Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-5396 State: PUBLISHED Published: 2024-05-27T02:31:05.124Z Last Updated: 2024-08-01T21:11:12.638Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: itsourcecode Products: Online Student Enrollment System Problem Types: CWE-89 Description: A vulnerability classified as critical has been found in itsourcecode Online Student Enrollment System 1.0. Affected is an unknown function of the file newfaculty.php. The manipulation of the argument name leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-266310 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CISA AD
public and may be used. VDB-266310 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.266310 - https://vuldb.com/?ctiid.266310 - https://vuldb.com/?submit.344699 - https://github.com/Lanxiy7th/lx_CVE_report-/issues/9
CVE ID: CVE-2024-5397 State: PUBLISHED Published: 2024-05-27T03:00:04.345Z Last Updated: 2024-08-01T21:11:12.582Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: itsourcecode Products: Online Student Enrollment System Problem Types: CWE-89 Description: A vulnerability classified as critical was found in itsourcecode Online Student Enrollment System 1.0. Affected by this vulnerability is an unknown functionality of the file instructorSubjects.php. The manipulation of the argument instructorId leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-266311. Addi
it has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-266311. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.266311 - https://vuldb.com/?ctiid.266311 - https://vuldb.com/?submit.344700 - https://github.com/Lanxiy7th/lx_CVE_report-/issues/10
CVE ID: CVE-2024-5398 State: REJECTED Published: N/A Last Updated: 2024-06-11T09:45:10.169Z Description: No description available.
CVE ID: CVE-2024-5399 State: PUBLISHED Published: 2024-05-27T03:32:29.744Z Last Updated: 2024-08-01T21:11:12.667Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Openfind Products: Mail2000 V7.0, Mail2000 V8.0 Problem Types: CWE-78 Description: Openfind Mail2000 does not properly filter parameters of specific API. Remote attackers with administrative privileges can exploit this vulnerability to execute arbitrary system commands on the remote server. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.twcert.org.tw/tw/cp-132-7817-6ce29-1.html
CVE ID: CVE-2024-5400 State: PUBLISHED Published: 2024-05-27T05:36:44.672Z Last Updated: 2024-08-01T21:11:12.528Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Openfind Products: Mail2000 V8.0 Problem Types: CWE-78 Description: Openfind Mail2000 does not properly filter parameters of specific CGI. Remote attackers with regular privileges can exploit this vulnerability to execute arbitrary system commands on the remote server. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.twcert.org.tw/tw/cp-132-7819-9661a-1.html
CVE ID: CVE-2024-5402 State: PUBLISHED Published: 2024-07-15T11:57:44.261Z Last Updated: 2024-08-01T21:11:12.639Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: ABB Products: Mint Workbench I Problem Types: CWE-428 Description: Unquoted Search Path or Element vulnerability in ABB Mint Workbench. A local attacker who successfully exploited this vulnerability could gain elevated privileges by inserting an executable file in the path of the affected service. This issue affects Mint Workbench I versions: from 5866 before 5868. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://search.abb.com/library/Download.aspx?Doc
Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://search.abb.com/library/Download.aspx?DocumentID=9AKK108469A7912&LanguageCode=en&DocumentPartId=1&Action=Launch
CVE ID: CVE-2024-5403 State: PUBLISHED Published: 2024-05-27T06:59:23.378Z Last Updated: 2024-08-01T21:11:12.563Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: ASKEY Products: 5G NR Small Cell Problem Types: CWE-78 Description: ASKEY 5G NR Small Cell fails to properly filter user input for certain functionality, allowing remote attackers with administrator privilege to execute arbitrary system commands on the remote server. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.twcert.org.tw/tw/cp-132-7821-87e38-1.html
CVE ID: CVE-2024-5404 State: PUBLISHED Published: 2024-06-03T09:00:55.691Z Last Updated: 2024-08-01T21:11:12.710Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: ifm Products: moneo appliance QVA200, moneo appliance QHA210, moneo appliance QHA300, moneo for Micosoft Windows Problem Types: CWE-640 Description: An unauthenticated remote attacker can change the admin password in a moneo appliance due to weak password recovery mechanism. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://cert.vde.com/en/advisories/VDE-2024-028
CVE ID: CVE-2024-5405 State: PUBLISHED Published: 2024-05-27T11:50:02.232Z Last Updated: 2024-08-01T21:11:12.613Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L) Vendors: Wtriple Products: WinNMP Problem Types: CWE-79 Description: A vulnerability had been discovered in WinNMP 19.02 consisting of an XSS attack via /tools/redis.php page in the k, hash, key and p parameters. This vulnerability could allow a remote user to submit a specially crafted JavaScript payload for an authenticated user to retrieve their session details. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/mult
- CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-winnmp-wtriple
CVE ID: CVE-2024-5406 State: PUBLISHED Published: 2024-05-27T11:50:55.482Z Last Updated: 2024-08-01T21:11:12.713Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L) Vendors: Wtriple Products: WinNMP Problem Types: CWE-79 Description: A vulnerability had been discovered in WinNMP 19.02 consisting of an XSS attack via index page in from, subject, text and hash parameters. This vulnerability could allow a remote user to send a specially crafted query to an authenticated user and steal their session details. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-wi
t: - CVE Program Container: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-winnmp-wtriple
CVE ID: CVE-2024-5407 State: PUBLISHED Published: 2024-05-27T12:13:55.114Z Last Updated: 2024-08-01T21:11:12.773Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: SaltOS Products: RhinOS Problem Types: CWE-94 Description: A vulnerability in RhinOS 3.0-1190 could allow PHP code injection through the "search" parameter in /portal/search.htm. This vulnerability could allow a remote attacker to perform a reverse shell on the remote system, compromising the entire infrastructure. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-rhinos-saltos - http
ontainer: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-rhinos-saltos - https://github.com/josepsanzcamp/RhinOS
CVE ID: CVE-2024-5408 State: PUBLISHED Published: 2024-05-27T12:16:52.088Z Last Updated: 2024-08-01T21:11:12.804Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: SaltOS Products: RhinOS Problem Types: CWE-79 Description: Vulnerability in RhinOS 3.0-1190 consisting of an XSS through the "search" parameter of /portal/search.htm. This vulnerability could allow a remote attacker to steal details of a victim's user session by submitting a specially crafted URL. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-rhinos-saltos - https://github.com/joseps
- https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-rhinos-saltos - https://github.com/josepsanzcamp/RhinOS
CVE ID: CVE-2024-5409 State: PUBLISHED Published: 2024-05-27T12:17:41.451Z Last Updated: 2024-08-01T21:11:12.697Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: SaltOS Products: RhinOS Problem Types: CWE-79 Description: RhinOS 3.0-1190 is vulnerable to an XSS via the "tamper" parameter in /admin/lib/phpthumb/phpthumb.php. An attacker could create a malicious URL and send it to a victim to obtain their session details. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-rhinos-saltos - https://github.com/josepsanzcamp/RhinOS
CVE ID: CVE-2024-5410 State: PUBLISHED Published: 2024-05-28T10:23:16.991Z Last Updated: 2025-02-13T17:54:08.981Z Vendors: ORing Products: IAP-420 Problem Types: CWE-79 Description: Missing input validation in the ORing IAP-420 web-interface allows stored Cross-Site Scripting (XSS).This issue affects IAP-420 version 2.01e and below. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://cyberdanube.com/en/en-multiple-vulnerabilities-in-oring-iap420/ - http://seclists.org/fulldisclosure/2024/May/36
CVE ID: CVE-2024-5411 State: PUBLISHED Published: 2024-05-28T10:28:51.246Z Last Updated: 2025-10-08T09:14:56.574Z Vendors: ORing Products: IAP-420 Problem Types: CWE-78 Description: Missing input validation and OS command integration of the input in the ORing IAP-420 web-interface allows authenticated command injection.This issue affects IAP-420 version 2.01e and below. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://cyberdanube.com/en/en-multiple-vulnerabilities-in-oring-iap420/ - http://seclists.org/fulldisclosure/2024/May/36
CVE ID: CVE-2024-5412 State: PUBLISHED Published: 2024-09-03T01:18:40.444Z Last Updated: 2024-09-03T14:10:55.771Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Zyxel Products: VMG8825-T50K firmware Problem Types: CWE-120 Description: A buffer overflow vulnerability in the library "libclinkc" of the Zyxel VMG8825-T50K firmware version 5.50(ABOM.8)C0 could allow an unauthenticated attacker to cause denial of service (DoS) conditions by sending a crafted HTTP request to a vulnerable device. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-buffer-overflow-vuln
ferences: - https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-buffer-overflow-vulnerability-in-some-5g-nr-cpe-dsl-ethernet-cpe-fiber-ont-wifi-extender-and-security-router-devices-09-03-2024
CVE ID: CVE-2024-5413 State: PUBLISHED Published: 2024-05-28T12:21:40.642Z Last Updated: 2024-08-01T21:11:12.746Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: PhpMyBackupPro Products: PhpMyBackupPro Problem Types: CWE-79 Description: A vulnerability have been discovered in PhpMyBackupPro affecting version 2.3 that could allow an attacker to execute XSS through /phpmybackuppro/scheduled.php, all parameters. This vulnerabilities could allow an attacker to create a specially crafted URL and send it to a victim to retrieve their session details. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.incibe.es/en/in
s. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/cross-site-scripting-vulnerability-phpmybackuppro
CVE ID: CVE-2024-5414 State: PUBLISHED Published: 2024-05-28T12:22:02.463Z Last Updated: 2024-08-01T21:11:12.741Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: PhpMyBackupPro Products: PhpMyBackupPro Problem Types: CWE-79 Description: A vulnerability have been discovered in PhpMyBackupPro affecting version 2.3 that could allow an attacker to execute XSS through /phpmybackuppro/get_file.php, 'view' parameter. This vulnerabilities could allow an attacker to create a specially crafted URL and send it to a victim to retrieve their session details. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.incibe.es/en/i
ls. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/cross-site-scripting-vulnerability-phpmybackuppro
CVE ID: CVE-2024-5415 State: PUBLISHED Published: 2024-05-28T12:22:19.808Z Last Updated: 2024-08-01T21:11:12.765Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: PhpMyBackupPro Products: PhpMyBackupPro Problem Types: CWE-79 Description: A vulnerability have been discovered in PhpMyBackupPro affecting version 2.3 that could allow an attacker to execute XSS through /phpmybackuppro/backup.php, 'comments' and 'db' parameters. This vulnerabilities could allow an attacker to create a specially crafted URL and send it to a victim to retrieve their session details. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.in
ession details. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/cross-site-scripting-vulnerability-phpmybackuppro
CVE ID: CVE-2024-5416 State: PUBLISHED Published: 2024-09-11T11:32:03.195Z Last Updated: 2024-09-11T13:14:24.949Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: elemntor Products: Elementor Website Builder – More than Just a Page Builder Problem Types: CWE-79 Description: The Elementor Website Builder – More than Just a Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the url parameter of multiple widgets in all versions up to, and including, 3.23.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and abo
g on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in Elementor Editor pages. This was partially patched in version 3.23.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/a99a64f7-1ea8-4de6-b24f-1f69bf25c1f5?source=cve - https://plugins.trac.wordpress.org/browser/elementor/tags/3.21.8/includes/widgets/traits/button-trait.php#L523 - https://plugins.trac.wordpress.org/browser/elementor/tags/3.21.8/includes/widgets/image.php#L820 - https://plugins.trac.wordpress.org/browser/elementor/tags/3.21.8/includes/widgets/soci
includes/widgets/image.php#L820 - https://plugins.trac.wordpress.org/browser/elementor/tags/3.21.8/includes/widgets/social-icons.php#L659 - https://plugins.trac.wordpress.org/browser/elementor/tags/3.21.8/includes/widgets/testimonial.php#L608 - https://plugins.trac.wordpress.org/changeset/3123936 - https://plugins.trac.wordpress.org/changeset/3149264/
CVE ID: CVE-2024-5417 State: PUBLISHED Published: 2024-08-29T06:00:02.726Z Last Updated: 2024-08-29T14:03:28.662Z Vendors: Unknown Products: Gutentor Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Gutentor WordPress plugin before 3.3.6 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/fb7d6839-9ccb-4a0f-9dca-d6841f666a1b/
CVE ID: CVE-2024-5418 State: PUBLISHED Published: 2024-05-31T02:41:08.761Z Last Updated: 2024-08-01T21:11:12.717Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: detheme Products: DethemeKit For Elementor Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The DethemeKit For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'slitems' attribute within the plugin's De Product Tab & Slide widget in all versions up to, and including, 2.1.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authentic
to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/19bdbde1-1414-4113-890e-b6c96b8a6e11?source=cve - https://plugins.trac.wordpress.org/browser/dethemekit-for-elementor/tags/2.1.4/widgets/de-product-tab-slide.php#L1617 - https://plugins.trac.wordpress.org/browser/dethemekit-for-elementor/tags/2.1.0/widgets/de-product-tab-s
lide.php#L1617 - https://plugins.trac.wordpress.org/browser/dethemekit-for-elementor/tags/2.1.0/widgets/de-product-tab-slide.php#L1619 - https://wordpress.org/plugins/dethemekit-for-elementor/#developers - https://plugins.trac.wordpress.org/changeset/3094885/
CVE ID: CVE-2024-5419 State: PUBLISHED Published: 2024-07-02T03:14:52.242Z Last Updated: 2024-08-01T21:11:12.792Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: voidthemes Products: Void Contact Form 7 Widget For Elementor Page Builder Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Void Contact Form 7 Widget For Elementor Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'cf7_redirect_page' attribute within the plugin's Void Contact From 7 widget in all versions up to, and including, 2.4 due to insufficient input sanitization and output escaping
ntact From 7 widget in all versions up to, and including, 2.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/2837c9b2-419e-453a-b011-5ec1ef050d62?source=cve - https://plugins.trac.wordpress.org/browser/cf7-widget-elementor/tags/2.4/widgets/void-section-cf7.php#L1672 - https://plugins.trac.wordpress.org/changeset/31
owser/cf7-widget-elementor/tags/2.4/widgets/void-section-cf7.php#L1672 - https://plugins.trac.wordpress.org/changeset/3109802/#file6
CVE ID: CVE-2024-5420 State: PUBLISHED Published: 2024-06-04T07:48:27.789Z Last Updated: 2025-10-08T09:23:18.086Z Vendors: SEH Computertechnik Products: utnserver Pro, utnserver ProMAX, INU-100 Problem Types: CWE-79 Description: Missing input validation in the SEH Computertechnik utnserver Pro, SEH Computertechnik utnserver ProMAX, SEH Computertechnik INU-100 web-interface allows stored Cross-Site Scripting (XSS)..This issue affects utnserver Pro, utnserver ProMAX, INU-100 version 20.1.22 and below. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://cyberdanube.com/security-research/multiple-vulnerabilities-in-seh-untserver-pro/ - http://seclist
References: - https://cyberdanube.com/security-research/multiple-vulnerabilities-in-seh-untserver-pro/ - http://seclists.org/fulldisclosure/2024/Jun/4
CVE ID: CVE-2024-5421 State: PUBLISHED Published: 2024-06-04T07:58:50.389Z Last Updated: 2025-02-13T17:54:14.183Z Vendors: SEH Computertechnik Products: utnserver Pro, utnserver ProMAX, INU-100 Problem Types: CWE-78 Description: Missing input validation and OS command integration of the input in the utnserver Pro, utnserver ProMAX, INU-100 web-interface allows authenticated command injection.This issue affects utnserver Pro, utnserver ProMAX, INU-100 version 20.1.22 and below. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://cyberdanube.com/en/en-multiple-vulnerabilities-in-seh-untserver-pro/index.html - http://seclists.org/fulldisclosure/2024
cyberdanube.com/en/en-multiple-vulnerabilities-in-seh-untserver-pro/index.html - http://seclists.org/fulldisclosure/2024/Jun/4
CVE ID: CVE-2024-5422 State: PUBLISHED Published: 2024-06-04T08:06:45.294Z Last Updated: 2025-02-13T17:54:14.807Z Vendors: SEH Computertechnik Products: utnserver Pro, utnserver ProMAX, INU-100 Problem Types: CWE-400 Description: An uncontrolled resource consumption of file descriptors in SEH Computertechnik utnserver Pro, SEH Computertechnik utnserver ProMAX, SEH Computertechnik INU-100 allows DoS via HTTP.This issue affects utnserver Pro, utnserver ProMAX, INU-100 version 20.1.22 and below. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://cyberdanube.com/en/en-multiple-vulnerabilities-in-seh-untserver-pro/index.html - http://seclists.org/ful
nces: - https://cyberdanube.com/en/en-multiple-vulnerabilities-in-seh-untserver-pro/index.html - http://seclists.org/fulldisclosure/2024/Jun/4
CVE ID: CVE-2024-5423 State: PUBLISHED Published: 2024-08-08T10:31:02.871Z Last Updated: 2024-08-29T15:04:59.365Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: GitLab Products: GitLab Problem Types: CWE-400 Description: Multiple Denial of Service (DoS) conditions has been discovered in GitLab CE/EE affecting all versions starting from 1.0 prior to 17.0.6, starting from 17.1 prior to 17.1.4, and starting from 17.2 prior to 17.2.2 which allowed an attacker to cause resource exhaustion via banzai pipeline. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/463807 - https://hackerone.com/reports/25185
P Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/463807 - https://hackerone.com/reports/2518563
CVE ID: CVE-2024-5424 State: PUBLISHED Published: 2024-06-28T08:33:28.105Z Last Updated: 2024-08-01T21:11:12.868Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: gallerycreator Products: Gallery Blocks with Lightbox. Image Gallery, (HTML5 video , YouTube, Vimeo) Video Gallery and Lightbox for native gallery Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Gallery Blocks with Lightbox. Image Gallery, (HTML5 video , YouTube, Vimeo) Video Gallery and Lightbox for native gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘galleryID’ and 'className' parameter