Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-4142 State: PUBLISHED Published: 2024-05-01T20:18:23.916Z Last Updated: 2024-08-01T20:33:52.579Z Severity: CRITICAL (CVSS 9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: JFrog Products: Artifactory Problem Types: CWE-20 Description: An Improper input validation vulnerability that could potentially lead to privilege escalation was discovered in JFrog Artifactory. Due to this vulnerability, users with low privileges may gain administrative access to the system. This issue can also be exploited in Artifactory platforms with anonymous access enabled. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://jfrog.com/help/r/jfrog-
dditional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://jfrog.com/help/r/jfrog-release-information/jfrog-security-advisories
CVE ID: CVE-2024-4143 State: PUBLISHED Published: 2024-07-15T21:46:41.838Z Last Updated: 2024-08-01T20:33:52.408Z Vendors: HP Inc. Products: Certain HP PC Products Description: A potential security vulnerability has been identified in certain HP PC products using AMI BIOS, which might allow arbitrary code execution. AMI has released firmware updates to mitigate this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://support.hp.com/us-en/document/ish_10914391-10914417-16/hpsbhf03953
CVE ID: CVE-2024-4144 State: PUBLISHED Published: 2024-05-14T05:33:00.221Z Last Updated: 2024-08-01T20:33:52.480Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L) Vendors: wpkube Products: Simple Basic Contact Form Problem Types: CWE-94 Improper Control of Generation of Code ('Code Injection') Description: The Simple Basic Contact Form plugin for WordPress for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 20240502. This allows unauthenticated attackers to execute arbitrary shortcodes. The severity and exploitability depends on the functionality of other plugins installed in the environment. Additional Analyst Notes: - C
exploitability depends on the functionality of other plugins installed in the environment. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/ded1944f-662d-4d25-8277-4b1dc63b2144?source=cve - https://plugins.trac.wordpress.org/browser/simple-basic-contact-form/trunk/simple-basic-contact-form.php#L543 - https://plugins.trac.wordpress.org/changeset/3085036/
CVE ID: CVE-2024-4145 State: PUBLISHED Published: 2024-06-13T06:00:02.892Z Last Updated: 2024-08-01T20:33:52.569Z Vendors: Unknown Products: Search & Replace Problem Types: CWE-89 SQL Injection Description: The Search & Replace WordPress plugin before 3.2.2 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to perform SQL injection attacks (such as within a multi-site network). Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://wpscan.com/vulnerability/7d5b8764-c82d-4969-a707-f38b63bcadca/
CVE ID: CVE-2024-4146 State: PUBLISHED Published: 2024-06-08T19:41:25.437Z Last Updated: 2024-08-30T15:28:58.378Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: lunary-ai Products: lunary-ai/lunary Problem Types: CWE-863 Description: In lunary-ai/lunary version v1.2.13, an incorrect authorization vulnerability exists that allows unauthorized users to access and manipulate projects within an organization they should not have access to. Specifically, the vulnerability is located in the `checkProjectAccess` method within the authorization middleware, which fails to adequately verify if a user has the correct permissions to access a specific project. Instead,
iddleware, which fails to adequately verify if a user has the correct permissions to access a specific project. Instead, it only checks if the user is part of the organization owning the project, overlooking the necessary check against the `account_project` table for explicit project access rights. This flaw enables attackers to gain complete control over all resources within a project, including the ability to create, update, read, and delete any resource, compromising the privacy and security of sensitive information. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://huntr.com/bounties/a749e696-b398-4260-b2d0-b0054b9fffa7 - https://github.com
VE Program Container: References: - https://huntr.com/bounties/a749e696-b398-4260-b2d0-b0054b9fffa7 - https://github.com/lunary-ai/lunary/commit/c43b6c62035f32ca455f66d5fd22ba661648cde7
CVE ID: CVE-2024-4148 State: PUBLISHED Published: 2024-06-01T15:54:36.486Z Last Updated: 2025-01-30T13:09:21.705Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: lunary-ai Products: lunary-ai/lunary Problem Types: CWE-1333 Description: A Regular Expression Denial of Service (ReDoS) vulnerability exists in the lunary-ai/lunary application, version 1.2.10. An attacker can exploit this vulnerability by maliciously manipulating regular expressions, which can significantly impact the response time of the application and potentially render it completely non-functional. Specifically, the vulnerability can be triggered by sending a specially crafted request to the app
etely non-functional. Specifically, the vulnerability can be triggered by sending a specially crafted request to the application, leading to a denial of service where the application crashes. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://huntr.com/bounties/eca4ad45-2a38-4f3c-9ec1-8205cd51be31 - https://github.com/lunary-ai/lunary/commit/1e8a3d941ba5cfef2c478dd5bac4e4a4b4d67830
CVE ID: CVE-2024-4149 State: PUBLISHED Published: 2024-06-13T06:00:03.095Z Last Updated: 2025-03-26T14:56:45.754Z Vendors: Unknown Products: Floating Chat Widget: Contact Chat Icons, WhatsApp, Telegram Chat, Line Messenger, WeChat, Email, SMS, Call Button Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Floating Chat Widget: Contact Chat Icons, WhatsApp, Telegram Chat, Line Messenger, WeChat, Email, SMS, Call Button WordPress plugin before 3.2.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite s
m Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://wpscan.com/vulnerability/0256ec2a-f1a9-4110-9978-ee88f9e24237/
CVE ID: CVE-2024-4150 State: PUBLISHED Published: 2024-05-09T20:03:20.930Z Last Updated: 2024-08-01T20:33:52.540Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: wpkube Products: Simple Basic Contact Form Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Simple Basic Contact Form plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘scf_email’ parameter in versions up to, and including, 20221201 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if
escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/22074d7a-5dbd-4a0c-bc5d-e4c983e5edb4?source=cve - https://plugins.trac.wordpress.org/browser/simple-basic-contact-form/trunk/simple-basic-contact-form.php#L122 - https://plugins.trac.wordpress.org/changeset/3080540
CVE ID: CVE-2024-4151 State: PUBLISHED Published: 2024-05-20T14:14:53.399Z Last Updated: 2025-01-31T11:05:21.243Z Severity: HIGH (CVSS 8.3 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L) Vendors: lunary-ai Products: lunary-ai/lunary Problem Types: CWE-639 Description: An Improper Access Control vulnerability exists in lunary-ai/lunary version 1.2.2, where users can view and update any prompts in any projects due to insufficient access control checks in the handling of PATCH and GET requests for template versions. This vulnerability allows unauthorized users to manipulate or access sensitive project data, potentially leading to data integrity and confidentiality issues. Additional Analyst Notes
ccess sensitive project data, potentially leading to data integrity and confidentiality issues. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://huntr.com/bounties/4acfef85-dedf-43bd-8438-0d8aaa4ffa01 - https://github.com/lunary-ai/lunary/commit/ddfd497afd017a6946c582a1a806687fdac888bf
CVE ID: CVE-2024-4152 State: REJECTED Published: N/A Last Updated: 2024-06-07T16:55:16.990Z Description: No description available.
CVE ID: CVE-2024-4153 State: REJECTED Published: 2024-05-22T09:17:39.006Z Last Updated: 2024-06-07T16:56:14.632Z Description: No description available.
CVE ID: CVE-2024-4154 State: PUBLISHED Published: 2024-05-21T17:57:28.152Z Last Updated: 2025-01-31T11:05:21.786Z Severity: HIGH (CVSS 7.1 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N) Vendors: lunary-ai Products: lunary-ai/lunary Problem Types: CWE-639 Description: In lunary-ai/lunary version 1.2.2, an incorrect synchronization vulnerability allows unprivileged users to rename projects they do not have access to. Specifically, an unprivileged user can send a PATCH request to the project's endpoint with a new name for a project, despite not having the necessary permissions or being assigned to the project. This issue allows for unauthorized modification of project names, potentially leading
or being assigned to the project. This issue allows for unauthorized modification of project names, potentially leading to confusion or unauthorized access to project resources. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://huntr.com/bounties/e56509af-f7af-4e1e-a04b-9cb53545f30f - https://github.com/lunary-ai/lunary/commit/c43b6c62035f32ca455f66d5fd22ba661648cde7
CVE ID: CVE-2024-4155 State: REJECTED Published: N/A Last Updated: 2024-06-11T09:46:49.391Z Description: No description available.
CVE ID: CVE-2024-4156 State: PUBLISHED Published: 2024-05-02T16:51:52.490Z Last Updated: 2024-08-01T20:33:52.653Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: wpdevteam Products: Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘eael_event_text_color’ parameter in versions up to, and including, 5.9.17 due to insufficient
ss-Site Scripting via the ‘eael_event_text_color’ parameter in versions up to, and including, 5.9.17 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/23a66e6b-cec0-4110-9bef-a5d41ce1c954?source=cve - https://plugins.trac.wordpress.org/browser/essential-addons-for-elementor-lite/trunk/includes/Elements/Event_Calendar.php#L3125 - https://plu
wordpress.org/browser/essential-addons-for-elementor-lite/trunk/includes/Elements/Event_Calendar.php#L3125 - https://plugins.trac.wordpress.org/changeset/3079406/
CVE ID: CVE-2024-4157 State: PUBLISHED Published: 2024-05-22T07:37:24.259Z Last Updated: 2024-08-01T20:33:52.482Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: techjewel Products: Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder Problem Types: CWE-502 Deserialization of Untrusted Data Description: The Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 5.1.15 via deserialization of untrusted input in the extractDynamicValues function. This makes it possible for authenticated attackers, with co
ion of untrusted input in the extractDynamicValues function. This makes it possible for authenticated attackers, with contributor-level access and above, to inject a PHP Object. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code. Successful exploitation requires the attacker to have "View Form" and "Manage Form" permissions, which must be explicitly set by an administrator. However, this requirement can be bypassed when this vulnerability is chained with CVE-2024-2771. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: -
is chained with CVE-2024-2771. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/8def156a-f2f2-4640-a1c9-c21c74e1f308?source=cve - https://plugins.trac.wordpress.org/changeset/3081740/fluentform
CVE ID: CVE-2024-4158 State: PUBLISHED Published: 2024-05-09T20:03:21.398Z Last Updated: 2024-08-01T20:33:52.903Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: creativethemeshq Products: Blocksy Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Blocksy theme for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘tagName’ parameter in versions up to, and including, 2.0.42 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level permissions and above, to inject arbitrary web scripts in pages that
for authenticated attackers, with contributor-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/22d1ccf3-ac1a-4dfc-81c3-b8eb88795bc1?source=cve - https://themes.trac.wordpress.org/changeset/226440/blocksy
CVE ID: CVE-2024-4159 State: PUBLISHED Published: 2024-04-25T01:58:17.489Z Last Updated: 2024-08-01T20:33:52.913Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Brocade Products: Brocade SANnav Problem Types: CWE-200 Description: Brocade SANnav before v2.3.0a lacks protection mechanisms on port 2377/TCP and 7946/TCP, which could allow an unauthenticated attacker to sniff the SANnav Docker information. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://support.broadcom.com/external/content/SecurityAdvisories/0/23282
CVE ID: CVE-2024-4160 State: PUBLISHED Published: 2024-05-31T09:31:39.856Z Last Updated: 2024-08-01T20:33:52.855Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: codename065 Products: Download Manager Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wpdm-all-packages' shortcode in all versions up to, and including, 3.2.90 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level acc
put escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/9f51258a-e228-412f-9d97-28ab679136d7?source=cve - https://plugins.trac.wordpress.org/browser/download-manager/trunk/src/Package/views/all-packages-shortcode.php?rev=2996137#L202 - https://wordpress.org/plugins/download-manager/ - https://www.wpdownloadmanager.com/doc/short-codes/wpdm_all_packages-list-all-download
ss.org/plugins/download-manager/ - https://www.wpdownloadmanager.com/doc/short-codes/wpdm_all_packages-list-all-downloads-in-tabular-format-in-a-page/ - https://wordpress.org/plugins/download-manager/#developers - https://plugins.trac.wordpress.org/changeset/3080781/
CVE ID: CVE-2024-4161 State: PUBLISHED Published: 2024-04-25T02:32:08.686Z Last Updated: 2024-08-01T20:33:52.517Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N) Vendors: Brocade Products: Brocade SANnav Problem Types: CWE-319 Description: In Brocade SANnav, before Brocade SANnav v2.3.0, syslog traffic received clear text. This could allow an unauthenticated, remote attacker to capture sensitive information. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://support.broadcom.com/external/content/SecurityAdvisories/0/23284
CVE ID: CVE-2024-4162 State: PUBLISHED Published: 2024-05-08T02:57:11.091Z Last Updated: 2024-08-01T20:33:52.545Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L) Vendors: Panasonic Holdings Corporation Products: KW Watcher Problem Types: CWE-119 Description: A buffer error in Panasonic KW Watcher versions 1.00 through 2.83 may allow attackers malicious read access to memory. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www3.panasonic.biz/ac/e/fasys/software_info/eco/tol_kwwatcher.jsp
CVE ID: CVE-2024-4163 State: PUBLISHED Published: 2024-04-26T02:26:22.758Z Last Updated: 2024-08-01T20:33:52.410Z Severity: HIGH (CVSS 8 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Skylab Products: IIoT Gateway (IGX) Problem Types: Limited shell breakout leading to root access Description: The Skylab IGX IIoT Gateway allowed users to connect to it via a limited shell terminal (IGX). However, it was discovered that the process was running under root privileges. This allowed the attacker to read, write, and modify any file in the operating system by utilizing the limited shell file exec and download functions. By replacing the /etc/passwd file with a new root user entry, the attacke
imited shell file exec and download functions. By replacing the /etc/passwd file with a new root user entry, the attacker was able to breakout from the limited shell and login to a unrestricted shell with root access. With the root access, the attacker will be able take full control of the IIoT Gateway. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://govtech-csg.github.io/security-advisories/2024/04/25/CVE-2024-4163.html
CVE ID: CVE-2024-4164 State: PUBLISHED Published: 2024-04-25T10:31:04.703Z Last Updated: 2024-08-01T20:33:52.490Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C) Vendors: Tenda Products: G3 Problem Types: CWE-121 Description: A vulnerability, which was classified as critical, has been found in Tenda G3 15.11.0.17(9502). This issue affects the function formModifyPppAuthWhiteMac of the file /goform/ModifyPppAuthWhiteMac. The manipulation of the argument pppoeServerWhiteMacIndex leads to stack-based buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-261983. NOTE: The vendor
disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-261983. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.261983 - https://vuldb.com/?ctiid.261983 - https://vuldb.com/?submit.318588 - https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/G3/G3V15/formModifyPppAuthWhiteMac.md
CVE ID: CVE-2024-4165 State: PUBLISHED Published: 2024-04-25T11:31:04.731Z Last Updated: 2024-08-01T20:33:52.512Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C) Vendors: Tenda Products: G3 Problem Types: CWE-121 Description: A vulnerability, which was classified as critical, was found in Tenda G3 15.11.0.17(9502). Affected is the function modifyDhcpRule of the file /goform/modifyDhcpRule. The manipulation of the argument bindDhcpIndex leads to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-261984. NOTE: The vendor was contacted early about this disclosure b
e used. The identifier of this vulnerability is VDB-261984. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.261984 - https://vuldb.com/?ctiid.261984 - https://vuldb.com/?submit.318589 - https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/G3/G3V15/modifyDhcpRule.md
CVE ID: CVE-2024-4166 State: PUBLISHED Published: 2024-04-25T11:31:06.063Z Last Updated: 2024-08-01T20:33:52.527Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C) Vendors: Tenda Products: 4G300 Problem Types: CWE-121 Description: A vulnerability has been found in Tenda 4G300 1.01.42 and classified as critical. Affected by this vulnerability is the function sub_41E858. The manipulation of the argument GO/page leads to stack-based buffer overflow. The attack can be launched remotely. The identifier VDB-261985 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Pr
early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.261985 - https://vuldb.com/?ctiid.261985 - https://vuldb.com/?submit.318981 - https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/G3/4G300/sub_41E858_GO.md
CVE ID: CVE-2024-4167 State: PUBLISHED Published: 2024-04-25T12:00:05.316Z Last Updated: 2024-08-01T20:33:52.666Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C) Vendors: Tenda Products: 4G300 Problem Types: CWE-121 Description: A vulnerability was found in Tenda 4G300 1.01.42 and classified as critical. Affected by this issue is the function sub_422AA4. The manipulation of the argument year/month/day/hour/minute/second leads to stack-based buffer overflow. The attack may be launched remotely. VDB-261986 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichme
as contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.261986 - https://vuldb.com/?ctiid.261986 - https://vuldb.com/?submit.318983 - https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/G3/4G300/sub_422AA4.md