Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-23958 State: PUBLISHED Published: 2024-09-28T06:10:32.811Z Last Updated: 2024-10-03T13:48:39.497Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) Vendors: Autel Products: MaxiCharger AC Elite Business C50 Problem Types: CWE-798 Description: Autel MaxiCharger AC Elite Business C50 BLE Hardcoded Credentials Authentication Bypass Vulnerability. This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of Autel MaxiCharger AC Elite Business C50 charging stations. Authentication is not required to exploit this vulnerability. The specific flaw exists within the BLE AppAuthenRequest command handler. The handler
ed to exploit this vulnerability. The specific flaw exists within the BLE AppAuthenRequest command handler. The handler uses hardcoded credentials as a fallback in case of an authentication request failure. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-23196 Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-24-852/
CVE ID: CVE-2024-23959 State: PUBLISHED Published: 2024-09-28T06:15:15.076Z Last Updated: 2024-10-03T13:44:29.019Z Severity: HIGH (CVSS 8 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Autel Products: MaxiCharger AC Elite Business C50 Problem Types: CWE-121 Description: Autel MaxiCharger AC Elite Business C50 BLE AppChargingControl Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Autel MaxiCharger AC Elite Business C50 charging stations. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The
gh authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the handling of the AppChargingControl BLE command. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the device. Was ZDI-CAN-23194 Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-24-851/
CVE ID: CVE-2024-23960 State: PUBLISHED Published: 2024-09-28T06:20:12.192Z Last Updated: 2024-10-03T14:16:49.093Z Severity: MEDIUM (CVSS 4.6 CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) Vendors: Alpine Products: Halo9 Problem Types: CWE-347 Description: Alpine Halo9 Improper Verification of Cryptographic Signature Vulnerability. This vulnerability allows physically present attackers to bypass signature validation mechanism on affected installations of Alpine Halo9 devices. Authentication is not required to exploit this vulnerability. The specific flaw exists within the firmware metadata signature validation mechanism. The issue results from the lack of proper verification of a cryptographi
rmware metadata signature validation mechanism. The issue results from the lack of proper verification of a cryptographic signature. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of root. Was ZDI-CAN-23102 Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-24-845/
CVE ID: CVE-2024-23961 State: PUBLISHED Published: 2024-09-28T06:16:46.383Z Last Updated: 2024-10-03T14:15:54.210Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Alpine Products: Halo9 Problem Types: CWE-78 Description: Alpine Halo9 UPDM_wemCmdUpdFSpeDecomp Command Injection Remote Code Execution Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Alpine Halo9 devices. Authentication is not required to exploit this vulnerability. The specific flaw exists within the UPDM_wemCmdUpdFSpeDecomp function. The issue results from the lack of proper validation of a user-supplied string before u
DM_wemCmdUpdFSpeDecomp function. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-23306 Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-24-849/
CVE ID: CVE-2024-23962 State: PUBLISHED Published: 2025-01-30T23:53:33.224Z Last Updated: 2025-07-01T13:43:07.238Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Alpine Products: Halo9 Problem Types: CWE-200 Description: This vulnerability allows remote attackers to disclose sensitive information on affected installations of Alpine Halo9 devices. Authentication is not required to exploit this vulnerability. The specific flaw exists within the DLT interface, which listens on TCP port 3490 by default. The issue results from the lack of authentication prior to allowing access to functionality. An attacker can leverage this in conjunction with other vulnerabili
ntication prior to allowing access to functionality. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the device. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-24-847/
CVE ID: CVE-2024-23963 State: PUBLISHED Published: 2025-01-30T23:57:24.401Z Last Updated: 2025-07-01T13:41:46.822Z Severity: HIGH (CVSS 8 CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Alpine Products: Halo9 Problem Types: CWE-94 Description: This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Alpine Halo9 devices. An attacker must first obtain the ability to pair a malicious Bluetooth device with the target system in order to exploit this vulnerability. The specific flaw exists within the PBAP_DecodeVCARD function. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a
tion. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-24-850/
CVE ID: CVE-2024-23967 State: PUBLISHED Published: 2024-09-28T06:12:05.822Z Last Updated: 2024-10-03T13:41:52.758Z Severity: HIGH (CVSS 8 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Autel Products: MaxiCharger AC Elite Business C50 Problem Types: CWE-121 Description: Autel MaxiCharger AC Elite Business C50 WebSocket Base64 Decoding Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Autel MaxiCharger AC Elite Business C50 chargers. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specif
hentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the handling of base64-encoded data within WebSocket messages. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the device. Was ZDI-CAN-23230 Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-24-853/
CVE ID: CVE-2024-23968 State: PUBLISHED Published: 2025-01-30T23:31:40.396Z Last Updated: 2025-08-26T21:01:52.095Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: ChargePoint Products: Home Flex Problem Types: CWE-120 Description: This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of ChargePoint Home Flex charging stations. Authentication is not required to exploit this vulnerability. The specific flaw exists within the SrvrToSmSetAutoChnlListMsg function. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An att
f proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-24-1050/
CVE ID: CVE-2024-23969 State: PUBLISHED Published: 2025-01-30T23:37:22.462Z Last Updated: 2025-08-26T21:02:16.174Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: ChargePoint Products: Home Flex Problem Types: CWE-787 Description: This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of ChargePoint Home Flex charging stations. Authentication is not required to exploit this vulnerability. The specific flaw exists within the wlanchnllst function. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage th
tion of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of root. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-24-1051/
CVE ID: CVE-2024-23970 State: PUBLISHED Published: 2025-01-30T23:40:49.963Z Last Updated: 2025-08-26T21:02:52.773Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) Vendors: ChargePoint Products: Home Flex Problem Types: CWE-295 Description: This vulnerability allows network-adjacent attackers to compromise transport security on affected installations of ChargePoint Home Flex charging stations. Authentication is not required to exploit this vulnerability. The specific flaw exists within the CURLOPT_SSL_VERIFYHOST setting. The issue results from the lack of proper validation of the certificate presented by the server. An attacker can leverage this in conjunction with ot
ck of proper validation of the certificate presented by the server. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of root. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-24-1052/
CVE ID: CVE-2024-23971 State: PUBLISHED Published: 2025-01-30T23:42:57.796Z Last Updated: 2025-08-26T21:08:23.253Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: ChargePoint Products: Home Flex Problem Types: CWE-77 Description: This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of ChargePoint Home Flex charging stations. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of OCPP messages. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability
lidation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-24-1053/
CVE ID: CVE-2024-23972 State: PUBLISHED Published: 2024-09-23T14:19:36.143Z Last Updated: 2024-09-23T16:42:27.286Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Sony Products: XAV-AX5500 Problem Types: CWE-120 Description: Sony XAV-AX5500 USB Configuration Descriptor Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Sony XAV-AX5500 devices. Authentication is not required to exploit this vulnerability. The specific flaw exists within the USB host driver. A crafted USB configuration descriptor can trigger an overflow of a fixed-length buffer. An a
ithin the USB host driver. A crafted USB configuration descriptor can trigger an overflow of a fixed-length buffer. An attacker can leverage this vulnerability to execute code in the context of the device. Was ZDI-CAN-23185 Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-24-876/ - https://www.sony.com/electronics/support/mobile-cd-players-digital-media-players-xav-series/xav-ax5500/software/00274156
CVE ID: CVE-2024-23973 State: PUBLISHED Published: 2025-01-30T23:28:55.542Z Last Updated: 2025-08-26T21:08:23.396Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Silicon Labs Products: Gecko OS Problem Types: CWE-120 Description: This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Silicon Labs Gecko OS. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of HTTP GET requests. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a stack-based buffer. An attacker can leverage this vulnerability
he length of user-supplied data prior to copying it to a stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the device. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-24-873/ - https://community.silabs.com/a45Vm0000000Atp
CVE ID: CVE-2024-23974 State: PUBLISHED Published: 2024-08-14T13:45:30.464Z Last Updated: 2024-08-14T15:50:44.777Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: n/a Products: Intel(R) ISH software installers Problem Types: escalation of privilege, CWE-276 Description: Incorrect default permissions in some Intel(R) ISH software installers may allow an authenticated user to potentially enable escalation of privilege via local access. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01088.html
CVE ID: CVE-2024-23975 State: PUBLISHED Published: 2024-03-21T22:15:33.833Z Last Updated: 2024-08-12T20:27:50.352Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Delta Electronics Products: DIAEnergie Problem Types: CWE-89 Description: SQL injection vulnerability exists in GetDIAE_slogListParameters. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-24-074-12
CVE ID: CVE-2024-23976 State: PUBLISHED Published: 2024-02-14T16:30:20.173Z Last Updated: 2024-08-01T23:13:08.251Z Severity: MEDIUM (CVSS 6 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N) Vendors: F5 Products: BIG-IP Problem Types: CWE-266 Description: When running in Appliance mode, an authenticated attacker assigned the Administrator role may be able to bypass Appliance mode restrictions utilizing iAppsLX templates on a BIG-IP system. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://my.f5.com/manage/s/article/K91054692
CVE ID: CVE-2024-23978 State: PUBLISHED Published: 2024-02-02T06:38:33.253Z Last Updated: 2025-05-15T19:50:24.669Z Vendors: KDDI CORPORATION Products: HOME SPOT CUBE2 Problem Types: Heap-based buffer overflow Description: Heap-based buffer overflow vulnerability exists in HOME SPOT CUBE2 V102 and earlier. By processing invalid values, arbitrary code may be executed. Note that the affected products are no longer supported. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.au.com/support/service/mobile/guide/wlan/home_spot_cube_2/ - https://jvn.jp/en/vu/JVNVU93740658/
CVE ID: CVE-2024-23979 State: PUBLISHED Published: 2024-02-14T16:30:22.395Z Last Updated: 2024-08-01T23:13:08.549Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: F5 Products: BIG-IP Problem Types: CWE-770 Description: When SSL Client Certificate LDAP or Certificate Revocation List Distribution Point (CRLDP) authentication profile is configured on a virtual server, undisclosed requests can cause an increase in CPU resource utilization. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://my.f5.com/manage/s/article/K000134516
CVE ID: CVE-2024-23980 State: PUBLISHED Published: 2024-05-16T20:46:59.941Z Last Updated: 2024-08-20T15:00:07.103Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: n/a Products: UEFI firmware for some Intel(R) Server D50FCP Family products Problem Types: escalation of privilege, CWE-119 Description: Improper buffer restrictions in PlatformPfrDxe driver in UEFI firmware for some Intel(R) Server D50FCP Family products may allow a privileged user to enable escalation of privilege via local access. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01080
: - CISA ADP Vulnrichment: References: - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01080.html
CVE ID: CVE-2024-23981 State: PUBLISHED Published: 2024-08-14T13:45:45.752Z Last Updated: 2024-08-16T04:01:28.264Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: n/a Products: Intel(R) Ethernet Network Controllers and Adapters Problem Types: escalation of privilege, CWE-128 Description: Wrap-around error in Linux kernel mode driver for some Intel(R) Ethernet Network Controllers and Adapters before version 28.3 may allow an authenticated user to potentially enable escalation of privilege via local access. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00918.html
CVE ID: CVE-2024-23982 State: PUBLISHED Published: 2024-02-14T16:35:08.991Z Last Updated: 2024-08-21T15:47:02.775Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: F5 Products: BIG-IP Problem Types: CWE-121 Description: When a BIG-IP PEM classification profile is configured on a UDP virtual server, undisclosed requests can cause the Traffic Management Microkernel (TMM) to terminate. This issue affects classification engines using signatures released between 09-08-2022 and 02-16-2023. See the table in the F5 Security Advisory for a complete list of affected classification signature files. NOTE: Software versions which have reached End of Technical Support (EoTS)
t of affected classification signature files. NOTE: Software versions which have reached End of Technical Support (EoTS) are not evaluated Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://my.f5.com/manage/s/article/K000135946
CVE ID: CVE-2024-23983 State: PUBLISHED Published: 2024-11-11T22:56:58.036Z Last Updated: 2024-11-12T18:51:50.901Z Vendors: Ping Identity Products: PingAccess Problem Types: CWE-20, CWE-177 Description: Improper handling of canonical URL-encoding may lead to bypass not properly constrained by request rules. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://docs.pingidentity.com/pingaccess/latest/release_notes/pa_811_rn.html - https://www.pingidentity.com/en/resources/downloads/pingaccess.html
CVE ID: CVE-2024-23984 State: PUBLISHED Published: 2024-09-16T16:38:48.187Z Last Updated: 2025-11-03T21:53:51.437Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:N) Vendors: n/a Products: Intel(R) Processors Problem Types: information disclosure, CWE-203 Description: Observable discrepancy in RAPL interface for some Intel(R) Processors may allow a privileged user to potentially enable information disclosure via local access. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01103.html
CVE ID: CVE-2024-23985 State: PUBLISHED Published: 2024-01-25T00:00:00.000Z Last Updated: 2025-05-30T14:16:08.425Z Vendors: n/a Products: n/a Problem Types: n/a Description: EzServer 6.4.017 allows a denial of service (daemon crash) via a long string, such as one for the RNTO command. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://packetstormsecurity.com/files/176663/EzServer-6.4.017-Denial-Of-Service.html
CVE ID: CVE-2024-23995 State: PUBLISHED Published: 2024-04-29T00:00:00 Last Updated: 2024-08-01T23:13:08.504Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting (XSS) in Beekeeper Studio 4.1.13 and earlier allows remote attackers to execute arbitrary code in the column name of a database table in tabulator-popup-container. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.beekeeperstudio.io/ - https://github.com/EQSTLab/PoC/blob/main/2024/RCE/CVE-2024-23995/README.md
CVE ID: CVE-2024-23997 State: PUBLISHED Published: 2024-07-05T00:00:00 Last Updated: 2024-08-01T23:13:08.503Z Vendors: n/a Products: n/a Problem Types: n/a Description: Lukas Bach yana =<1.0.16 is vulnerable to Cross Site Scripting (XSS) via src/electron-main.ts. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/EQSTLab/PoC/tree/main/2024/LCE/CVE-2024-23997
CVE ID: CVE-2024-23998 State: PUBLISHED Published: 2024-07-05T00:00:00 Last Updated: 2024-08-01T23:13:08.528Z Vendors: n/a Products: n/a Problem Types: n/a Description: goanother Another Redis Desktop Manager =<1.6.1 is vulnerable to Cross Site Scripting (XSS) via src/components/Setting.vue. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/EQSTLab/PoC/tree/main/2024/LCE/CVE-2024-23998
CVE ID: CVE-2024-24000 State: PUBLISHED Published: 2024-02-06T00:00:00.000Z Last Updated: 2025-06-12T14:40:17.447Z Vendors: n/a Products: n/a Problem Types: n/a Description: jshERP v3.3 is vulnerable to Arbitrary File Upload. The jshERP-boot/systemConfig/upload interface does not check the uploaded file type, and the biz parameter can be spliced into the upload path, resulting in arbitrary file uploads with controllable paths. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/jishenghua/jshERP - https://github.com/cxcxcxcxcxcxcxc/cxcxcxcxcxcxcxc/blob/main/cxcxcxcxcxc/about-2024/24000.txt
CVE ID: CVE-2024-24001 State: PUBLISHED Published: 2024-02-06T00:00:00.000Z Last Updated: 2025-05-15T19:45:35.925Z Vendors: n/a Products: n/a Problem Types: n/a Description: jshERP v3.3 is vulnerable to SQL Injection. via the com.jsh.erp.controller.DepotHeadController: com.jsh.erp.utils.BaseResponseInfo findallocationDetail() function of jshERP which allows an attacker to construct malicious payload to bypass jshERP's protection mechanism. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/jishenghua/jshERP/issues/99 - https://github.com/cxcxcxcxcxcxcxc/cxcxcxcxcxcxcxc/blob/main/cxcxcxcxcxc/about-2024/24001.txt