Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-42797 State: PUBLISHED Published: 2024-09-24T00:00:00 Last Updated: 2024-09-24T18:28:14.879Z Vendors: n/a Products: n/a Problem Types: n/a Description: An Incorrect Access Control vulnerability was found in /music/ajax.php?action=delete_playlist in Kashipara Music Management System v1.0. This vulnerability allows an unauthenticated attacker to delete the valid music playlist entries. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/takekaramey/CVE_Writeup/blob/main/Kashipara/Music%20Management%20System%20v1.0/Broken%20Access%20Control%20-%20Delete%20Playlist.pdf
CVE ID: CVE-2024-42798 State: PUBLISHED Published: 2024-09-16T00:00:00 Last Updated: 2024-09-18T15:41:30.912Z Vendors: n/a Products: n/a Problem Types: n/a Description: An Incorrect Access Control vulnerability was found in /music/index.php?page=user_list and /music/index.php?page=edit_user in Kashipara Music Management System v1.0. This allows a low privileged attacker to take over the administrator account. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.kashipara.com/ - https://github.com/takekaramey/CVE_Writeup/blob/main/Kashipara/Music%20Management%20System%20v1.0/Broken%20Access%20Control%20-%20Priv%20Esc%20-%20Save%20Edit%20User%20-%20AC%20Takeover.pdf
CVE ID: CVE-2024-42812 State: PUBLISHED Published: 2024-08-19T00:00:00.000Z Last Updated: 2025-03-17T15:13:26.867Z Vendors: n/a Products: n/a Problem Types: n/a Description: In D-Link DIR-860L v2.03, there is a buffer overflow vulnerability due to the lack of length verification for the SID field in gena.cgi. Attackers who successfully exploit this vulnerability can cause the remote target device to crash or execute arbitrary commands. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.dlink.com/en/security-bulletin/ - https://gist.github.com/XiaoCurry/574ed9c2b0d12cd0b45399116d82121c
CVE ID: CVE-2024-42813 State: PUBLISHED Published: 2024-08-19T00:00:00 Last Updated: 2024-08-19T20:19:42.764Z Vendors: n/a Products: n/a Problem Types: n/a Description: In TRENDnet TEW-752DRU FW1.03B01, there is a buffer overflow vulnerability due to the lack of length verification for the service field in gena.cgi. Attackers who successfully exploit this vulnerability can cause the remote target device to crash or execute arbitrary commands. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gist.github.com/XiaoCurry/204680035c1efffa27d14956820ad928
CVE ID: CVE-2024-42815 State: PUBLISHED Published: 2024-08-19T00:00:00 Last Updated: 2024-10-24T19:43:03.259Z Vendors: n/a Products: n/a Problem Types: n/a Description: In the TP-Link RE365 V1_180213, there is a buffer overflow vulnerability due to the lack of length verification for the USER_AGENT field in /usr/bin/httpd. Attackers who successfully exploit this vulnerability can cause the remote target device to crash or execute arbitrary commands. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gist.github.com/XiaoCurry/14d46e0becd79d9bb9907f2fbe147cfe - https://securityonline.info/cve-2024-42815-cvss-9-8-buffer-overflow-flaw-in-tp-link-routers-opens-door-to-rce/
CVE ID: CVE-2024-42816 State: PUBLISHED Published: 2024-08-26T00:00:00 Last Updated: 2024-08-27T14:04:08.537Z Vendors: n/a Products: n/a Problem Types: n/a Description: A cross-site scripting (XSS) vulnerability in the Create Product function of fastapi-admin pro v0.1.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Product Name parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://fastapi-admin-pro.long2ice.io/admin/login - https://github.com/fastapi-admin/fastapi-admin/issues/172
CVE ID: CVE-2024-42818 State: PUBLISHED Published: 2024-08-26T00:00:00 Last Updated: 2024-08-26T17:21:18.478Z Vendors: n/a Products: n/a Problem Types: n/a Description: A cross-site scripting (XSS) vulnerability in the Config-Create function of fastapi-admin pro v0.1.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Product Name parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://fastapi-admin-pro.long2ice.io/admin/login - https://github.com/fastapi-admin/fastapi-admin/issues/172
CVE ID: CVE-2024-42831 State: PUBLISHED Published: 2024-10-07T00:00:00 Last Updated: 2024-10-07T19:33:36.654Z Vendors: n/a Products: n/a Problem Types: n/a Description: A reflected cross-site scripting (XSS) vulnerability in Elaine's Realtime CRM Automation v6.18.17 allows attackers to execute arbitrary JavaScript code in the web browser of a user via injecting a crafted payload into the dialog parameter at wrapper_dialog.php. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://elaine.com - http://realtime.com - https://seclists.org/fulldisclosure/2024/Sep/49
CVE ID: CVE-2024-42834 State: PUBLISHED Published: 2024-11-13T00:00:00 Last Updated: 2024-11-18T19:28:51.798Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stored cross-site scripting (XSS) vulnerability in the Create Customer API in Incognito Service Activation Center (SAC) UI v14.11 allows authenticated attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the lastName parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/CyberSec-Supra/CVE-2024-42834
CVE ID: CVE-2024-42835 State: PUBLISHED Published: 2024-10-31T00:00:00 Last Updated: 2024-10-31T18:31:02.701Z Vendors: n/a Products: n/a Problem Types: n/a Description: langflow v1.0.12 was discovered to contain a remote code execution (RCE) vulnerability via the PythonCodeTool component. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/langflow-ai/langflow/issues/2908
CVE ID: CVE-2024-42843 State: PUBLISHED Published: 2024-08-15T00:00:00 Last Updated: 2024-08-19T18:36:07.165Z Vendors: n/a Products: n/a Problem Types: n/a Description: Projectworlds Online Examination System v1.0 is vulnerable to SQL Injection via the subject parameter in feed.php. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/ganzhi-qcy/cve/issues/6
CVE ID: CVE-2024-42844 State: PUBLISHED Published: 2025-03-06T00:00:00.000Z Last Updated: 2025-03-06T16:13:22.982Z Vendors: n/a Products: n/a Problem Types: n/a Description: A SQL Injection vulnerability has been identified in EPICOR Prophet 21 (P21) up to 23.2.5232. This vulnerability allows authenticated remote attackers to execute arbitrary SQL commands through unsanitized user input fields to obtain unauthorized information Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gist.github.com/getHecked/dc4ae46526d181d3deb17092815b9bec
CVE ID: CVE-2024-42845 State: PUBLISHED Published: 2024-08-23T00:00:00 Last Updated: 2024-08-28T15:15:47.698Z Vendors: n/a Products: n/a Problem Types: n/a Description: An eval Injection vulnerability in the component invesalius/reader/dicom.py of InVesalius 3.1.99991 through 3.1.99998 allows attackers to execute arbitrary code via loading a crafted DICOM file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/invesalius/invesalius3 - https://github.com/invesalius/invesalius3/releases - https://github.com/partywavesec/invesalius3_vulnerabilities/tree/main/CVE-2024-42845
CVE ID: CVE-2024-42849 State: PUBLISHED Published: 2024-08-16T00:00:00 Last Updated: 2024-08-16T19:45:36.959Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in Silverpeas v.6.4.2 and lower allows a remote attacker to cause a denial of service via the password change function. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://silverpeas.com - https://github.com/njmbb8/CVE-2024-42849/tree/main
CVE ID: CVE-2024-42850 State: PUBLISHED Published: 2024-08-16T00:00:00 Last Updated: 2024-08-19T16:06:59.626Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in the password change function of Silverpeas v6.4.2 and lower allows for the bypassing of password complexity requirements. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://silverpeas.com - https://github.com/njmbb8/CVE-2024-42850
CVE ID: CVE-2024-42851 State: PUBLISHED Published: 2024-08-27T00:00:00 Last Updated: 2024-08-28T20:05:30.034801 Vendors: n/a Products: n/a Problem Types: n/a Description: Buffer Overflow vulnerability in open source exiftags v.1.01 allows a local attacker to execute arbitrary code via the paresetag function. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/T1anyang/fuzzing/tree/main/exiftags
CVE ID: CVE-2024-42852 State: PUBLISHED Published: 2024-08-23T00:00:00 Last Updated: 2024-08-23T18:55:18.809Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting vulnerability in AcuToWeb server v.10.5.0.7577C8b allows a remote attacker to execute arbitrary code via the index.php component. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Hebing123/cve/issues/64
CVE ID: CVE-2024-42861 State: PUBLISHED Published: 2024-09-23T00:00:00.000Z Last Updated: 2025-03-18T15:41:45.235Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in IEEE 802.1AS linuxptp v.4.2 and before allowing a remote attacker to cause a denial of service via a crafted Pdelay_Req message to the time synchronization function Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/qiupy123/CVE-2024-42861
CVE ID: CVE-2024-42885 State: PUBLISHED Published: 2024-09-05T00:00:00 Last Updated: 2024-09-05T18:04:44.579Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL Injection vulnerability in ESAFENET CDG 5.6 and before allows an attacker to execute arbitrary code via the id parameter of the data.jsp page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://supervisor0.notion.site/ESAFENET-CDG-SQL-Injection-17d7e244810147f697c3c42a884f932b
CVE ID: CVE-2024-42898 State: PUBLISHED Published: 2025-01-09T00:00:00 Last Updated: 2025-01-10T17:20:56.573Z Vendors: n/a Products: n/a Problem Types: n/a Description: A cross-site scripting (XSS) vulnerability in Nagios XI 2024R1.1.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name parameter in the Account Settings page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.nagios.com/products/security/ - https://github.com/simalamuel/Research/tree/main/CVE-2024-42898
CVE ID: CVE-2024-42900 State: PUBLISHED Published: 2024-08-28T00:00:00 Last Updated: 2024-08-28T15:58:49.592Z Vendors: n/a Products: n/a Problem Types: n/a Description: Ruoyi v4.7.9 and before was discovered to contain a cross-site scripting (XSS) vulnerability via the sql parameter of the createTable() function at /tool/gen/create. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitee.com/y_project/RuoYi - https://g03m0n.github.io/posts/cve-2024-42900/
CVE ID: CVE-2024-42901 State: PUBLISHED Published: 2024-09-03T00:00:00 Last Updated: 2024-09-03T19:24:16.779Z Vendors: n/a Products: n/a Problem Types: n/a Description: A CSV injection vulnerability in Lime Survey v6.5.12 allows attackers to execute arbitrary code via uploading a crafted CSV file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/LimeSurvey/LimeSurvey/pull/3884 - https://github.com/sysentr0py/CVEs/tree/main/CVE-2024-42901
CVE ID: CVE-2024-42902 State: PUBLISHED Published: 2024-09-03T00:00:00 Last Updated: 2024-09-03T18:05:01.447Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in the js_localize.php function of LimeSurvey v6.6.2 and before allows attackers to execute arbitrary code via injecting a crafted payload into the lng parameter of the js_localize.php function Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/LimeSurvey/LimeSurvey/blob/6434b12ded1c4b6516200c453441d0896e11eee0/vendor/kcfinder/js_localize.php#L19 - https://bugs.limesurvey.org/view.php?id=19639 - https://github.com/sysentr0py/CVEs/tree/main/CVE-2024-42902
CVE ID: CVE-2024-42903 State: PUBLISHED Published: 2024-09-03T00:00:00.000Z Last Updated: 2025-03-13T20:30:26.321Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Host header injection vulnerability in the password reset function of LimeSurvey v.6.6.1+240806 and before allows attackers to send users a crafted password reset link that will direct victims to a malicious domain. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/LimeSurvey/LimeSurvey/pull/3920 - https://github.com/LimeSurvey/LimeSurvey/compare/6.6.0+240729...6.6.1+240806 - https://github.com/sysentr0py/CVEs/tree/main/CVE-2024-42903
CVE ID: CVE-2024-42904 State: PUBLISHED Published: 2024-09-03T00:00:00.000Z Last Updated: 2025-03-13T14:41:46.379Z Vendors: n/a Products: n/a Problem Types: n/a Description: A cross-site scripting (XSS) vulnerability in SysPass 3.2.x allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the name parameter at /Controllers/ClientController.php. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/nuxsmin/sysPass/blob/9d0e169d2163897238877fb65130db47fe1ddcfa/app/modules/api/Controllers/ClientController.php#L89 - https://github.com/nuxsmin/sysPass/blob/master/lib/SP/DataModel/ClientData.php#L98 - https://github.com/sysentr0p
#L89 - https://github.com/nuxsmin/sysPass/blob/master/lib/SP/DataModel/ClientData.php#L98 - https://github.com/sysentr0py/CVEs/tree/main/CVE-2024-42904
CVE ID: CVE-2024-42905 State: PUBLISHED Published: 2024-08-28T00:00:00 Last Updated: 2024-08-28T18:36:15.152Z Vendors: n/a Products: n/a Problem Types: n/a Description: Beijing Digital China Cloud Technology Co., Ltd. DCME-320 v.7.4.12.60 has a command execution vulnerability, which can be exploited to obtain device administrator privileges via the getVar function in the code/function/system/tool/ping.php file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://immense-mirror-b42.notion.site/Beijing-Digital-China-Yunke-Information-Technology-Co-Ltd-DCN-firewall-has-a-command-execution-vuln-31bdd1228f6d47c09e854af5f0e7059f - https://github.com/ZackSecurity/VulnerReport/b
-firewall-has-a-command-execution-vuln-31bdd1228f6d47c09e854af5f0e7059f - https://github.com/ZackSecurity/VulnerReport/blob/cve/DCN/1.md
CVE ID: CVE-2024-42906 State: PUBLISHED Published: 2024-08-26T00:00:00 Last Updated: 2024-08-26T20:48:33.520Z Vendors: n/a Products: n/a Problem Types: n/a Description: TestLink before v.1.9.20 is vulnerable to Cross Site Scripting (XSS) via the pop-up on upload file. When uploading a file, the XSS payload can be entered into the file name. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://testlink.org/ - https://github.com/Alkatraz97/CVEs/blob/main/CVE-2024-42906.md
CVE ID: CVE-2024-42911 State: PUBLISHED Published: 2025-01-14T00:00:00.000Z Last Updated: 2025-02-03T15:53:36.840Z Vendors: n/a Products: n/a Problem Types: n/a Description: ECOVACS Robotics Deebot T20 OMNI and T20e OMNI before 1.24.0 was discovered to contain a WiFi Remote Code Execution vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://ecovacs.com - https://www.ecovacs.com/global/userhelp/dsa20250113001
CVE ID: CVE-2024-42912 State: PUBLISHED Published: 2025-07-16T00:00:00.000Z Last Updated: 2025-07-16T20:42:30.290Z Vendors: n/a Products: n/a Problem Types: n/a Description: A cross-site scripting (XSS) vulnerability in META-INF Kft. Email This Issue (Data Center) before 9.13.0-GA allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the recipient field of an e-mail message. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://tracker.bugcrowd.com/metainfkft/submissions/51e58658-220e-4614-b605-c8d662b5c426 - https://docs.meta-inf.hu/email-this-issue/email-this-issue-for-jira-server-data-center/misc/security-advisories/email-this-is
://docs.meta-inf.hu/email-this-issue/email-this-issue-for-jira-server-data-center/misc/security-advisories/email-this-issue-security-advisory-2025-06-30
CVE ID: CVE-2024-42913 State: PUBLISHED Published: 2024-08-26T00:00:00.000Z Last Updated: 2025-03-26T21:19:29.325Z Vendors: n/a Products: n/a Problem Types: n/a Description: RuoYi CMS v4.7.9 was discovered to contain a SQL injection vulnerability via the job_id parameter at /sasfs1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/kkll5875
CVE ID: CVE-2024-42914 State: PUBLISHED Published: 2024-08-23T00:00:00 Last Updated: 2024-08-26T16:22:58.840Z Vendors: n/a Products: n/a Problem Types: n/a Description: A host header injection vulnerability exists in the forgot password functionality of ArrowCMS version 1.0.0. By sending a specially crafted host header in the forgot password request, it is possible to send password reset links to users which, once clicked, lead to an attacker-controlled server and thus leak the password reset token. This may allow an attacker to reset other users' passwords. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/trquoccuong/ArrowCMS/ - https://github.com/soursec/
yst Notes: - CISA ADP Vulnrichment: References: - https://github.com/trquoccuong/ArrowCMS/ - https://github.com/soursec/CVEs/tree/main/CVE-2024-42914
CVE ID: CVE-2024-42915 State: PUBLISHED Published: 2024-08-23T00:00:00 Last Updated: 2024-08-23T18:07:55.606Z Vendors: n/a Products: n/a Problem Types: n/a Description: A host header injection vulnerability in Staff Appraisal System v1.0 allows attackers to obtain the password reset token via user interaction with a crafted password reset link. This will allow attackers to arbitrarily reset other users' passwords and compromise their accounts. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/debashish-choudhury/staff-appraisal-system/ - https://github.com/soursec/CVEs/tree/main/CVE-2024-42915
CVE ID: CVE-2024-42918 State: PUBLISHED Published: 2024-08-23T00:00:00.000Z Last Updated: 2025-03-13T15:43:05.429Z Vendors: n/a Products: n/a Problem Types: n/a Description: itsourcecode Online Accreditation Management System contains a Cross Site Scripting vulnerability, which allows an attacker to execute arbitrary code via a crafted payload to the SCHOOLNAME, EMAILADDRES, CONTACTNO, COMPANYNAME and COMPANYCONTACTNO parameters in controller.php. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://packetstormsecurity.com - https://github.com/n00bS3cLe4rner/CVE-s/blob/main/CVE-2024-42918.md
CVE ID: CVE-2024-42919 State: PUBLISHED Published: 2024-08-20T00:00:00 Last Updated: 2024-09-13T12:53:20.741Z Vendors: n/a Products: n/a Problem Types: n/a Description: eScan Management Console 14.0.1400.2281 is vulnerable to Incorrect Access Control via acteScanAVReport. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/jeyabalaji711/CVE-2024-42919
CVE ID: CVE-2024-42922 State: PUBLISHED Published: 2025-05-21T00:00:00.000Z Last Updated: 2025-05-21T17:51:00.960Z Vendors: n/a Products: n/a Problem Types: n/a Description: AAPanel v7.0.7 was discovered to contain an OS command injection vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gist.github.com/mstfsec/c4c05ddfb1cf8779422ff780587723c8
CVE ID: CVE-2024-42930 State: PUBLISHED Published: 2024-10-28T00:00:00 Last Updated: 2024-10-30T20:44:51.040Z Vendors: n/a Products: n/a Problem Types: n/a Description: PbootCMS 3.2.8 is vulnerable to URL Redirect. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.pbootcms.com/ - https://github.com/cyb3res3c/CVE-2024-42930/blob/main/CVE-2024-42930.md
CVE ID: CVE-2024-42934 State: PUBLISHED Published: 2024-10-09T00:00:00 Last Updated: 2024-10-31T20:09:19.931Z Vendors: n/a Products: n/a Problem Types: n/a Description: OpenIPMI before 2.0.36 has an out-of-bounds array access (for authentication type) in the ipmi_sim simulator, resulting in denial of service or (with very low probability) authentication bypass or code execution. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://sourceforge.net/p/openipmi/code/ci/b52e8e2538b2b48ef6b63bff12b5cc9e2d52eff1/ - https://sourceforge.net/p/openipmi/code/ci/4c129d0540f3578ecc078d8612bbf84b6cd24c87 - https://bugzilla.redhat.com/show_bug.cgi?id=2308375
CVE ID: CVE-2024-42936 State: PUBLISHED Published: 2025-01-21T00:00:00.000Z Last Updated: 2025-03-20T14:00:32.907Z Vendors: n/a Products: n/a Problem Types: n/a Description: The mqlink.elf is service component in Ruijie RG-EW300N with firmware ReyeeOS 1.300.1422 is vulnerable to Remote Code Execution via a modified MQTT broker message. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gist.github.com/smrx86/2008111b12ab47882b3928d0cbc9e415
CVE ID: CVE-2024-42939 State: PUBLISHED Published: 2024-08-21T00:00:00 Last Updated: 2024-08-21T13:26:15.999Z Vendors: n/a Products: n/a Problem Types: n/a Description: A cross-site scripting (XSS) vulnerability in the component /index/index.html of YZNCMS v1.4.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the configured remarks text field. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/tcyba/open_vul/blob/main/yzncms%20has%20a%20storage%20xss%20vulnerability.pdf
CVE ID: CVE-2024-42940 State: PUBLISHED Published: 2024-08-15T00:00:00 Last Updated: 2024-09-03T18:18:55.444Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda FH1201 v1.2.0.14 (408) was discovered to contain a stack overflow via the page parameter in the fromP2pListFilter function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/TTTJJJWWW/AHU-IoT-vulnerable/blob/main/Tenda/FH1201/fromP2pListFilter.md
CVE ID: CVE-2024-42941 State: PUBLISHED Published: 2024-08-15T00:00:00 Last Updated: 2024-09-03T18:12:31.041Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda FH1201 v1.2.0.14 (408) was discovered to contain a stack overflow via the wanmode parameter in the fromAdvSetWan function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/TTTJJJWWW/AHU-IoT-vulnerable/blob/main/Tenda/FH1201/fromAdvSetWan_pptpPPW.md
CVE ID: CVE-2024-42942 State: PUBLISHED Published: 2024-08-15T00:00:00 Last Updated: 2024-08-15T17:35:24.114Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda FH1201 v1.2.0.14 (408) was discovered to contain a stack overflow via the page parameter in the frmL7ImForm function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/TTTJJJWWW/AHU-IoT-vulnerable/blob/main/Tenda/FH1201/frmL7ImForm.md
CVE ID: CVE-2024-42943 State: PUBLISHED Published: 2024-08-15T00:00:00 Last Updated: 2024-08-16T18:10:20.544Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda FH1201 v1.2.0.14 (408) was discovered to contain a stack overflow via the PPPOEPassword parameter in the fromAdvSetWan function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/TTTJJJWWW/AHU-IoT-vulnerable/blob/main/Tenda/FH1201/fromAdvSetWan_PPPOEPassword.md