Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-3427 State: PUBLISHED Published: 2024-04-07T17:00:06.179Z Last Updated: 2024-08-01T20:12:07.263Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: SourceCodester Products: Online Courseware Problem Types: CWE-79 Description: A vulnerability, which was classified as problematic, was found in SourceCodester Online Courseware 1.0. This affects an unknown part of the file addq.php. The manipulation of the argument id leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-259599. Additional Analyst Notes: - CISA ADP Vulnrichment: -
ed. The associated identifier of this vulnerability is VDB-259599. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.259599 - https://vuldb.com/?ctiid.259599 - https://vuldb.com/?submit.311606 - https://github.com/thisissuperann/Vul/blob/Online-Courseware/Online-Courseware-12.md
CVE ID: CVE-2024-3428 State: PUBLISHED Published: 2024-04-07T17:31:04.727Z Last Updated: 2024-08-01T20:12:07.246Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: SourceCodester Products: Online Courseware Problem Types: CWE-79 Description: A vulnerability has been found in SourceCodester Online Courseware 1.0 and classified as problematic. This vulnerability affects unknown code of the file edit.php. The manipulation of the argument id leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-259600. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program C
. The identifier of this vulnerability is VDB-259600. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.259600 - https://vuldb.com/?ctiid.259600 - https://vuldb.com/?submit.311607 - https://github.com/thisissuperann/Vul/blob/Online-Courseware/Online-Courseware-13.md
CVE ID: CVE-2024-3429 State: PUBLISHED Published: 2024-06-06T18:44:55.299Z Last Updated: 2024-08-01T20:12:06.926Z Severity: CRITICAL (CVSS 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: parisneo Products: parisneo/lollms Problem Types: CWE-29 Description: A path traversal vulnerability exists in the parisneo/lollms application, specifically within the `sanitize_path_from_endpoint` and `sanitize_path` functions in `lollms_core\lollms\security.py`. This vulnerability allows for arbitrary file reading when the application is running on Windows. The issue arises due to insufficient sanitization of user-supplied input, enabling attackers to bypass the path traversal protection mechani
to insufficient sanitization of user-supplied input, enabling attackers to bypass the path traversal protection mechanisms by crafting malicious input. Successful exploitation could lead to unauthorized access to sensitive files, information disclosure, and potentially a denial of service (DoS) condition by including numerous large or resource-intensive files. This vulnerability affects the latest version prior to 9.6. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://huntr.com/bounties/fd8f50c8-17f0-40be-a2c6-bb8d80f7c409 - https://github.com/parisneo/lollms/commit/f4424cfc3d6dfb3ad5ac17dd46801efe784933e9
CVE ID: CVE-2024-3430 State: PUBLISHED Published: 2024-04-07T22:00:05.626Z Last Updated: 2024-08-01T20:12:06.925Z Severity: LOW (CVSS 2.4 CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: n/a Products: QKSMS Problem Types: CWE-530 Description: A vulnerability was found in QKSMS up to 3.9.4 on Android. It has been classified as problematic. This affects an unknown part of the file androidmanifest.xml of the component Backup File Handler. The manipulation leads to exposure of backup file to an unauthorized control sphere. It is possible to launch the attack on the physical device. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability
al device. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-259611. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.259611 - https://vuldb.com/?ctiid.259611 - https://vuldb.com/?submit.307756 - https://github.com/moezbhatti/qksms
CVE ID: CVE-2024-3431 State: PUBLISHED Published: 2024-04-07T22:00:07.735Z Last Updated: 2024-08-20T18:35:27.629Z Severity: N/A (CVSS 5.8 AV:N/AC:L/Au:M/C:P/I:P/A:P) Vendors: n/a Products: EyouCMS Problem Types: CWE-502 Description: A vulnerability was found in EyouCMS 1.6.5. It has been declared as critical. This vulnerability affects unknown code of the file /login.php?m=admin&c=Field&a=channel_edit of the component Backend. The manipulation of the argument channel_id leads to deserialization. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-259612. NOTE: The vendor was contacted early about this
lic and may be used. The identifier of this vulnerability is VDB-259612. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.259612 - https://vuldb.com/?ctiid.259612 - https://vuldb.com/?submit.308208 - https://terrific-street-3d0.notion.site/EYOUCMS-v1-6-5-RCE-7fe12e91a9b249e88e6ab36446b5ba22
CVE ID: CVE-2024-3432 State: PUBLISHED Published: 2024-04-07T22:31:05.322Z Last Updated: 2025-02-26T18:46:52.469Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: PuneethReddyHC Products: Event Management Problem Types: CWE-89 Description: A vulnerability was found in PuneethReddyHC Event Management 1.0. It has been rated as critical. This issue affects some unknown processing of the file /backend/register.php. The manipulation of the argument event_id/full_name/email/mobile/college/branch leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-259613 was assigned to this vulnerability. NOTE: T
has been disclosed to the public and may be used. The identifier VDB-259613 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.259613 - https://vuldb.com/?ctiid.259613 - https://packetstormsecurity.com/files/177841/Event-Management-1.0-SQL-Injection.html
CVE ID: CVE-2024-3433 State: PUBLISHED Published: 2024-04-07T23:00:05.894Z Last Updated: 2024-08-19T17:06:28.466Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: PuneethReddyHC Products: Event Management Problem Types: CWE-79 Description: A vulnerability classified as problematic has been found in PuneethReddyHC Event Management 1.0. Affected is an unknown function of the file /backend/register.php. The manipulation of the argument event_id/full_name/email/mobile/college/branch leads to cross site scripting. It is possible to launch the attack remotely. VDB-259614 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did n
4 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.259614 - https://vuldb.com/?ctiid.259614 - https://vuldb.com/?submit.307744 - https://packetstormsecurity.com/files/177841/Event-Management-1.0-SQL-Injection.html
CVE ID: CVE-2024-3434 State: PUBLISHED Published: 2024-04-07T23:31:05.571Z Last Updated: 2024-08-01T20:12:07.043Z Severity: N/A (CVSS 5.5 AV:N/AC:L/Au:S/C:N/I:P/A:P) Vendors: CP Plus Products: Wi-Fi Camera Problem Types: CWE-285 Description: A vulnerability classified as critical was found in CP Plus Wi-Fi Camera up to 20240401. Affected by this vulnerability is an unknown functionality of the component User Management. The manipulation leads to improper authorization. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-259615. NOTE: The vendor was contacted early about this disclosure but d
ociated identifier of this vulnerability is VDB-259615. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.259615 - https://vuldb.com/?ctiid.259615 - https://vuldb.com/?submit.308217 - https://drive.google.com/file/d/1-Fz3G5HQZxBNgeXjPfIR1bEeC_qAegWD/view?usp=sharing
CVE ID: CVE-2024-3435 State: PUBLISHED Published: 2024-05-16T09:03:48.687Z Last Updated: 2024-08-01T20:12:07.326Z Severity: HIGH (CVSS 8.4 CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: parisneo Products: parisneo/lollms-webui Problem Types: CWE-29 Description: A path traversal vulnerability exists in the 'save_settings' endpoint of the parisneo/lollms-webui application, affecting versions up to the latest release before 9.5. The vulnerability arises due to insufficient sanitization of the 'config' parameter in the 'apply_settings' function, allowing an attacker to manipulate the application's configuration by sending specially crafted JSON payloads. This could lead to remote code ex
manipulate the application's configuration by sending specially crafted JSON payloads. This could lead to remote code execution (RCE) by bypassing existing patches designed to mitigate such vulnerabilities. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://huntr.com/bounties/494f349a-8650-4d30-a0bd-4742fda44ce5 - https://github.com/parisneo/lollms-webui/commit/bb99b59e710d00c4f2598faa5e183fa30fbd3bc2
CVE ID: CVE-2024-3436 State: PUBLISHED Published: 2024-04-07T23:31:06.911Z Last Updated: 2024-08-26T14:40:43.954Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: SourceCodester Products: Prison Management System Problem Types: CWE-434 Description: A vulnerability was found in SourceCodester Prison Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /Admin/edit-photo.php of the component Avatar Handler. The manipulation of the argument avatar leads to unrestricted upload. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-259630 is the identifier assigned to this vulnerab
ly. The exploit has been disclosed to the public and may be used. VDB-259630 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.259630 - https://vuldb.com/?ctiid.259630 - https://vuldb.com/?submit.311919 - https://github.com/fubxx/CVE/blob/main/PrisonManagementSystemRCE.md
CVE ID: CVE-2024-3437 State: PUBLISHED Published: 2024-04-08T00:00:05.558Z Last Updated: 2024-08-21T22:24:01.651Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: SourceCodester Products: Prison Management System Problem Types: CWE-434 Description: A vulnerability was found in SourceCodester Prison Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /Admin/add-admin.php of the component Avatar Handler. The manipulation of the argument avatar leads to unrestricted upload. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-
y. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-259631. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.259631 - https://vuldb.com/?ctiid.259631 - https://vuldb.com/?submit.311920 - https://github.com/fubxx/CVE/blob/main/PrisonManagementSystemRCE2.md
CVE ID: CVE-2024-3438 State: PUBLISHED Published: 2024-04-08T11:00:04.899Z Last Updated: 2024-08-08T18:49:49.000Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: SourceCodester Products: Prison Management System Problem Types: CWE-89 Description: A vulnerability was found in SourceCodester Prison Management System 1.0 and classified as critical. This issue affects some unknown processing of the file /Admin/login.php. The manipulation leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-259691. Additional Analyst Notes: - CVE Program Container: - CISA ADP
ssociated identifier of this vulnerability is VDB-259691. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.259691 - https://vuldb.com/?ctiid.259691 - https://vuldb.com/?submit.312203 - https://github.com/fubxx/CVE/blob/main/PrisonManagementSystemSQL1.md
CVE ID: CVE-2024-3439 State: PUBLISHED Published: 2024-04-08T11:31:05.079Z Last Updated: 2024-08-01T20:12:06.847Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: SourceCodester Products: Prison Management System Problem Types: CWE-89 Description: A vulnerability was found in SourceCodester Prison Management System 1.0. It has been classified as critical. Affected is an unknown function of the file /Account/login.php. The manipulation leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-259692. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program
d. The identifier of this vulnerability is VDB-259692. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.259692 - https://vuldb.com/?ctiid.259692 - https://vuldb.com/?submit.312204 - https://github.com/fubxx/CVE/blob/main/PrisonManagementSystemSQL2.md
CVE ID: CVE-2024-3440 State: PUBLISHED Published: 2024-04-08T14:00:04.825Z Last Updated: 2024-08-08T18:48:41.344Z Severity: N/A (CVSS 5.8 AV:N/AC:L/Au:M/C:P/I:P/A:P) Vendors: SourceCodester Products: Prison Management System Problem Types: CWE-89 Description: A vulnerability was found in SourceCodester Prison Management System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /Admin/edit_profile.php. The manipulation leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-259693 was assigned to this vulnerability. Additional Analyst Notes: - CVE Pr
public and may be used. The identifier VDB-259693 was assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.259693 - https://vuldb.com/?ctiid.259693 - https://vuldb.com/?submit.312207 - https://github.com/fubxx/CVE/blob/main/PrisonManagementSystemSQL3.md
CVE ID: CVE-2024-3441 State: PUBLISHED Published: 2024-04-08T14:00:06.372Z Last Updated: 2024-08-01T20:12:06.952Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: SourceCodester Products: Prison Management System Problem Types: CWE-89 Description: A vulnerability was found in SourceCodester Prison Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /Employee/edit-profile.php. The manipulation leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-259694 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CISA ADP Vuln
and may be used. VDB-259694 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.259694 - https://vuldb.com/?ctiid.259694 - https://vuldb.com/?submit.312219 - https://github.com/fubxx/CVE/blob/main/PrisonManagementSystemSQL4.md
CVE ID: CVE-2024-3442 State: PUBLISHED Published: 2024-04-08T14:31:04.424Z Last Updated: 2024-08-08T20:24:58.409Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: SourceCodester Products: Prison Management System Problem Types: CWE-89 Description: A vulnerability classified as critical has been found in SourceCodester Prison Management System 1.0. This affects an unknown part of the file /Employee/delete_leave.php. The manipulation leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-259695. Additional Analyst Notes: - CVE Program Container: - CI
. The associated identifier of this vulnerability is VDB-259695. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.259695 - https://vuldb.com/?ctiid.259695 - https://vuldb.com/?submit.312248 - https://github.com/fubxx/CVE/blob/main/PrisonManagementSystemSQL5.md
CVE ID: CVE-2024-3443 State: PUBLISHED Published: 2024-04-08T15:00:05.527Z Last Updated: 2024-08-21T21:19:02.356Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: SourceCodester Products: Prison Management System Problem Types: CWE-79 Description: A vulnerability classified as problematic was found in SourceCodester Prison Management System 1.0. This vulnerability affects unknown code of the file /Employee/apply_leave.php. The manipulation of the argument txtstart_date/txtend_date leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-259696. Additional Analyst No
been disclosed to the public and may be used. The identifier of this vulnerability is VDB-259696. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.259696 - https://vuldb.com/?ctiid.259696 - https://vuldb.com/?submit.312285 - https://github.com/zyairelai/CVE-submissions/blob/main/prison-xss.md
CVE ID: CVE-2024-3444 State: PUBLISHED Published: 2024-04-08T15:00:07.096Z Last Updated: 2024-08-01T20:12:07.557Z Severity: N/A (CVSS 5.8 AV:N/AC:L/Au:M/C:P/I:P/A:P) Vendors: Wangshen Products: SecGate 3600 Problem Types: CWE-434 Description: A vulnerability was found in Wangshen SecGate 3600 up to 20240408. It has been classified as critical. This affects an unknown part of the file /?g=net_pro_keyword_import_save. The manipulation of the argument reqfile leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-259701 was assigned to this vulnerability. Additional Analyst Notes: - CISA ADP
lic and may be used. The identifier VDB-259701 was assigned to this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.259701 - https://vuldb.com/?ctiid.259701 - https://vuldb.com/?submit.312293 - https://github.com/h0e4a0r1t/lLGcmVjGkR/blob/main/Wangshen%20SecGata%203600%20Firewall%20net_pro_keyword_import_save%20arbitrary%20file%20upload%20vulnerability.pdf
CVE ID: CVE-2024-3445 State: PUBLISHED Published: 2024-04-08T15:31:04.755Z Last Updated: 2024-08-01T20:12:06.867Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: SourceCodester Products: Laundry Management System Problem Types: CWE-89 Description: A vulnerability was found in SourceCodester Laundry Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /karyawan/laporan_filter. The manipulation of the argument data_karyawan leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-259702 is the identifier assigned to this vulnerability. Additional Analyst N
sclosed to the public and may be used. VDB-259702 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.259702 - https://vuldb.com/?ctiid.259702 - https://vuldb.com/?submit.312296 - https://github.com/fubxx/CVE/blob/main/LaundryManagementSystemSQL.md
CVE ID: CVE-2024-3446 State: PUBLISHED Published: 2024-04-09T19:34:45.646Z Last Updated: 2025-05-02T23:02:59.338Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: Red Hat Products: Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8 Advanced Virtualization, Red Hat Enterprise Linux 9 Problem Types: CWE-415 Description: A double free vulnerability was found in QEMU virtio devices (virtio-gpu, virtio-serial-bus, virtio-crypto), where the mem_reentrancy_guard flag insufficiently protects against DMA reentrancy issues. This issue could allow a malicious privileged guest user to crash the QEMU process on the
against DMA reentrancy issues. This issue could allow a malicious privileged guest user to crash the QEMU process on the host, resulting in a denial of service or allow arbitrary code execution within the context of the QEMU process on the host. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2024:6964 - https://access.redhat.com/security/cve/CVE-2024-3446 - https://bugzilla.redhat.com/show_bug.cgi?id=2274211 - https://patchew.org/QEMU/20240409105537.18308-1-philmd@linaro.org/
CVE ID: CVE-2024-3447 State: PUBLISHED Published: 2024-11-14T12:10:36.880Z Last Updated: 2025-11-03T19:29:52.539Z Severity: MEDIUM (CVSS 6 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H) Vendors: Red Hat Products: Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 8 Advanced Virtualization, Red Hat Enterprise Linux 9 Problem Types: CWE-122 Description: A heap-based buffer overflow was found in the SDHCI device emulation of QEMU. The bug is triggered when both `s->data_count` and the size of `s->fifo_buffer` are set to 0x200, leading to an out-of-bound access. A malicious guest could use this flaw to crash the QEMU process on the host, r
0x200, leading to an out-of-bound access. A malicious guest could use this flaw to crash the QEMU process on the host, resulting in a denial of service condition. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://access.redhat.com/security/cve/CVE-2024-3447 - https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=58813 - https://bugzilla.redhat.com/show_bug.cgi?id=2274123 - https://patchew.org/QEMU/20240404085549.16987-1-philmd@linaro.org/
CVE ID: CVE-2024-3448 State: PUBLISHED Published: 2024-04-10T13:59:46.536Z Last Updated: 2024-08-01T20:12:07.447Z Severity: MEDIUM (CVSS 5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N) Vendors: Mautic Products: Mautic Problem Types: CWE-918 Description: Users with low privileges can perform certain AJAX actions. In this vulnerability instance, improper access to ajax?action=plugin:focus:checkIframeAvailability leads to a Server-Side Request Forgery by analyzing the error messages returned from the back-end. Allowing an attacker to perform a port scan in the back-end. At the time of publication of the CVE no patch is available. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program
time of publication of the CVE no patch is available. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://huntr.com/bounties/4d72d300-92d6-4e3c-93d8-52fe47396ae0
CVE ID: CVE-2024-3449 State: REJECTED Published: N/A Last Updated: 2025-02-11T01:05:57.166Z Description: No description available.