Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-34472 State: PUBLISHED Published: 2024-05-06T00:00:00 Last Updated: 2024-08-02T02:51:11.481Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in HSC Mailinspector 5.2.17-3 through v.5.2.18. An authenticated blind SQL injection vulnerability exists in the mliRealtimeEmails.php file. The ordemGrid parameter in a POST request to /mailinspector/mliRealtimeEmails.php does not properly sanitize input, allowing an authenticated attacker to execute arbitrary SQL commands, leading to the potential disclosure of the entire application database. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com
n database. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/osvaldotenorio/CVE-2024-34472
CVE ID: CVE-2024-34473 State: PUBLISHED Published: 2024-05-04T00:00:00.000Z Last Updated: 2025-03-27T15:02:08.012Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in appmgr in O-RAN Near-RT RIC I-Release. An attacker could register an unintended RMR message type during xApp registration to disrupt other service components. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://jira.o-ran-sc.org/browse/RIC-1055
CVE ID: CVE-2024-34474 State: PUBLISHED Published: 2024-05-05T00:00:00 Last Updated: 2024-08-21T19:36:27.445Z Vendors: n/a Products: n/a Problem Types: n/a Description: Clario through 2024-04-11 for Desktop has weak permissions for %PROGRAMDATA%\Clario and tries to load DLLs from there as SYSTEM. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://clario.co/download/ - https://github.com/Alaatk/CVE-2024-34474
CVE ID: CVE-2024-34475 State: PUBLISHED Published: 2024-05-04T00:00:00 Last Updated: 2024-08-02T02:51:11.513Z Vendors: n/a Products: n/a Problem Types: n/a Description: Open5GS before 2.7.1 is vulnerable to a reachable assertion that can cause an AMF crash via NAS messages from a UE: gmm_state_authentication in amf/gmm-sm.c for != OGS_ERROR. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/open5gs/open5gs/pull/3122 - https://github.com/open5gs/open5gs/compare/v2.7.0...v2.7.1
CVE ID: CVE-2024-34476 State: PUBLISHED Published: 2024-05-04T00:00:00 Last Updated: 2024-08-02T02:51:11.588Z Vendors: n/a Products: n/a Problem Types: n/a Description: Open5GS before 2.7.1 is vulnerable to a reachable assertion that can cause an AMF crash via NAS messages from a UE: ogs_nas_encrypt in lib/nas/common/security.c for pkbuf->len. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/open5gs/open5gs/pull/3122 - https://github.com/open5gs/open5gs/compare/v2.7.0...v2.7.1
CVE ID: CVE-2024-34477 State: PUBLISHED Published: 2024-05-27T14:00:07.313Z Last Updated: 2025-02-13T15:53:26.010Z Vendors: n/a Products: n/a Problem Types: n/a Description: configureNFS in lib/common/functions.sh in FOG through 1.5.10 allows local users to gain privileges by mounting a crafted NFS share (because of no_root_squash and insecure). In order to exploit the vulnerability, someone needs to mount an NFS share in order to add an executable file as root. In addition, the SUID bit must be added to this file. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/FOGProject/fogproject/blob/a4bb1bf39ac53c3cbe623576915fbc3b5c80a00f/li
DP Vulnrichment: References: - https://github.com/FOGProject/fogproject/blob/a4bb1bf39ac53c3cbe623576915fbc3b5c80a00f/lib/common/functions.sh#L1360 - https://forums.fogproject.org/topic/17486/fog-1-5-10-and-earlier-nfs-privilege-escalation-vulnerability - https://blog.hackvens.fr/advisories/CVE-2024-34477-Fogproject.html
CVE ID: CVE-2024-34478 State: PUBLISHED Published: 2024-05-05T00:00:00 Last Updated: 2024-08-07T15:03:11.041Z Vendors: n/a Products: n/a Problem Types: n/a Description: btcd before 0.24.0 does not correctly implement the consensus rules outlined in BIP 68 and BIP 112, making it susceptible to consensus failures. Specifically, it uses the transaction version as a signed integer when it is supposed to be treated as unsigned. There can be a chain split and loss of funds. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://delvingbitcoin.org/t/disclosure-btcd-consensus-bugs-due-to-usage-of-signed-transaction-version/455 - https://github.com/btcsuite/
tcoin.org/t/disclosure-btcd-consensus-bugs-due-to-usage-of-signed-transaction-version/455 - https://github.com/btcsuite/btcd/blob/e4c88c3a3ecb1813529bf3dddc7a865bd418a6b8/blockchain/chain.go#L383C1-L392C3 - https://github.com/btcsuite/btcd/blob/e4c88c3a3ecb1813529bf3dddc7a865bd418a6b8/txscript/opcode.go#L1172C1-L1178C3
CVE ID: CVE-2024-34479 State: PUBLISHED Published: 2024-08-07T00:00:00 Last Updated: 2024-08-07T20:00:40.823Z Vendors: n/a Products: n/a Problem Types: n/a Description: SourceCodester Computer Laboratory Management System 1.0 allows classes/Master.php id SQL Injection. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cxsecurity.com/issue/WLB-2024080004
CVE ID: CVE-2024-34480 State: PUBLISHED Published: 2024-08-07T00:00:00 Last Updated: 2024-08-08T14:35:13.249Z Vendors: n/a Products: n/a Problem Types: n/a Description: SourceCodester Computer Laboratory Management System 1.0 allows admin/category/view_category.php id SQL Injection. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cxsecurity.com/issue/WLB-2024080003
CVE ID: CVE-2024-34481 State: PUBLISHED Published: 2024-07-05T00:00:00.000Z Last Updated: 2025-11-04T17:20:44.029Z Vendors: n/a Products: n/a Problem Types: n/a Description: drupal-wiki.com Drupal Wiki before 8.31.1 allows XSS via comments, captions, and image titles of a Wiki page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.secuvera.de/advisories/secuvera-SA-2024-02.txt - https://drupal-wiki.com/drupal-wiki-update-8-31/ - https://seclists.org/fulldisclosure/2024/May/4
CVE ID: CVE-2024-34483 State: PUBLISHED Published: 2024-05-05T00:00:00 Last Updated: 2024-08-02T02:51:11.473Z Vendors: n/a Products: n/a Problem Types: n/a Description: OFPGroupDescStats in parser.py in Faucet SDN Ryu 4.34 allows attackers to cause a denial of service (infinite loop) via OFPBucket.len=0. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/faucetsdn/ryu/issues/193
CVE ID: CVE-2024-34484 State: PUBLISHED Published: 2024-05-05T00:00:00 Last Updated: 2024-11-20T21:25:55.338Z Vendors: n/a Products: n/a Problem Types: n/a Description: OFPBucket in parser.py in Faucet SDN Ryu 4.34 allows attackers to cause a denial of service (infinite loop) via action.len=0. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/faucetsdn/ryu/issues/194
CVE ID: CVE-2024-34486 State: PUBLISHED Published: 2024-05-05T00:00:00 Last Updated: 2024-08-02T02:51:11.465Z Vendors: n/a Products: n/a Problem Types: n/a Description: OFPPacketQueue in parser.py in Faucet SDN Ryu 4.34 allows attackers to cause a denial of service (infinite loop) via OFPQueueProp.len=0. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/faucetsdn/ryu/issues/190
CVE ID: CVE-2024-34487 State: PUBLISHED Published: 2024-05-05T00:00:00 Last Updated: 2024-11-20T16:18:27.334Z Vendors: n/a Products: n/a Problem Types: n/a Description: OFPFlowStats in parser.py in Faucet SDN Ryu 4.34 allows attackers to cause a denial of service (infinite loop) via inst.length=0. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/faucetsdn/ryu/issues/192
CVE ID: CVE-2024-34488 State: PUBLISHED Published: 2024-05-05T00:00:00 Last Updated: 2024-08-02T02:51:11.518Z Vendors: n/a Products: n/a Problem Types: n/a Description: OFPMultipartReply in parser.py in Faucet SDN Ryu 4.34 allows attackers to cause a denial of service (infinite loop) via b.length=0. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/faucetsdn/ryu/issues/191
CVE ID: CVE-2024-34489 State: PUBLISHED Published: 2024-05-05T00:00:00 Last Updated: 2024-08-02T02:51:11.649Z Vendors: n/a Products: n/a Problem Types: n/a Description: OFPHello in parser.py in Faucet SDN Ryu 4.34 allows attackers to cause a denial of service (infinite loop) via length=0. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/faucetsdn/ryu/issues/195
CVE ID: CVE-2024-34490 State: PUBLISHED Published: 2024-05-05T00:00:00 Last Updated: 2024-08-02T02:51:11.574Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Maxima through 5.47.0 before 51704c, the plotting facilities make use of predictable names under /tmp. Thus, the contents may be controlled by a local attacker who can create files in advance with these names. This affects, for example, plot2d. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://sourceforge.net/p/maxima/bugs/3755/
CVE ID: CVE-2024-34500 State: PUBLISHED Published: 2024-05-05T00:00:00.000Z Last Updated: 2025-11-04T17:20:45.386Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the UnlinkedWikibase extension in MediaWiki before 1.39.6, 1.40.x before 1.40.2, and 1.41.x before 1.41.1. XSS can occur through an interface message. Error messages (in the $err var) are not escaped before being passed to Html::rawElement() in the getError() function in the Hooks class. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://phabricator.wikimedia.org/T357203 - https://gerrit.wikimedia.org/r/c/mediawiki/extensions/UnlinkedWikibase/+/100
https://phabricator.wikimedia.org/T357203 - https://gerrit.wikimedia.org/r/c/mediawiki/extensions/UnlinkedWikibase/+/1002175 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FU2FGUXXK6TMV6R52VRECLC6XCSQQISY/
CVE ID: CVE-2024-34502 State: PUBLISHED Published: 2024-05-05T00:00:00.000Z Last Updated: 2025-11-04T17:20:46.748Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in WikibaseLexeme in MediaWiki before 1.39.6, 1.40.x before 1.40.2, and 1.41.x before 1.41.1. Loading Special:MergeLexemes will (attempt to) make an edit that merges the from-id to the to-id, even if the request was not a POST request, and even if it does not contain an edit token. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://phabricator.wikimedia.org/T357101 - https://gerrit.wikimedia.org/r/c/mediawiki/extensions/WikibaseLexeme/+/1013359 - http
habricator.wikimedia.org/T357101 - https://gerrit.wikimedia.org/r/c/mediawiki/extensions/WikibaseLexeme/+/1013359 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FU2FGUXXK6TMV6R52VRECLC6XCSQQISY/
CVE ID: CVE-2024-34506 State: PUBLISHED Published: 2024-05-05T00:00:00.000Z Last Updated: 2025-11-04T17:20:48.114Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in includes/specials/SpecialMovePage.php in MediaWiki before 1.39.7, 1.40.x before 1.40.3, and 1.41.x before 1.41.1. If a user with the necessary rights to move the page opens Special:MovePage for a page with tens of thousands of subpages, then the page will exceed the maximum request time, leading to a denial of service. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://phabricator.wikimedia.org/T357760 - https://lists.fedoraproject.org/archives/lis
rogram Container: References: - https://phabricator.wikimedia.org/T357760 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FU2FGUXXK6TMV6R52VRECLC6XCSQQISY/
CVE ID: CVE-2024-34507 State: PUBLISHED Published: 2024-05-05T00:00:00.000Z Last Updated: 2025-11-04T17:20:49.491Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in includes/CommentFormatter/CommentParser.php in MediaWiki before 1.39.7, 1.40.x before 1.40.3, and 1.41.x before 1.41.1. XSS can occur because of mishandling of the 0x1b character, as demonstrated by Special:RecentChanges#%1b0000000. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://phabricator.wikimedia.org/T355538 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FU2FGUXXK6TMV6R52VRECLC6XCSQQISY/
CVE ID: CVE-2024-34508 State: PUBLISHED Published: 2024-05-05T00:00:00.000Z Last Updated: 2025-11-03T20:37:30.046Z Vendors: n/a Products: n/a Problem Types: n/a Description: dcmnet in DCMTK before 3.6.9 has a segmentation fault via an invalid DIMSE message. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://support.dcmtk.org/redmine/issues/1114 - https://github.com/DCMTK/dcmtk/commit/c78e434c0c5f9d932874f0b17a8b4ce305ca01f5 - https://lists.debian.org/debian-lts-announce/2024/06/msg00022.html
CVE ID: CVE-2024-34509 State: PUBLISHED Published: 2024-05-05T00:00:00.000Z Last Updated: 2025-11-03T20:37:31.559Z Vendors: n/a Products: n/a Problem Types: n/a Description: dcmdata in DCMTK before 3.6.9 has a segmentation fault via an invalid DIMSE message. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://support.dcmtk.org/redmine/issues/1114 - https://github.com/DCMTK/dcmtk/commit/c78e434c0c5f9d932874f0b17a8b4ce305ca01f5 - https://lists.debian.org/debian-lts-announce/2024/06/msg00022.html
CVE ID: CVE-2024-34510 State: PUBLISHED Published: 2024-05-05T00:00:00 Last Updated: 2024-11-19T21:37:27.401Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AC:L/AV:N/A:N/C:H/I:N/PR:N/S:U/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: Gradio before 4.20 allows credential leakage on Windows. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/gradio-app/gradio/ - https://www.gradio.app/changelog#4-20-0
CVE ID: CVE-2024-34511 State: REJECTED Published: 2024-05-05T00:00:00 Last Updated: 2024-05-10T14:29:12.747226 Description: No description available.
CVE ID: CVE-2024-34515 State: PUBLISHED Published: 2024-05-05T00:00:00 Last Updated: 2024-08-21T17:04:46.011Z Vendors: n/a Products: n/a Problem Types: n/a Description: image-optimizer before 1.7.3 allows PHAR deserialization, e.g., the phar:// protocol in arguments to file_exists(). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/spatie/image-optimizer/issues/210 - https://github.com/spatie/image-optimizer/compare/1.7.2...1.7.3 - https://github.com/spatie/image-optimizer/pull/211
CVE ID: CVE-2024-34517 State: PUBLISHED Published: 2024-05-07T00:00:00.000Z Last Updated: 2025-07-23T03:55:32.171Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N) Vendors: Neo4j Products: Neo4j Problem Types: CWE-471 Description: The Cypher component in Neo4j 5.0.0 through 5.18 mishandles IMMUTABLE privileges in some situations where an attacker already has admin access. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://trust.neo4j.com - https://neo4j.com/security/cve-2024-34517/ - https://github.com/neo4j/neo4j/wiki/Neo4j-5-changelog#cypher - https://github.com/advisories/GHSA-p343-9qwp-pqxv
CVE ID: CVE-2024-34519 State: PUBLISHED Published: 2024-05-05T00:00:00 Last Updated: 2024-08-02T02:51:11.474Z Vendors: n/a Products: n/a Problem Types: n/a Description: Avantra Server 24.x before 24.0.7 and 24.1.x before 24.1.1 mishandles the security of dashboards, aka XAN-5367. If a user can create a dashboard with an auto-login user, data disclosure may occur. Access control can be bypassed when there is a shared dashboard, and its auto-login user has privileges that a dashboard visitor should not have. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://docs.avantra.com/release-notes/24/changes.html - https://support.avantra.com/support/solut
tainer: References: - https://docs.avantra.com/release-notes/24/changes.html - https://support.avantra.com/support/solutions/articles/44002516766-xan-5367-security-vulnerability-fix-for-dashboards
CVE ID: CVE-2024-34520 State: PUBLISHED Published: 2025-02-12T00:00:00.000Z Last Updated: 2025-02-13T20:19:03.031Z Vendors: n/a Products: n/a Problem Types: n/a Description: An authorization bypass vulnerability exists in the Mavenir SCE Application Provisioning Portal, version PORTAL-LBS-R_1_0_24_0, which allows an authenticated 'guest' user to perform unauthorized administrative actions, such as accessing the 'add user' feature, by bypassing client-side access controls. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/whitewhale-dmb/Vulnerability-Research/tree/main/CVE-2024-34520
CVE ID: CVE-2024-34521 State: PUBLISHED Published: 2025-02-12T00:00:00.000Z Last Updated: 2025-02-20T19:21:12.157Z Vendors: n/a Products: n/a Problem Types: n/a Description: A directory traversal vulnerability exists in the Mavenir SCE Application Provisioning Portal, version PORTAL-LBS-R_1_0_24_0, which allows an administrative user to access system files with the file permissions of the privileged system user running the application. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/whitewhale-dmb/Vulnerability-Research/tree/main/CVE-2024-34521
CVE ID: CVE-2024-34523 State: PUBLISHED Published: 2024-05-07T00:00:00 Last Updated: 2024-08-02T02:51:11.576Z Vendors: n/a Products: n/a Problem Types: n/a Description: AChecker 1.5 allows remote attackers to read the contents of arbitrary files via the download.php path parameter by using Unauthenticated Path Traversal. This occurs through readfile in PHP. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/inclusive-design/AChecker/blob/main/checker/download.php - https://github.com/piuppi/Proof-of-Concepts/blob/main/AChecker/CVE-2024-34523
/AChecker/blob/main/checker/download.php - https://github.com/piuppi/Proof-of-Concepts/blob/main/AChecker/CVE-2024-34523.md
CVE ID: CVE-2024-34524 State: PUBLISHED Published: 2024-05-05T00:00:00 Last Updated: 2024-08-02T02:59:20.793Z Vendors: n/a Products: n/a Problem Types: n/a Description: In XLANG OpenAgents through fe73ac4, the allowed_file protection mechanism can be bypassed by using an incorrect file extension for the nature of the file content. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/xlang-ai/OpenAgents/issues/112 - https://github.com/xlang-ai/OpenAgents/blob/880e26adfe380e999962fc645fc8fc80bd72f103/backend/utils/utils.py#L31
CVE ID: CVE-2024-34525 State: PUBLISHED Published: 2024-05-05T00:00:00 Last Updated: 2024-08-02T02:59:20.776Z Vendors: n/a Products: n/a Problem Types: n/a Description: FileCodeBox 2.0 stores a OneDrive password and AWS key in a cleartext env file. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/vastsa/FileCodeBox/issues/133
CVE ID: CVE-2024-34527 State: PUBLISHED Published: 2024-05-05T00:00:00 Last Updated: 2024-08-22T17:16:28.345Z Vendors: n/a Products: n/a Problem Types: n/a Description: spaces_plugin/app.py in SolidUI 0.4.0 has an unnecessary print statement for an OpenAI key. The printed string might be logged. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/CloudOrc/SolidUI/issues/279 - https://github.com/CloudOrc/SolidUI/blob/00d96b53bd0acf082996cef45b0f292eaba22fb7/solidui/spaces_plugin/app.py#L77
CVE ID: CVE-2024-34528 State: PUBLISHED Published: 2024-05-05T00:00:00 Last Updated: 2024-11-01T18:43:19.803Z Vendors: n/a Products: n/a Problem Types: n/a Description: WordOps through 3.20.0 has a wo/cli/plugins/stack_pref.py TOCTOU race condition because the conf_path os.open does not use a mode parameter during file creation. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/WordOps/WordOps/issues/611 - https://github.com/WordOps/WordOps/blob/ecf20192c7853925e2cb3f8c8378cd0d86ca0d62/wo/cli/plugins/stack_pref.py#L77
CVE ID: CVE-2024-34529 State: PUBLISHED Published: 2024-05-05T00:00:00.000Z Last Updated: 2025-03-26T16:15:56.276Z Vendors: n/a Products: n/a Problem Types: n/a Description: Nebari through 2024.4.1 prints the temporary Keycloak root password. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/nebari-dev/nebari/issues/2282 - https://github.com/nebari-dev/nebari/blob/5463e8df9e8d53a266a7b9d3d4e27353ec43c40b/src/_nebari/deploy.py#L71
CVE ID: CVE-2024-34532 State: PUBLISHED Published: 2024-05-06T00:00:00 Last Updated: 2024-08-02T02:59:20.971Z Vendors: n/a Products: n/a Problem Types: n/a Description: A SQL injection vulnerability in Yvan Dotet PostgreSQL Query Deluxe module (aka query_deluxe) 17.x before 17.0.0.4 allows a remote attacker to gain privileges via the query parameter to models/querydeluxe.py:QueryDeluxe::get_result_from_query. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/luvsn/OdZoo/tree/main/exploits/query_deluxe
CVE ID: CVE-2024-34533 State: PUBLISHED Published: 2024-05-06T00:00:00 Last Updated: 2024-08-02T02:59:20.973Z Vendors: n/a Products: n/a Problem Types: n/a Description: A SQL injection vulnerability in ZI PT Solusi Usaha Mudah Analytic Data Query module (aka izi_data) 11.0 through 17.x before 17.0.3 allows a remote attacker to gain privileges via a query to IZITools::query_check, IZITools::query_fetch, or IZITools::query_execute. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/luvsn/OdZoo/tree/main/exploits/izi_data
CVE ID: CVE-2024-34534 State: PUBLISHED Published: 2024-05-06T00:00:00 Last Updated: 2024-08-02T02:59:20.782Z Vendors: n/a Products: n/a Problem Types: n/a Description: A SQL injection vulnerability in Cybrosys Techno Solutions Text Commander module (aka text_commander) 16.0 through 16.0.1 allows a remote attacker to gain privileges via the data parameter to models/ir_model.py:IrModel::chech_model. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/luvsn/OdZoo/tree/main/exploits/text_commander
CVE ID: CVE-2024-34535 State: PUBLISHED Published: 2024-10-03T00:00:00 Last Updated: 2024-11-25T18:01:21.080Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Mastodon 4.1.6, API endpoint rate limiting can be bypassed by setting a crafted HTTP request header. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/mastodon/mastodon/tags - https://github.com/mastodon/mastodon/security/advisories/GHSA-q3rg-xx5v-4mxh
CVE ID: CVE-2024-34537 State: PUBLISHED Published: 2024-10-28T00:00:00 Last Updated: 2024-10-31T16:35:30.213028 Vendors: n/a Products: n/a Problem Types: n/a Description: TYPO3 before 13.3.1 allows denial of service (interface error) in the Bookmark Toolbar (ext:backend), exploitable by an administrator-level backend user account via manipulated data saved in the bookmark toolbar of the backend user interface. The fixed versions are 10.4.46 ELTS, 11.5.40 LTS, 12.4.21 LTS, and 13.3.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/TYPO3/typo3/security/advisories/GHSA-ffcv-v6pw-qhrp - https://typo3.org/security/advisory/typo3-core-sa-2024-011 - https://www.
ypo3/security/advisories/GHSA-ffcv-v6pw-qhrp - https://typo3.org/security/advisory/typo3-core-sa-2024-011 - https://www.mgm-sp.com/cve/denial-of-service-in-typo3-bookmark-toolbar