inputs are not sufficiently encoded, resulting in a Cross-Site Scripting (XSS) vulnerability via /cupseasylive/statecreate.php, in the stateid parameter. Exploitation of this vulnerability could allow a remote attacker to send a specially crafted URL to an authenticated user and steal their session cookie cr