Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-9504 State: PUBLISHED Published: 2024-11-26T07:31:31.040Z Last Updated: 2024-11-26T14:56:44.060Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) Vendors: wpdevart Products: Booking calendar, Appointment Booking System Problem Types: CWE-434 Description: The Booking calendar, Appointment Booking System plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 3.2.15 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file. Additional Ana
tackers to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/1fb05281-205f-4d9c-aac9-2b37e069a6fb?source=cve - https://plugins.trac.wordpress.org/changeset/3195800/booking-calendar - https://hacked.be/posts/CVE-2024-9504
CVE ID: CVE-2024-9505 State: PUBLISHED Published: 2024-10-29T13:53:55.805Z Last Updated: 2024-10-29T14:49:19.015Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: justinbusa Products: Beaver Builder – WordPress Page Builder Problem Types: CWE-79 Description: The Beaver Builder – WordPress Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Button widget in all versions up to, and including, 2.8.4.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages
possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/7cfab048-efc6-4c7c-a1bd-0a9daf8779bc?source=cve - https://wordpress.org/plugins/beaver-builder-lite-version/#developers - https://plugins.trac.wordpress.org/changeset/3177345/ - https://www.wpbeaverbuilder.com/change-logs/
CVE ID: CVE-2024-9506 State: PUBLISHED Published: 2024-10-15T15:40:04.627Z Last Updated: 2024-10-15T16:10:56.576Z Severity: LOW (CVSS 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: vue Products: vue Problem Types: CWE-1333 Description: Improper regular expression in Vue's parseHTML function leads to a potential regular expression denial of service vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.herodevs.com/vulnerability-directory/cve-2024-9506
CVE ID: CVE-2024-9507 State: PUBLISHED Published: 2024-10-11T07:37:45.931Z Last Updated: 2024-10-11T15:21:23.094Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) Vendors: bitpressadmin Products: Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder Problem Types: CWE-20 Description: The Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder plugin for WordPress is vulnerable to arbitrary file read in all versions up to, and including, 2.15.2 due to improper input validation within the iconUpload function. This makes it possible for authen
and including, 2.15.2 due to improper input validation within the iconUpload function. This makes it possible for authenticated attackers, with Administrator-level access and above, to leverage a PHP filter chain attack and read the contents of arbitrary files on the server, which can contain sensitive information. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/aa46842f-ed07-4f72-aedb-aa27baecd79c?source=cve - https://plugins.trac.wordpress.org/browser/bit-form/trunk/includes/Admin/AdminAjax.php#L1210 - https://wordpress.org/plugins/bit-form/#developers - https://plugins.trac.wordpress.org/changeset/3165686/bit-form/
10 - https://wordpress.org/plugins/bit-form/#developers - https://plugins.trac.wordpress.org/changeset/3165686/bit-form/trunk/includes/Admin/AdminAjax.php - https://plugins.trac.wordpress.org/changeset/3165686/
CVE ID: CVE-2024-9508 State: PUBLISHED Published: 2024-12-13T00:49:03.188Z Last Updated: 2024-12-13T21:14:18.861Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Horner Automation Products: Cscape Problem Types: CWE-125 Description: Horner Automation Cscape contains a memory corruption vulnerability, which could allow an attacker to disclose information and execute arbitrary code. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-24-345-05 - https://hornerautomation.com/cscape-software-free/cscape-software/
CVE ID: CVE-2024-9511 State: PUBLISHED Published: 2024-11-23T07:38:05.537Z Last Updated: 2024-11-24T18:33:24.437Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: techjewel Products: FluentSMTP – WP SMTP Plugin with Amazon SES, SendGrid, MailGun, Postmark, Google and Any SMTP Provider Problem Types: CWE-502 Description: The FluentSMTP – WP SMTP Plugin with Amazon SES, SendGrid, MailGun, Postmark, Google and Any SMTP Provider plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.2.82 via deserialization of untrusted input in the 'formatResult' function. This makes it possible for unauthenticated attackers to injec
ization of untrusted input in the 'formatResult' function. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code. The vulnerability was partially patched in version 2.2.82. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/a3deedc4-b939-4c54-8376-95d3728872d4?source=cve - https://plugins.trac.wordpress.org/browser/fluent-smtp/trunk/app/Models/Logger.php#L1
c54-8376-95d3728872d4?source=cve - https://plugins.trac.wordpress.org/browser/fluent-smtp/trunk/app/Models/Logger.php#L157 - https://plugins.trac.wordpress.org/changeset/3194359/ - https://plugins.trac.wordpress.org/changeset/3194555/
CVE ID: CVE-2024-9512 State: PUBLISHED Published: 2025-06-12T14:02:55.123Z Last Updated: 2025-06-12T14:13:37.117Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: GitLab Products: GitLab Problem Types: CWE-367 Description: An issue has been discovered in GitLab EE affecting all versions prior to 17.10.8, 17.11 prior to 17.11.4, and 18.0 prior to 18.0.2. It may have been possible for private repository to be cloned in case of race condition when a secondary node is out of sync. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/497748 - https://hackerone.com/reports/2683469
CVE ID: CVE-2024-9513 State: PUBLISHED Published: 2024-10-04T12:31:03.905Z Last Updated: 2024-10-07T20:27:36.068Z Severity: LOW (CVSS 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Netadmin Software Products: NetAdmin IAM Problem Types: CWE-203 Description: A vulnerability was found in Netadmin Software NetAdmin IAM up to 3.5 and classified as problematic. Affected by this issue is some unknown functionality of the file /controller/api/Answer/ReturnUserQuestionsFilled of the component HTTP POST Request Handler. The manipulation of the argument username leads to information exposure through discrepancy. The attack may be launched remotely. The complexity of an attack is rather hig
information exposure through discrepancy. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure is planning to release a fix in mid-October 2024. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.279212 - https://vuldb.com/?ctiid.279212 - https://vuldb.com/?submit.413498
CVE ID: CVE-2024-9514 State: PUBLISHED Published: 2024-10-04T13:31:05.233Z Last Updated: 2024-10-04T14:06:54.282Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C) Vendors: D-Link Products: DIR-605L Problem Types: CWE-120 Description: A vulnerability was found in D-Link DIR-605L 2.13B01 BETA. It has been declared as critical. This vulnerability affects the function formSetDomainFilter of the file /goform/formSetDomainFilter. The manipulation of the argument curTime leads to buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.279214 - https://
nd may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.279214 - https://vuldb.com/?ctiid.279214 - https://vuldb.com/?submit.413874 - https://github.com/noahze01/IoT-vulnerable/blob/main/D-Link/DIR-605L/formSetDomainFilter.md - https://www.dlink.com/
CVE ID: CVE-2024-9515 State: PUBLISHED Published: 2024-10-04T14:00:05.476Z Last Updated: 2024-10-04T14:46:09.557Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C) Vendors: D-Link Products: DIR-605L Problem Types: CWE-120 Description: A vulnerability was found in D-Link DIR-605L 2.13B01 BETA. It has been classified as critical. This affects the function formSetQoS of the file /goform/formSetQoS. The manipulation of the argument curTime leads to buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.279213 - https://vuldb.com/?ctiid.279
tional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.279213 - https://vuldb.com/?ctiid.279213 - https://vuldb.com/?submit.413878 - https://github.com/noahze01/IoT-vulnerable/blob/main/D-Link/DIR-605L/formSetQoS.md - https://www.dlink.com/
CVE ID: CVE-2024-9518 State: PUBLISHED Published: 2024-10-10T02:06:05.859Z Last Updated: 2024-10-10T17:53:12.553Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: userplus Products: User registration & user profile – UserPlus Problem Types: CWE-269 Description: The UserPlus plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 2.0 due to insufficient restriction on the 'form_actions' and 'userplus_update_user_profile' functions. This makes it possible for unauthenticated attackers to specify their user role by supplying the 'role' parameter during a registration. Additional Analyst Notes: - CISA ADP Vulnrichment: Refer
r role by supplying the 'role' parameter during a registration. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/2489e649-27f7-4ca0-8655-0957016fa89a?source=cve - https://plugins.trac.wordpress.org/browser/userplus/trunk/functions/user-functions.php?rev=1604604#L47
CVE ID: CVE-2024-9519 State: PUBLISHED Published: 2024-10-10T02:06:03.574Z Last Updated: 2024-10-10T17:58:23.884Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: userplus Products: User registration & user profile – UserPlus Problem Types: CWE-266 Description: The UserPlus plugin for WordPress is vulnerable to unauthorized modification of data due to an improper capability check on the 'save_metabox_form' function in versions up to, and including, 2.0. This makes it possible for authenticated attackers, with editor-level permissions or above, to update the registration form role to administrator, which leads to privilege escalation. Additional Analyst Notes: -
to update the registration form role to administrator, which leads to privilege escalation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/1148b18d-7af1-41c6-bd7f-1b2d53cb44e6?source=cve - https://plugins.trac.wordpress.org/browser/userplus/trunk/admin/admin-post-metaboxes.php?rev=1627771#L62
CVE ID: CVE-2024-9520 State: PUBLISHED Published: 2024-10-10T02:06:13.172Z Last Updated: 2024-10-10T14:25:35.021Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: userplus Products: User registration & user profile – UserPlus Problem Types: CWE-862 Description: The UserPlus plugin for WordPress is vulnerable to unauthorized access, modification, and loss of data due to a missing capability check on multiple functions in all versions up to, and including, 2.0. This makes it possible for authenticated attackers with subscriber-level permissions or above, to add, modify, or delete user meta and plugin options. Additional Analyst Notes: - CISA ADP Vulnrichment: R
s or above, to add, modify, or delete user meta and plugin options. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/e64e41a1-ea8e-41b4-911c-672caf0d2df1?source=cve - https://plugins.trac.wordpress.org/browser/userplus/trunk/admin/admin-ajax.php?rev=1627771#L216 - https://plugins.trac.wordpress.org/browser/userplus/trunk/admin/admin-ajax.php?rev=1627771#L225 - https://plugins.trac.wordpress.org/browser/userplus/trunk/admin/admin-ajax.php?rev=1627771#L186
CVE ID: CVE-2024-9521 State: PUBLISHED Published: 2024-10-16T02:04:59.979Z Last Updated: 2024-10-16T14:10:52.686Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: india-web-developer Products: SEO Manager Problem Types: CWE-79 Description: The SEO Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via post meta in versions up to, and including, 1.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additio
ermissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/17457ff2-917d-4cc4-8c5e-c80cd320cc90?source=cve - https://plugins.trac.wordpress.org/browser/seo-manager/trunk/seo-manager.php?rev=2963205#L458
CVE ID: CVE-2024-9522 State: PUBLISHED Published: 2024-10-10T02:06:06.456Z Last Updated: 2024-10-10T17:47:02.026Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: lagunaisw Products: WP Users Masquerade Problem Types: CWE-288 Description: The WP Users Masquerade plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.0.0. This is due to incorrect authentication and capability checking in the 'ajax_masq_login' function. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to log in as any existing user on the site, such as an administrator. Additional Analyst Notes: - CISA ADP Vu
and above, to log in as any existing user on the site, such as an administrator. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/4a4f0909-76f6-4d27-87b1-f6cd5f5cbbb7?source=cve - https://plugins.trac.wordpress.org/browser/wp-users-masquerade/trunk/masquerade.php?rev=1703860#L162
CVE ID: CVE-2024-9524 State: PUBLISHED Published: 2025-05-09T15:37:23.621Z Last Updated: 2025-05-09T17:03:15.931Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Aira Products: Prime Problem Types: CWE-59 Description: Link Following Local Privilege Escalation Vulnerability in System Speedup Service in Avira Operations GmbH Avira Prime Version 1.1.96.2 on Windows 10 x64 allows local attackers to escalate privileges and execute arbitrary code in the context of SYSTEM via creating a symbolic link and leveraging a TOCTTOU (time-of-check to time-of-use) attack. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.gendigital.com/us/en/contact
f-use) attack. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.gendigital.com/us/en/contact-us/security-advisories/
CVE ID: CVE-2024-9526 State: PUBLISHED Published: 2024-11-18T13:30:21.818Z Last Updated: 2024-11-21T10:24:31.751Z Vendors: Kubeflow Products: Kubeflow Pipeline View Problem Types: CWE-79 Description: There exists a stored XSS Vulnerability in Kubeflow Pipeline View web UI. The Kubeflow Web UI allows to create new pipelines. When creating a new pipeline, it is possible to add a description. The description field allows html tags, which are not filtered properly. Leading to a stored XSS. We recommend upgrading past commit 930c35f1c543998e60e8d648ce93185c9b5dbe8d Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/kubeflow/pipelines/pull/10315
CVE ID: CVE-2024-9528 State: PUBLISHED Published: 2024-10-05T02:34:50.316Z Last Updated: 2024-10-07T14:19:44.490Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: techjewel Products: Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder Problem Types: CWE-79 Description: The Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via form label fields in all versions up to, and including, 5.1.19 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with access to edit forms (a
input sanitization and output escaping. This makes it possible for authenticated attackers, with access to edit forms (administrator by default), to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/4ed4dfee-5f14-47ce-abed-cd226c110665?source=cve - https://plugins.trac.wordpress.org/browser/fluentform/tags/5.1.17/app/Services/FormBuilder/Components/BaseComponent.php#L191 - https://plugins.trac.wordpress.org/browser/fluentform/tags/5.1.17/boot/globals.php#L342 - https://plugins.trac.wordpress.org/changeset/3125227/
CVE ID: CVE-2024-9529 State: PUBLISHED Published: 2024-11-15T06:00:08.369Z Last Updated: 2024-11-15T18:38:37.432Z Vendors: Unknown Products: Secure Custom Fields, Advanced Custom Fields Pro Problem Types: CWE-94 Improper Control of Generation of Code ('Code Injection') Description: The Secure Custom Fields WordPress plugin before 6.3.9, Secure Custom Fields WordPress plugin before 6.3.6.3, Advanced Custom Fields Pro WordPress plugin before 6.3.9 does not prevent users from running arbitrary functions through its setting import functionalities, which could allow high privilege users such as admin to run arbitrary PHP functions. Additional Analyst Notes: - CISA ADP Vulnrichment: References: -
ge users such as admin to run arbitrary PHP functions. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/dd3cc8d8-4dff-47f9-b036-5d09f2c7e5f2/
CVE ID: CVE-2024-9530 State: PUBLISHED Published: 2024-10-23T07:34:54.225Z Last Updated: 2024-10-23T13:46:08.818Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: qodeinteractive Products: Qi Addons For Elementor Problem Types: CWE-200 Description: The Qi Addons For Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.8.0 via private templates. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensitive data including the contents of templates that are private. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.word
ontents of templates that are private. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/0dd93514-657c-4b04-931a-23f3d405fb88?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3170536%40qi-addons-for-elementor%2Ftrunk&old=3159768%40qi-addons-for-elementor%2Ftrunk&sfp_email=&sfph_mail=
CVE ID: CVE-2024-9531 State: PUBLISHED Published: 2024-10-24T07:35:55.646Z Last Updated: 2024-10-24T18:33:56.226Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: wcmp Products: MultiVendorX – The Ultimate WooCommerce Multivendor Marketplace Solution Problem Types: CWE-285 Description: The MultiVendorX – The Ultimate WooCommerce Multivendor Marketplace Solution plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'mvx_sent_deactivation_request' function in all versions up to, and including, 4.2.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to send a ca
cluding, 4.2.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to send a canned email to the site's administrator asking to delete the profile of an arbitrary vendor. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/5af1063c-615e-4196-9fa6-960c008544c4?source=cve - https://plugins.trac.wordpress.org/browser/dc-woocommerce-multi-vendor/trunk/classes/class-mvx-ajax.php#L3780 - https://plugins.trac.wordpress.org/changeset/3173238/dc-woocommerce-multi-vendor/trunk/classes/class-mvx-ajax.php?contextall=1&old=3168957&old_path=%2Fdc-woocommerce-multi-vendor%2Ftrunk%2Fclasses%2Fclas
unk/classes/class-mvx-ajax.php?contextall=1&old=3168957&old_path=%2Fdc-woocommerce-multi-vendor%2Ftrunk%2Fclasses%2Fclass-mvx-ajax.php
CVE ID: CVE-2024-9532 State: PUBLISHED Published: 2024-10-05T08:00:07.102Z Last Updated: 2024-10-07T13:50:25.468Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C) Vendors: D-Link Products: DIR-605L Problem Types: CWE-120 Description: A vulnerability has been found in D-Link DIR-605L 2.13B01 BETA and classified as critical. This vulnerability affects the function formAdvanceSetup of the file /goform/formAdvanceSetup. The manipulation of the argument webpage leads to buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.279238 - https://vuldb.co
e used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.279238 - https://vuldb.com/?ctiid.279238 - https://vuldb.com/?submit.413880 - https://github.com/abcdefg-png/IoT-vulnerable/blob/main/D-Link/DIR-605L/formAdvanceSetup.md - https://www.dlink.com/
CVE ID: CVE-2024-9533 State: PUBLISHED Published: 2024-10-05T13:00:07.156Z Last Updated: 2024-10-07T13:50:18.818Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C) Vendors: D-Link Products: DIR-605L Problem Types: CWE-120 Description: A vulnerability was found in D-Link DIR-605L 2.13B01 BETA and classified as critical. This issue affects the function formDeviceReboot of the file /goform/formDeviceReboot. The manipulation of the argument next_page leads to buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.279239 - https://vuldb.com/?ctiid.27
itional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.279239 - https://vuldb.com/?ctiid.279239 - https://vuldb.com/?submit.413883 - https://github.com/abcdefg-png/IoT-vulnerable/blob/main/D-Link/DIR-605L/formDeviceReboot.md - https://www.dlink.com/