Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-29500 State: PUBLISHED Published: 2024-04-10T00:00:00.000Z Last Updated: 2025-04-16T15:38:32.165Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in the kiosk mode of Secure Lockdown Multi Application Edition v2.00.219 allows attackers to execute arbitrary code via running a ClickOnce application instance. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.drive-byte.de/en/blog/inteset-bugs-and-hardening - https://raeph123.github.io/BlogPosts/inteset/Inteset_Secure_Lockdown_Multi_Application_Edition_-_Vulnerabilities_and_Hardening_Measures_en.html
CVE ID: CVE-2024-29502 State: PUBLISHED Published: 2024-04-10T00:00:00.000Z Last Updated: 2025-04-15T22:12:55.595Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in Secure Lockdown Multi Application Edition v2.00.219 allows attackers to read arbitrary files via using UNC paths. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.drive-byte.de/en/blog/inteset-bugs-and-hardening - https://raeph123.github.io/BlogPosts/inteset/Inteset_Secure_Lockdown_Multi_Application_Edition_-_Vulnerabilities_and_Hardening_Measures_en.html
CVE ID: CVE-2024-29504 State: PUBLISHED Published: 2024-04-10T00:00:00 Last Updated: 2024-08-27T19:40:24.457Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting vulnerability in Summernote v.0.8.18 and before allows a remote attacker to execute arbtirary code via a crafted payload to the codeview parameter. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/summernote/summernote/pull/3782 - https://gist.github.com/phoenix118go/a9192281efcfa518daa709ab7638712b
CVE ID: CVE-2024-29506 State: PUBLISHED Published: 2024-07-03T00:00:00 Last Updated: 2024-08-02T01:10:55.536Z Vendors: n/a Products: n/a Problem Types: n/a Description: Artifex Ghostscript before 10.03.0 has a stack-based buffer overflow in the pdfi_apply_filter() function via a long PDF filter name. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://bugs.ghostscript.com/show_bug.cgi?id=707510 - https://git.ghostscript.com/?p=ghostpdl.git%3Bh=77dc7f699beba606937b7ea23b50cf5974fa64b1 - https://www.openwall.com/lists/oss-security/2024/07/03/7
CVE ID: CVE-2024-29507 State: PUBLISHED Published: 2024-07-03T00:00:00 Last Updated: 2024-12-03T15:41:47.471Z Vendors: n/a Products: n/a Problem Types: n/a Description: Artifex Ghostscript before 10.03.0 sometimes has a stack-based buffer overflow via the CIDFSubstPath and CIDFSubstFont parameters. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://bugs.ghostscript.com/show_bug.cgi?id=707510 - https://git.ghostscript.com/?p=ghostpdl.git%3Ba=commitdiff%3Bh=7745dbe24514 - https://www.openwall.com/lists/oss-security/2024/07/03/7
CVE ID: CVE-2024-29508 State: PUBLISHED Published: 2024-07-03T00:00:00.000Z Last Updated: 2025-03-17T13:50:45.571Z Vendors: n/a Products: n/a Problem Types: n/a Description: Artifex Ghostscript before 10.03.0 has a heap-based pointer disclosure (observable in a constructed BaseFont name) in the function pdf_base_font_alloc. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://bugs.ghostscript.com/show_bug.cgi?id=707510 - https://git.ghostscript.com/?p=ghostpdl.git%3Bh=ff1013a0ab485b66783b70145e342a82c670906a - https://www.openwall.com/lists/oss-security/2024/07/03/7
CVE ID: CVE-2024-29509 State: PUBLISHED Published: 2024-07-03T00:00:00.000Z Last Updated: 2025-03-20T19:06:20.794Z Vendors: n/a Products: n/a Problem Types: n/a Description: Artifex Ghostscript before 10.03.0 has a heap-based overflow when PDFPassword (e.g., for runpdf) has a \000 byte in the middle. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://bugs.ghostscript.com/show_bug.cgi?id=707510 - https://git.ghostscript.com/?p=ghostpdl.git%3Bh=917b3a71fb20748965254631199ad98210d6c2fb - https://www.openwall.com/lists/oss-security/2024/07/03/7
CVE ID: CVE-2024-29510 State: PUBLISHED Published: 2024-07-03T00:00:00 Last Updated: 2024-08-19T07:47:53.603Z Vendors: n/a Products: n/a Problem Types: n/a Description: Artifex Ghostscript before 10.03.1 allows memory corruption, and SAFER sandbox bypass, via format string injection with a uniprint device. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://bugs.ghostscript.com/show_bug.cgi?id=707662 - https://www.openwall.com/lists/oss-security/2024/07/03/7 - https://codeanlabs.com/blog/research/cve-2024-29510-ghostscript-format-string-exploitation/
CVE ID: CVE-2024-29511 State: PUBLISHED Published: 2024-07-03T00:00:00 Last Updated: 2024-08-02T01:10:55.453Z Vendors: n/a Products: n/a Problem Types: n/a Description: Artifex Ghostscript before 10.03.1, when Tesseract is used for OCR, has a directory traversal issue that allows arbitrary file reading (and writing of error messages to arbitrary files) via OCRLanguage. For example, exploitation can use debug_file /tmp/out and user_patterns_file /etc/passwd. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://bugs.ghostscript.com/show_bug.cgi?id=707510 - https://git.ghostscript.com/?p=ghostpdl.git%3Ba=commitdiff%3Bh=3d4cfdc1a44 - https://www.openw
/show_bug.cgi?id=707510 - https://git.ghostscript.com/?p=ghostpdl.git%3Ba=commitdiff%3Bh=3d4cfdc1a44 - https://www.openwall.com/lists/oss-security/2024/07/03/7
CVE ID: CVE-2024-29513 State: PUBLISHED Published: 2024-05-13T19:32:39.029Z Last Updated: 2025-02-13T15:47:47.233Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in briscKernelDriver.sys in BlueRiSC WindowsSCOPE Cyber Forensics before 3.3 allows a local attacker to execute arbitrary code within the driver and create a local denial-of-service condition due to an improper DACL being applied to the device the driver creates. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/dru1d-foofus/briscKernelDriver
CVE ID: CVE-2024-29514 State: PUBLISHED Published: 2024-04-02T00:00:00 Last Updated: 2024-08-28T18:44:58.122Z Vendors: n/a Products: n/a Problem Types: n/a Description: File Upload vulnerability in lepton v.7.1.0 allows a remote authenticated attackers to execute arbitrary code via uploading a crafted PHP file. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/zzq66/cve6/
CVE ID: CVE-2024-29515 State: PUBLISHED Published: 2024-03-25T00:00:00 Last Updated: 2024-08-19T19:56:31.080Z Vendors: n/a Products: n/a Problem Types: n/a Description: File Upload vulnerability in lepton v.7.1.0 allows a remote authenticated attackers to execute arbitrary code via uploading a crafted PHP file to the save.php and config.php component. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/zzq66/cve7/
CVE ID: CVE-2024-29640 State: PUBLISHED Published: 2024-03-29T00:00:00 Last Updated: 2024-08-27T18:08:39.144Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in aliyundrive-webdav v.2.3.3 and before allows a remote attacker to execute arbitrary code via a crafted payload to the sid parameter in the action_query_qrcode component. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://aliyundrive-webdav.com - https://github.com/lakemoon602/vuln/blob/main/detail.md - https://github.com/messense/aliyundrive-webdav
CVE ID: CVE-2024-29643 State: PUBLISHED Published: 2025-04-18T00:00:00.000Z Last Updated: 2025-04-22T15:08:13.519Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in croogo v.3.0.2 allows an attacker to perform Host header injection via the feed.rss component. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://medium.com/@christbowel6/cve-2024-29643-host-header-injection-in-croogo-v3-0-2-0aded525f574
CVE ID: CVE-2024-29644 State: PUBLISHED Published: 2024-03-26T00:00:00.000Z Last Updated: 2025-03-24T15:50:03.694Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting vulnerability in dcat-admin v.2.1.3 and before allows a remote attacker to execute arbitrary code via a crafted script to the user login box. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://dcat-admin.com - https://github.com/jqhph/dcat-admin - https://www.yuque.com/yangtu-swjrh/oc6nqi/epcbz5y1grl4il1m
CVE ID: CVE-2024-29645 State: PUBLISHED Published: 2024-12-02T00:00:00.000Z Last Updated: 2025-03-13T16:05:24.451Z Vendors: n/a Products: n/a Problem Types: n/a Description: Buffer Overflow vulnerability in radarorg radare2 v.5.8.8 allows an attacker to execute arbitrary code via the parse_die function. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/radareorg/radare2/commit/72bf3a486fa851797aa21887a40ba0e3d3a6d620 - https://github.com/radareorg/radare2/pull/22561 - https://gist.github.com/Crispy-fried-chicken/83f0f5e8a475284d64bf99fb342e9027
CVE ID: CVE-2024-29646 State: PUBLISHED Published: 2024-12-17T00:00:00 Last Updated: 2024-12-18T15:51:45.417Z Vendors: n/a Products: n/a Problem Types: n/a Description: Buffer Overflow vulnerability in radarorg radare2 v.5.8.8 allows an attacker to execute arbitrary code via the name, type, or group fields. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/radareorg/radare2/pull/22562 - https://github.com/radareorg/radare2/pull/22567 - https://github.com/radareorg/radare2/pull/22572 - https://github.com/radareorg/radare2/pull/22578 - https://github.com/radareorg/radare2/pull/22599 - https://gist.github.com/Crispy-fried-chicken/0be4a204e7226fa2cea761c09f02769
//github.com/radareorg/radare2/pull/22599 - https://gist.github.com/Crispy-fried-chicken/0be4a204e7226fa2cea761c09f027690
CVE ID: CVE-2024-29650 State: PUBLISHED Published: 2024-03-25T00:00:00 Last Updated: 2024-08-23T20:20:42.428Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in @thi.ng/paths v.5.1.62 and before allows a remote attacker to execute arbitrary code via the mutIn and mutInManyUnsafe components. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://gist.github.com/tariqhawis/1bc340ca5ea6ae115c9ab9665cfd5921 - https://learn.snyk.io/lesson/prototype-pollution/#a0a863a5-fd3a-539f-e1ed-a0769f6c6e3b
CVE ID: CVE-2024-29651 State: PUBLISHED Published: 2024-05-20T17:15:21.434Z Last Updated: 2025-02-13T15:47:47.764Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Prototype Pollution issue in API Dev Tools json-schema-ref-parser v.11.0.0 and v.11.1.0 allows a remote attacker to execute arbitrary code via the bundle()`, `parse()`, `resolve()`, `dereference() functions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gist.github.com/tariqhawis/5db76b38112bba756615b688c32409ad
CVE ID: CVE-2024-29660 State: PUBLISHED Published: 2024-04-25T00:00:00 Last Updated: 2024-08-02T01:10:55.530Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting vulnerability in DedeCMS v.5.7 allows a local attacker to execute arbitrary code via a crafted payload to the stepselect_main.php component. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/ysl1415926/cve/blob/main/DedeCMSv5.7.md
CVE ID: CVE-2024-29661 State: PUBLISHED Published: 2024-04-22T00:00:00 Last Updated: 2024-08-02T01:10:55.421Z Vendors: n/a Products: n/a Problem Types: n/a Description: A File Upload vulnerability in DedeCMS v5.7 allows a local attacker to execute arbitrary code via a crafted payload. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/ysl1415926/cve/blob/main/DedeCMSv5.7_getshell.md
CVE ID: CVE-2024-29666 State: PUBLISHED Published: 2024-03-25T00:00:00 Last Updated: 2024-08-27T17:26:56.205Z Vendors: n/a Products: n/a Problem Types: n/a Description: Insecure Permissions vulnerability in Vehicle Monitoring platform system CMSV6 v.7.31.0.2 through v.7.32.0.3 allows a remote attacker to escalate privileges via the default password component. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/whgojp/cve-reports/wiki/There-is-a-weak-password-in-the-CMSV6-vehicle-monitoring-platform-system
CVE ID: CVE-2024-29667 State: PUBLISHED Published: 2024-03-29T00:00:00.000Z Last Updated: 2025-03-25T14:40:57.392Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL Injection vulnerability in Tongtianxing Technology Co., Ltd CMSV6 v.7.31.0.2 through v.7.31.0.3 allows a remote attacker to escalate privileges and obtain sensitive information via the ids parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/whgojp/cve-reports/wiki/CMSV6-vehicle-monitoring-platform-system-SQL-injection
CVE ID: CVE-2024-29671 State: PUBLISHED Published: 2024-12-16T00:00:00 Last Updated: 2024-12-17T14:44:43.433Z Vendors: n/a Products: n/a Problem Types: n/a Description: Buffer Overflow vulnerability in NEXTU FLATA AX1500 Router v.1.0.2 allows a remote attacker to execute arbitrary code via the POST request handler component. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://ez-net.co.kr/new_2012/customer/download_view.php?cid=&sid=&goods=&cate=&q=Ax1500&seq=228 - https://github.com/laskdjlaskdj12/CVE-2024-29671-POC - https://gist.github.com/laskdjlaskdj12/4afc8b5d75640bd28eaf32de3ceda48a
CVE ID: CVE-2024-29672 State: PUBLISHED Published: 2024-04-05T00:00:00 Last Updated: 2024-08-16T15:07:13.921Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AC:L/AV:N/A:H/C:H/I:H/PR:N/S:U/UI:R) Vendors: n/a Products: n/a Problem Types: n/a Description: Directory Traversal vulnerability in zly2006 Reden before v.0.2.514 allows a remote attacker to execute arbitrary code via the DEBUG_RTC_REQUEST_SYNC_DATA in KeyCallbacks.kt. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gist.github.com/apple502j/193358682885fe1a6708309ce934e4ed - https://github.com/zly2006/reden-is-what-we-made/commit/44c5320f0a1ccaa764dd91df6a12e747f81fe63a
CVE ID: CVE-2024-29684 State: PUBLISHED Published: 2024-03-26T00:00:00 Last Updated: 2024-08-06T14:16:25.293Z Vendors: n/a Products: n/a Problem Types: n/a Description: DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /src/dede/makehtml_homepage.php allowing a remote attacker to execute arbitrary code. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/iimiss/cms/blob/main/1.md
CVE ID: CVE-2024-29686 State: PUBLISHED Published: 2024-03-29T00:00:00 Last Updated: 2024-08-23T13:55:48.525Z Vendors: n/a Products: n/a Problem Types: n/a Description: Server-side Template Injection (SSTI) vulnerability in Winter CMS v.1.2.3 allows a remote attacker to execute arbitrary code via a crafted payload to the CMS Pages field and Plugin components. NOTE: the vendor disputes this because the payload could only be entered by a trusted user, such as the owner of the server that hosts Winter CMS, or a developer working for them. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.exploit-db.com/exploits/51893 - https://forum.ksec.co.uk
ulnrichment: - CVE Program Container: References: - https://www.exploit-db.com/exploits/51893 - https://forum.ksec.co.uk/t/webapps-winter-cms-1-2-3-server-side-template-injection-ssti-authenticated/2779 - https://wintercms.com/docs/v1.2/docs/cms/themes#template-structure
CVE ID: CVE-2024-29723 State: PUBLISHED Published: 2024-08-29T09:46:10.008Z Last Updated: 2024-08-29T13:04:26.152Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: SportsNET Products: SportsNET Problem Types: CWE-89 Description: SQL injection vulnerabilities in SportsNET affecting version 4.0.1. These vulnerabilities could allow an attacker to retrieve, update and delete all information in the database by sending a specially crafted SQL query: https://XXXXXXX.saludydesafio.com/conexiones/ax/openTracExt/, parameter categoria;. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerab
alyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-sportsnet
CVE ID: CVE-2024-29724 State: PUBLISHED Published: 2024-08-29T09:45:07.623Z Last Updated: 2024-08-29T13:04:15.834Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: SportsNET Products: SportsNET Problem Types: CWE-89 Description: SQL injection vulnerabilities in SportsNET affecting version 4.0.1. These vulnerabilities could allow an attacker to retrieve, update and delete all information in the database by sending a specially crafted SQL query: https://XXXXXXX.saludydesafio.com/ax/registerSp/, parameter idDesafio. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-sport
- CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-sportsnet
CVE ID: CVE-2024-29725 State: PUBLISHED Published: 2024-08-29T09:42:24.817Z Last Updated: 2024-08-29T13:04:07.905Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: SportsNET Products: SportsNET Problem Types: CWE-89 Description: SQL injection vulnerabilities in SportsNET affecting version 4.0.1. These vulnerabilities could allow an attacker to retrieve, update and delete all information in the database by sending a specially crafted SQL query: https://XXXXXXX.saludydesafio.com/app/ax/sort_bloques/, parameter list. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-spor
CVE ID: CVE-2024-29726 State: PUBLISHED Published: 2024-08-29T09:38:20.813Z Last Updated: 2024-09-06T16:20:51.157Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: SportsNET Products: SportsNET Problem Types: CWE-89 Description: SQL injection vulnerabilities in SportsNET affecting version 4.0.1. These vulnerabilities could allow an attacker to retrieve, update and delete all information in the database by sending a specially crafted SQL query: https://XXXXXXX.saludydesafio.com/app/ax/setAsRead/, parameter id. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-sportsnet
CVE ID: CVE-2024-29727 State: PUBLISHED Published: 2024-08-29T09:36:07.382Z Last Updated: 2024-08-29T13:03:50.543Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: SportsNET Products: SportsNET Problem Types: CWE-89 Description: SQL injection vulnerabilities in SportsNET affecting version 4.0.1. These vulnerabilities could allow an attacker to retrieve, update and delete all information in the database by sending a specially crafted SQL query: https://XXXXXXX.saludydesafio.com/app/ax/sendParticipationRemember/ , parameter send. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulner
Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-sportsnet
CVE ID: CVE-2024-29728 State: PUBLISHED Published: 2024-08-29T09:32:21.014Z Last Updated: 2024-08-29T13:03:43.279Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: SportsNET Products: SportsNET Problem Types: CWE-89 Description: SQL injection vulnerabilities in SportsNET affecting version 4.0.1. These vulnerabilities could allow an attacker to retrieve, update and delete all information in the database by sending a specially crafted SQL query: https://XXXXXXX.saludydesafio.com/app/ax/inscribeUsuario/ , parameter idDesafio. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabili
st Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-sportsnet
CVE ID: CVE-2024-29729 State: PUBLISHED Published: 2024-08-29T09:31:06.178Z Last Updated: 2024-08-29T13:03:34.918Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: SportsNET Products: SportsNET Problem Types: CWE-89 Description: SQL injection vulnerabilities in SportsNET affecting version 4.0.1. These vulnerabilities could allow an attacker to retrieve, update and delete all information in the database by sending a specially crafted SQL query: https://XXXXXXX.saludydesafio.com/app/ax/generateShortURL/, parameter url. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-s
es: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-sportsnet
CVE ID: CVE-2024-29730 State: PUBLISHED Published: 2024-08-29T09:28:38.872Z Last Updated: 2024-09-06T16:21:17.933Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: SportsNET Products: SportsNET Problem Types: CWE-89 Description: SQL injection vulnerabilities in SportsNET affecting version 4.0.1. These vulnerabilities could allow an attacker to retrieve, update and delete all information in the database by sending a specially crafted SQL query: https://XXXXXXX.saludydesafio.com/app/ax/consejoRandom/ , parameter idCat;. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-
tes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-sportsnet
CVE ID: CVE-2024-29731 State: PUBLISHED Published: 2024-08-29T09:20:52.101Z Last Updated: 2024-08-29T13:03:18.005Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: SportsNET Products: SportsNET Problem Types: CWE-89 Description: SQL injection vulnerabilities in SportsNET affecting version 4.0.1. These vulnerabilities could allow an attacker to retrieve, update and delete all information in the database by sending a specially crafted SQL query: https://XXXXXXX.saludydesafio.com/app/ax/checkBlindFields/ , parameters idChallenge and idEmpresa. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/mu
. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-sportsnet
CVE ID: CVE-2024-29732 State: PUBLISHED Published: 2024-03-21T10:37:08.440Z Last Updated: 2024-08-06T14:56:52.651Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Abast Products: SCAN_VISIO eDocument Suite Web Viewer Problem Types: CWE-89 Description: A SQL Injection has been found on SCAN_VISIO eDocument Suite Web Viewer of Abast. This vulnerability allows an unauthenticated user to retrieve, update and delete all the information of database. This vulnerability was found on login page via "user" parameter. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/sql-inject
Program Container: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/sql-injection-vulnerability-scanvisio-edocument-suite-web-viewer-abast