Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
es of image is SVG, which allows JS scripting. Therefore, by uploading a malicious SVG which contains JS code, an attacker which is able to drive a victim to the uploaded image could compromise that victim's session and access to their tokens. Version 5.4.1 contains a patch for the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Bubka/2FAuth/security/advisories/GHSA-q5p4-6q4v-gqg3 - https://github.com/Bubka/2FAuth/commit/93c508e118f483f3c93ac36e1f91face95af642d
CVE ID: CVE-2024-52598 State: PUBLISHED Published: 2024-11-20T14:09:45.400Z Last Updated: 2024-11-20T14:28:57.571Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Bubka Products: 2FAuth Problem Types: CWE-79, CWE-80, CWE-918 Description: 2FAuth is a web app to manage Two-Factor Authentication (2FA) accounts and generate their security codes. Two interconnected vulnerabilities exist in version 5.4.1 a SSRF and URI validation bypass issue. The endpoint at POST /api/v1/twofaccounts/preview allows setting a remote URI to retrieve the image of a 2fa site. By abusing this functionality, it is possible to force the application to make a GET request to an arbitrary UR
fa site. By abusing this functionality, it is possible to force the application to make a GET request to an arbitrary URL, whose content will be stored in an image file in the server if it looks like an image. Additionally, the library does some basic validation on the URI, attempting to filter our URIs which do not have an image extension. However, this can be easily bypassed by appending the string `#.svg` to the URI. The combination of these two issues allows an attacker to retrieve URIs accessible from the application, as long as their content type is text based. If not, the request is still sent, but the response is not reflected to the attacker. Version 5.4.1 fixes the issues. Addition
, the request is still sent, but the response is not reflected to the attacker. Version 5.4.1 fixes the issues. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Bubka/2FAuth/security/advisories/GHSA-xwxc-w7v3-2p4j
CVE ID: CVE-2024-52599 State: PUBLISHED Published: 2024-12-09T18:41:35.060Z Last Updated: 2024-12-10T16:17:35.774Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: Enalean Products: tuleap Problem Types: CWE-79 Description: Tuleap is an open source suite to improve management of software developments and collaboration. In Tuleap Community Edition prior to version 16.1.99.50 and Tuleap Enterprise Edition prior to versions 16.1-4 and 16.0-7, a malicious user with the ability to create an artifact in a tracker with a Gantt chart could force a victim to execute uncontrolled code. Tuleap Community Edition 16.1.99.50, Tuleap Enterprise Edition 16.1-4, and Tuleap En
ictim to execute uncontrolled code. Tuleap Community Edition 16.1.99.50, Tuleap Enterprise Edition 16.1-4, and Tuleap Enterprise Edition 16.0-7 contain a fix. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Enalean/tuleap/security/advisories/GHSA-489c-fm2j-qjw7 - https://github.com/Enalean/tuleap/commit/d3686ab152b6f64ff835e7dd3c99d97b36a9d4d5 - https://tuleap.net/plugins/git/tuleap/tuleap/stable?a=commit&h=d3686ab152b6f64ff835e7dd3c99d97b36a9d4d5 - https://tuleap.net/plugins/tracker/?aid=40459
CVE ID: CVE-2024-52600 State: PUBLISHED Published: 2024-11-19T16:30:12.221Z Last Updated: 2024-12-03T17:18:17.282Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: statamic Products: cms Problem Types: CWE-22 Description: Statmatic is a Laravel and Git powered content management system (CMS). Prior to version 5.17.0, assets uploaded with appropriately crafted filenames may result in them being placed in a location different than what was configured. The issue affects front-end forms with `assets` fields and other places where assets can be uploaded, although users would need upload permissions anyway. Files can be uploaded so they would be located on the serv
ploaded, although users would need upload permissions anyway. Files can be uploaded so they would be located on the server in a different location, and potentially override existing files. Traversal outside an asset container is not possible. This path traversal vulnerability has been fixed in 5.17.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/statamic/cms/security/advisories/GHSA-p7f6-8mcm-fwv3 - https://github.com/statamic/cms/commit/0c07c10009a2439c8ee56c8faefd1319dc6e388d - https://github.com/statamic/cms/commit/400875b20f40e1343699d536a432a6fc284346da - https://github.com/statamic/cms/commit/4cc2c9bd0f39a93b3fc7e9ef0f12792576fd380d
CVE ID: CVE-2024-52601 State: PUBLISHED Published: 2025-05-14T14:39:15.120Z Last Updated: 2025-05-14T14:49:38.783Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: Combodo Products: iTop Problem Types: CWE-639 Description: iTop is an web based IT Service Management tool. Prior to versions 2.7.12, 3.1.3, and 3.2.1, anyone with an account having portal access can have read access to objects they're not allowed to see by querying an unprotected route. Versions 2.7.12, 3.1.3, and 3.2.1 contain a fix for the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Combodo/iTop/security/advisories/GHSA-cph2-466c-3f87
CVE ID: CVE-2024-52602 State: PUBLISHED Published: 2025-01-16T19:14:46.822Z Last Updated: 2025-02-12T20:31:21.571Z Severity: MEDIUM (CVSS 5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N) Vendors: t2bot Products: matrix-media-repo Problem Types: CWE-918 Description: Matrix Media Repo (MMR) is a highly configurable multi-homeserver media repository for Matrix. Matrix Media Repo (MMR) is vulnerable to server-side request forgery, serving content from a private network it can access, under certain conditions. This is fixed in MMR v1.3.8. Users are advised to upgrade. Restricting which hosts MMR is allowed to contact via (local) firewall rules or a transparent proxy and may provide a workaround fo
which hosts MMR is allowed to contact via (local) firewall rules or a transparent proxy and may provide a workaround for users unable to upgrade. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/t2bot/matrix-media-repo/security/advisories/GHSA-r6jg-jfv6-2fjv - https://github.com/t2bot/matrix-media-repo/releases/tag/v1.3.8 - https://learn.snyk.io/lesson/ssrf-server-side-request-forgery - https://owasp.org/www-community/attacks/Server_Side_Request_Forgery - https://www.agwa.name/blog/post/preventing_server_side_request_forgery_in_golang
CVE ID: CVE-2024-52606 State: PUBLISHED Published: 2025-02-11T07:17:05.645Z Last Updated: 2025-02-11T15:25:40.184Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: SolarWinds Products: SolarWinds Problem Types: CWE-918 Description: SolarWinds Platform is affected by server-side request forgery vulnerability. Proper input sanitation was not applied allowing for the possibility of a malicious web request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://documentation.solarwinds.com/en/success_center/orionplatform/content/release_notes/solarwinds_platform_2025-1_release_notes.htm - https://www.solarwinds.com/trust-center/security-advisories/
elease_notes/solarwinds_platform_2025-1_release_notes.htm - https://www.solarwinds.com/trust-center/security-advisories/CVE-2024-52606
CVE ID: CVE-2024-52611 State: PUBLISHED Published: 2025-02-11T07:25:02.977Z Last Updated: 2025-02-11T15:14:42.560Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: SolarWinds Products: SolarWinds Platform Problem Types: CWE-209 Description: The SolarWinds Platform is vulnerable to an information disclosure vulnerability through an error message. While the data does not provide anything sensitive, the information could assist an attacker in other malicious actions. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://documentation.solarwinds.com/en/success_center/orionplatform/content/release_notes/solarwinds_platform_2025-1_release_notes.htm
ation.solarwinds.com/en/success_center/orionplatform/content/release_notes/solarwinds_platform_2025-1_release_notes.htm - https://www.solarwinds.com/trust-center/security-advisories/CVE-2024-52611
CVE ID: CVE-2024-52612 State: PUBLISHED Published: 2025-02-11T07:21:17.835Z Last Updated: 2025-02-19T04:55:13.422Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: SolarWinds Products: SolarWinds Platform Problem Types: CWE-79 Description: SolarWinds Platform is vulnerable to a reflected cross-site scripting vulnerability. This was caused by an insufficient sanitation of input parameters. This vulnerability requires authentication by a high- privileged account to be exploitable. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://documentation.solarwinds.com/en/success_center/orionplatform/content/release_notes/solarwinds_platform_2025-1_
- https://documentation.solarwinds.com/en/success_center/orionplatform/content/release_notes/solarwinds_platform_2025-1_release_notes.htm - https://www.solarwinds.com/trust-center/security-advisories/cve-2024-52612
CVE ID: CVE-2024-52613 State: PUBLISHED Published: 2024-11-14T00:00:00 Last Updated: 2024-11-20T16:13:25.382Z Vendors: n/a Products: n/a Problem Types: n/a Description: A heap-based buffer under-read in tsMuxer version nightly-2024-05-12-02-01-18 allows attackers to cause Denial of Service (DoS) via a crafted MOV video file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/justdan96/tsMuxer/issues/881
CVE ID: CVE-2024-52614 State: PUBLISHED Published: 2024-11-20T05:12:41.410Z Last Updated: 2024-11-20T15:16:27.641Z Severity: MEDIUM (CVSS 4 CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: EPARK, Inc. Products: Kura Sushi Official App Produced by EPARK Problem Types: CWE-321 Description: Use of hard-coded cryptographic key issue exists in "Kura Sushi Official App Produced by EPARK" for Android versions prior to 3.8.5. If this vulnerability is exploited, a local attacker may obtain the login ID and password for the affected product. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://play.google.com/store/apps/details?id=jp.co.kura_corpo - https://jvn.jp/en/jp/JVN16
Vulnrichment: References: - https://play.google.com/store/apps/details?id=jp.co.kura_corpo - https://jvn.jp/en/jp/JVN16114985/
CVE ID: CVE-2024-52615 State: PUBLISHED Published: 2024-11-21T20:34:00.981Z Last Updated: 2025-11-11T09:29:37.295Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: Red Hat Products: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat OpenShift Container Platform 4 Problem Types: CWE-330 Description: A flaw was found in Avahi-daemon, which relies on fixed source ports for wide-area DNS queries. This issue simplifies attacks where malicious DNS responses are injected. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://access.redhat.com/errata/RHSA-2025:11402 - https://acc
nal Analyst Notes: - CISA ADP Vulnrichment: References: - https://access.redhat.com/errata/RHSA-2025:11402 - https://access.redhat.com/errata/RHSA-2025:16441 - https://access.redhat.com/security/cve/CVE-2024-52615 - https://bugzilla.redhat.com/show_bug.cgi?id=2326418
CVE ID: CVE-2024-52616 State: PUBLISHED Published: 2024-11-21T20:41:11.636Z Last Updated: 2025-11-20T19:38:39.181Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: Red Hat Products: Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat OpenShift Container Platform 4 Problem Types: CWE-334 Description: A flaw was found in the Avahi-daemon, where it initializes DNS transaction IDs randomly only once at startup, incrementing them sequentially after that. This predictable behavior facilitates DNS spoofing attacks, allowing attackers to guess transaction IDs. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - htt
tacks, allowing attackers to guess transaction IDs. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://access.redhat.com/errata/RHSA-2025:7437 - https://access.redhat.com/security/cve/CVE-2024-52616 - https://bugzilla.redhat.com/show_bug.cgi?id=2326429
CVE ID: CVE-2024-52675 State: PUBLISHED Published: 2024-11-19T00:00:00 Last Updated: 2024-11-21T16:46:33.361Z Vendors: n/a Products: n/a Problem Types: n/a Description: SourceCodester Sentiment Based Movie Rating System 1.0 is vulnerable to SQL Injection in /msrps/movies.php. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/xubeining/Cve_report/blob/main/Sourcecodester-SQLi-Sentiment-Based-Moive-Rating.md
CVE ID: CVE-2024-52676 State: PUBLISHED Published: 2024-12-04T00:00:00 Last Updated: 2024-12-05T19:17:13.674Z Vendors: n/a Products: n/a Problem Types: n/a Description: Itsourcecode Online Discussion Forum Project v.1.0.0 is vulnerable to Cross Site Scripting (XSS) via /bcc_forum/members/home.php. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/WTIMITW/System-with-Cross-site-Scripting-XSS-
CVE ID: CVE-2024-52677 State: PUBLISHED Published: 2024-11-20T00:00:00.000Z Last Updated: 2025-03-13T15:36:40.197Z Vendors: n/a Products: n/a Problem Types: n/a Description: HkCms <= v2.3.2.240702 is vulnerable to file upload in the getFileName method in /app/common/library/Upload.php. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/J-0k3r/test/blob/main/upload.pdf - https://github.com/J-0k3r/CVE-2024-52677
CVE ID: CVE-2024-52680 State: PUBLISHED Published: 2025-08-07T00:00:00.000Z Last Updated: 2025-08-07T20:27:19.323Z Vendors: n/a Products: n/a Problem Types: n/a Description: EyouCMS 1.6.7 is vulnerable to Cross Site Scripting (XSS) in /login.php?m=admin&c=System&a=web&lang=cn. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://www.eyoucms.com - https://gist.github.com/cyb3res3c/c715407bfe6d418d8e6da61e1ab41fc8
CVE ID: CVE-2024-52701 State: PUBLISHED Published: 2024-11-20T00:00:00 Last Updated: 2024-11-20T20:55:14.616Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stored cross-site scripting (XSS) vulnerability in the Configuration page of Piwigo v14.5.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Page banner parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Piwigo/Piwigo/issues/2261
CVE ID: CVE-2024-52702 State: PUBLISHED Published: 2024-11-20T00:00:00 Last Updated: 2024-11-20T20:57:10.751Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stored cross-site scripting (XSS) vulnerability in the component install\index.php of MyBB v1.8.38 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Website Name parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/mybb/mybb/issues/4859
CVE ID: CVE-2024-52711 State: PUBLISHED Published: 2024-11-19T00:00:00 Last Updated: 2024-11-22T17:11:22.590Z Vendors: n/a Products: n/a Problem Types: n/a Description: DI-8100 v16.07.26A1 is vulnerable to Buffer Overflow In the ip_position_asp function via the ip parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/CLan-nad/CVE/blob/main/D-Link/ip_position_asp/1.md
CVE ID: CVE-2024-52714 State: PUBLISHED Published: 2024-11-19T00:00:00 Last Updated: 2024-11-20T19:28:54.481Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda AC6 v2.0 v15.03.06.50 was discovered to contain a buffer overflow in the function 'fromSetSysTime. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://tenda.com - https://github.com/CLan-nad/CVE/blob/main/tenda/fromSetSysTime/1.md
CVE ID: CVE-2024-52723 State: PUBLISHED Published: 2024-11-22T00:00:00.000Z Last Updated: 2025-03-13T17:36:37.395Z Vendors: n/a Products: n/a Problem Types: n/a Description: In TOTOLINK X6000R V9.4.0cu.1041_B20240224 in the shttpd file, the Uci_Set Str function is used without strict parameter filtering. An attacker can achieve arbitrary command execution by constructing the payload. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://x6000r.com - https://gist.github.com/M4rg4tr01d/e84f8ed8dc27960d7c56ad289f6fb0ff
CVE ID: CVE-2024-52724 State: PUBLISHED Published: 2024-12-02T00:00:00 Last Updated: 2024-12-03T15:01:58.928Z Vendors: n/a Products: n/a Problem Types: n/a Description: ZZCMS 2023 was discovered to contain a SQL injection vulnerability in /q/show.php. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/npubaishao/zzcms_sql_injection/blob/main/zzcms_sql_injection.md - https://gist.github.com/npubaishao/768b638ab16b7da6478d028aeb25bbbc
CVE ID: CVE-2024-52725 State: PUBLISHED Published: 2024-11-20T00:00:00 Last Updated: 2024-12-02T20:34:15.441Z Vendors: n/a Products: n/a Problem Types: n/a Description: SemCms v4.8 was discovered to contain a SQL injection vulnerability. This allows an attacker to execute arbitrary code via the ldgid parameter in the SEMCMS_SeoAndTag.php component. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://semcms.com - https://github.com/Megrez0423/Seecms
CVE ID: CVE-2024-52726 State: PUBLISHED Published: 2024-11-22T00:00:00 Last Updated: 2024-11-27T16:44:34.613Z Vendors: n/a Products: n/a Problem Types: n/a Description: CRMEB v5.4.0 is vulnerable to Arbitrary file read in the save_basics function which allows an attacker to obtain sensitive information Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/sec-Kode/cve3/blob/main/cve3.md - https://gist.github.com/sec-Kode/bb71138619b22de28c6b0ba986ad58e5
CVE ID: CVE-2024-52732 State: PUBLISHED Published: 2024-12-02T00:00:00 Last Updated: 2024-12-03T15:13:53.683Z Vendors: n/a Products: n/a Problem Types: n/a Description: Incorrect access control in wms-Warehouse management system-zeqp v2.20.9.1 due to the token value of the zeqp system being reused. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/dotNetTreasury/WMS/blob/master/README.md - https://github.com/dotNetTreasury/WMS/tree/master/src - https://gist.github.com/LINF2009/fe2f0681389d4521d236a34ec2109a24
CVE ID: CVE-2024-52739 State: PUBLISHED Published: 2024-11-20T00:00:00 Last Updated: 2024-11-20T19:25:01.549Z Vendors: n/a Products: n/a Problem Types: n/a Description: D-LINK DI-8400 v16.07.26A1 was discovered to contain multiple remote command execution (RCE) vulnerabilities in the msp_info_htm function via the flag and cmd parameters. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.dlink.com/en/security-bulletin/ - https://github.com/faqiadegege/IoTVuln/blob/main/DI_8400_msp_info_htm_rce/detail.md
CVE ID: CVE-2024-52754 State: PUBLISHED Published: 2024-11-20T00:00:00 Last Updated: 2024-11-22T16:18:03.449Z Vendors: n/a Products: n/a Problem Types: n/a Description: D-LINK DI-8003 v16.07.16A1 was discovered to contain a buffer overflow via the fn parameter in the tgfile_htm function. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.dlink.com/en/security-bulletin/ - https://github.com/faqiadegege/IoTVuln/blob/main/DI_8003_tgfile_htm_stackoverflow/detail.md
CVE ID: CVE-2024-52755 State: PUBLISHED Published: 2024-11-20T00:00:00 Last Updated: 2024-11-22T16:13:22.215Z Vendors: n/a Products: n/a Problem Types: n/a Description: D-LINK DI-8003 v16.07.26A1 was discovered to contain a buffer overflow via the host_ip parameter in the ipsec_road_asp function. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/faqiadegege/IoTVuln/blob/main/DI_8003_jingx_asp_stackoverflow/detail.md
CVE ID: CVE-2024-52757 State: PUBLISHED Published: 2024-11-20T00:00:00 Last Updated: 2024-11-22T16:16:30.025Z Vendors: n/a Products: n/a Problem Types: n/a Description: D-LINK DI-8003 v16.07.16A1 was discovered to contain a buffer overflow via the notify parameter in the arp_sys_asp function. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.dlink.com/en/security-bulletin/ - https://github.com/faqiadegege/IoTVuln/blob/main/DI_8003_arp_sys_asp_stackoverflow/detail.md
CVE ID: CVE-2024-52759 State: PUBLISHED Published: 2024-11-19T00:00:00 Last Updated: 2024-11-22T16:20:09.981Z Vendors: n/a Products: n/a Problem Types: n/a Description: D-LINK DI-8003 v16.07.26A1 was discovered to contain a buffer overflow via the ip parameter in the ip_position_asp function. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.dlink.com/en/security-bulletin/ - https://github.com/faqiadegege/IoTVuln/blob/main/DI_8003_ip_position_asp_stackoverflow/detail.md
CVE ID: CVE-2024-52762 State: PUBLISHED Published: 2024-11-19T00:00:00 Last Updated: 2024-11-20T19:25:19.566Z Vendors: n/a Products: n/a Problem Types: n/a Description: A cross-site scripting (XSS) vulnerability in the component /master/header.php of Ganglia-web v3.73 to v3.76 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the "tz" parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/ganglia/ganglia-web/issues/382
CVE ID: CVE-2024-52763 State: PUBLISHED Published: 2024-11-19T00:00:00 Last Updated: 2024-11-20T20:57:53.564Z Vendors: n/a Products: n/a Problem Types: n/a Description: A cross-site scripting (XSS) vulnerability in the component /graph_all_periods.php of Ganglia-web v3.73 to v3.75 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the "g" parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/ganglia/ganglia-web/issues/382
CVE ID: CVE-2024-52765 State: PUBLISHED Published: 2024-11-20T00:00:00.000Z Last Updated: 2025-03-13T13:30:55.764Z Vendors: n/a Products: n/a Problem Types: n/a Description: H3C GR-1800AX MiniGRW1B0V100R007 is vulnerable to remote code execution (RCE) via the aspForm parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://tjr181.com/2024/11/08/H3C%20GR-1800AX/
CVE ID: CVE-2024-52769 State: PUBLISHED Published: 2024-11-20T00:00:00 Last Updated: 2024-11-29T21:05:50.183Z Vendors: n/a Products: n/a Problem Types: n/a Description: An arbitrary file upload vulnerability in the component /admin/friendlink_edit of DedeBIZ v6.3.0 allows attackers to execute arbitrary code via uploading a crafted file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/DedeBIZ/DedeV6/ - https://co-a1natas.feishu.cn/docx/Zsd9dnGUvoBW6tx0G5fcVx6vnBb
CVE ID: CVE-2024-52770 State: PUBLISHED Published: 2024-11-20T00:00:00 Last Updated: 2024-11-21T15:42:19.203Z Vendors: n/a Products: n/a Problem Types: n/a Description: An arbitrary file upload vulnerability in the component /admin/file_manage_control of DedeBIZ v6.3.0 allows attackers to execute arbitrary code via uploading a crafted file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/DedeBIZ/DedeV6/ - https://co-a1natas.feishu.cn/docx/Zsd9dnGUvoBW6tx0G5fcVx6vnBb
CVE ID: CVE-2024-52771 State: PUBLISHED Published: 2024-11-20T00:00:00 Last Updated: 2024-11-27T17:05:17.390Z Vendors: n/a Products: n/a Problem Types: n/a Description: DedeBIZ v6.3.0 was discovered to contain an arbitrary file deletion vulnerability via the component /admin/file_manage_view. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/DedeBIZ/DedeV6/ - https://co-a1natas.feishu.cn/docx/Zsd9dnGUvoBW6tx0G5fcVx6vnBb