Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-7903 State: PUBLISHED Published: 2024-08-18T07:00:06.051Z Last Updated: 2024-08-19T17:45:38.922Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: n/a Products: DedeBIZ Problem Types: CWE-434 Description: A vulnerability was found in DedeBIZ 6.3.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file admin/media_add.php of the component File Extension Handler. The manipulation of the argument upfile1 leads to unrestricted upload. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. NOTE: The vendor was contacted early about this disclosure but did not respond in any w
d to the public and may be used. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.275029 - https://vuldb.com/?ctiid.275029 - https://vuldb.com/?submit.388360 - https://github.com/DeepMountains/Mirage/blob/main/CVE17-1.md
CVE ID: CVE-2024-7904 State: PUBLISHED Published: 2024-08-18T08:31:03.907Z Last Updated: 2024-08-19T16:50:38.182Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: n/a Products: DedeBIZ Problem Types: CWE-434 Description: A vulnerability was found in DedeBIZ 6.3.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file admin/file_manage_control.php of the component File Extension Handler. The manipulation of the argument upfile1 leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. NOTE: The vendor was contacted early about this disclosure but did not respond in any
ed to the public and may be used. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.275030 - https://vuldb.com/?ctiid.275030 - https://vuldb.com/?submit.388361 - https://github.com/DeepMountains/Mirage/blob/main/CVE17-2.md
CVE ID: CVE-2024-7905 State: PUBLISHED Published: 2024-08-18T11:31:04.281Z Last Updated: 2024-08-19T14:07:31.425Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: n/a Products: DedeBIZ Problem Types: CWE-434 Description: A vulnerability classified as critical has been found in DedeBIZ 6.3.0. This affects the function AdminUpload of the file admin/archives_do.php. The manipulation of the argument litpic leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment:
ontacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.275031 - https://vuldb.com/?ctiid.275031 - https://vuldb.com/?submit.388362 - https://github.com/DeepMountains/Mirage/blob/main/CVE17-3.md
CVE ID: CVE-2024-7906 State: PUBLISHED Published: 2024-08-18T13:31:04.550Z Last Updated: 2024-08-20T19:54:36.347Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: n/a Products: DedeBIZ Problem Types: CWE-434 Description: A vulnerability classified as critical was found in DedeBIZ 6.3.0. This vulnerability affects the function get_mime_type of the file /admin/dialog/select_images_post.php of the component Attachment Settings. The manipulation of the argument upload leads to unrestricted upload. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. NOTE: The vendor was contacted early about this disclosure but did not respond in any way
to the public and may be used. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.275032 - https://vuldb.com/?ctiid.275032 - https://vuldb.com/?submit.388363 - https://github.com/DeepMountains/Mirage/blob/main/CVE17-4.md
CVE ID: CVE-2024-7907 State: PUBLISHED Published: 2024-08-18T16:00:05.668Z Last Updated: 2024-08-19T16:15:52.346Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: TOTOLINK Products: X6000R Problem Types: CWE-77 Description: A vulnerability, which was classified as critical, has been found in TOTOLINK X6000R 9.4.0cu.852_20230719. This issue affects the function setSyslogCfg of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument rtLogServer leads to command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Ana
d may be used. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.275033 - https://vuldb.com/?ctiid.275033 - https://vuldb.com/?submit.388424 - https://github.com/BeaCox/IoT_vuln/tree/main/totolink/x6000R/setSyslogCfg_injection
CVE ID: CVE-2024-7908 State: PUBLISHED Published: 2024-08-18T17:00:05.376Z Last Updated: 2024-08-19T13:39:15.433Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C) Vendors: TOTOLINK Products: EX1200L Problem Types: CWE-121 Description: A vulnerability, which was classified as critical, was found in TOTOLINK EX1200L 9.3.5u.6146_B20201023. Affected is the function setDefResponse of the file /www/cgi-bin/cstecgi.cgi. The manipulation of the argument IpAddress leads to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Ad
he public and may be used. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.275034 - https://vuldb.com/?ctiid.275034 - https://vuldb.com/?submit.388435 - https://github.com/BeaCox/IoT_vuln/tree/main/totolink/EX1200L/setDefResponse_bof
CVE ID: CVE-2024-7909 State: PUBLISHED Published: 2024-08-18T18:00:07.558Z Last Updated: 2024-08-21T18:16:05.783Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C) Vendors: TOTOLINK Products: EX1200L Problem Types: CWE-121 Description: A vulnerability has been found in TOTOLINK EX1200L 9.3.5u.6146_B20201023 and classified as critical. Affected by this vulnerability is the function setLanguageCfg of the file /www/cgi-bin/cstecgi.cgi. The manipulation of the argument langType leads to stack-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. NOTE: The vendor was contacted early about this disclosure but did not respond in an
osed to the public and may be used. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.275035 - https://vuldb.com/?ctiid.275035 - https://vuldb.com/?submit.388436 - https://github.com/BeaCox/IoT_vuln/tree/main/totolink/EX1200L/setLanguageCfg_bof - https://www.totolink.net/
CVE ID: CVE-2024-7910 State: PUBLISHED Published: 2024-08-18T18:31:05.801Z Last Updated: 2024-08-19T16:20:57.808Z Severity: N/A (CVSS 5.8 AV:N/AC:L/Au:M/C:P/I:P/A:P) Vendors: CodeAstro Products: Online Railway Reservation System Problem Types: CWE-434 Description: A vulnerability was found in CodeAstro Online Railway Reservation System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /admin/emp-profile-avatar.php of the component Profile Photo Update Handler. The manipulation leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnr
nched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.275036 - https://vuldb.com/?ctiid.275036 - https://vuldb.com/?submit.391650 - https://github.com/CYB84/CVE_Writeup/blob/main/Online%20Railway%20Reservation%20System/RCE%20via%20File%20Upload.md
CVE ID: CVE-2024-7911 State: PUBLISHED Published: 2024-08-18T19:31:03.544Z Last Updated: 2024-08-19T16:17:38.184Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: SourceCodester Products: Simple Online Bidding System Problem Types: CWE-73 Description: A vulnerability was found in SourceCodester Simple Online Bidding System 1.0. It has been classified as critical. This affects an unknown part of the file /simple-online-bidding-system/bidding/index.php. The manipulation of the argument page leads to file inclusion. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: Referenc
he exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.275037 - https://vuldb.com/?ctiid.275037 - https://vuldb.com/?submit.391657 - https://github.com/Wsstiger/cve/blob/main/simple_include.md
CVE ID: CVE-2024-7912 State: PUBLISHED Published: 2024-08-18T21:31:04.192Z Last Updated: 2024-08-19T13:34:37.035Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: CodeAstro Products: Online Railway Reservation System Problem Types: CWE-548 Description: A vulnerability was found in CodeAstro Online Railway Reservation System 1.0. It has been declared as problematic. This vulnerability affects unknown code of the file /admin/assets/. The manipulation leads to exposure of information through directory listing. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: Ref
ly. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.275038 - https://vuldb.com/?ctiid.275038 - https://vuldb.com/?submit.391658 - https://github.com/CYB84/CVE_Writeup/blob/main/Online%20Railway%20Reservation%20System/Directory%20Listing.md
CVE ID: CVE-2024-7913 State: PUBLISHED Published: 2024-08-18T22:00:05.260Z Last Updated: 2024-08-19T16:11:42.714Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: itsourcecode Products: Billing System Problem Types: CWE-89 Description: A vulnerability was found in itsourcecode Billing System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /addclient1.php. The manipulation of the argument lname/fname/mi/address/contact/meterReader leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.
d to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.275039 - https://vuldb.com/?ctiid.275039 - https://vuldb.com/?submit.391841 - https://github.com/ppp-src/a/issues/4
CVE ID: CVE-2024-7914 State: PUBLISHED Published: 2024-08-18T22:00:06.960Z Last Updated: 2024-08-19T13:31:32.990Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: SourceCodester Products: Yoga Class Registration System Problem Types: CWE-79 Description: A vulnerability classified as problematic has been found in SourceCodester Yoga Class Registration System 1.0. Affected is an unknown function of the file /php-ycrs/classes/SystemSettings.php. The manipulation of the argument address leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References:
xploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.275040 - https://vuldb.com/?ctiid.275040 - https://vuldb.com/?submit.392193 - https://github.com/Wsstiger/cve/blob/main/Yoga_xss2.md
CVE ID: CVE-2024-7915 State: PUBLISHED Published: 2024-11-25T17:45:39.978Z Last Updated: 2024-11-25T18:43:52.579Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Sensei Products: Sensei Mac Cleaner Problem Types: CWE-863 Description: The application Sensei Mac Cleaner contains a local privilege escalation vulnerability, allowing an attacker to perform multiple operations as the root user. These operations include arbitrary file deletion and writing, loading and unloading daemons, manipulating file permissions, and loading extensions, among other actions. The vulnerable module org.cindori.SenseiHelper can be contacted via XPC. While the module performs client v
her actions. The vulnerable module org.cindori.SenseiHelper can be contacted via XPC. While the module performs client validation, it relies on the client's PID obtained through the public processIdentifier property of the NSXPCConnection class. This approach makes the module susceptible to a PID Reuse Attack, enabling an attacker to impersonate a legitimate client and send crafted XPC messages to invoke arbitrary methods exposed by the HelperProtocol interface. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://pentraze.com/vulnerability-reports
CVE ID: CVE-2024-7916 State: PUBLISHED Published: 2024-08-18T22:31:03.738Z Last Updated: 2024-08-19T18:04:16.948Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: nafisulbari, itsourcecode Products: Insurance Management System Problem Types: CWE-79 Description: A vulnerability classified as problematic was found in nafisulbari/itsourcecode Insurance Management System 1.0. Affected by this vulnerability is an unknown functionality of the file addNominee.php of the component Add Nominee Page. The manipulation of the argument Nominee-Client ID leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. NOTE: The ven
ipting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.275041 - https://vuldb.com/?ctiid.275041 - https://vuldb.com/?submit.388905
CVE ID: CVE-2024-7917 State: PUBLISHED Published: 2024-08-18T22:31:07.539Z Last Updated: 2024-08-19T16:04:33.467Z Severity: N/A (CVSS 5.8 AV:N/AC:L/Au:M/C:P/I:P/A:P) Vendors: n/a Products: DouPHP Problem Types: CWE-434 Description: A vulnerability, which was classified as critical, has been found in DouPHP 1.7 Release 20220822. Affected by this issue is some unknown functionality of the file /admin/system.php of the component Favicon Handler. The manipulation of the argument site_favicon leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb
disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.275042 - https://vuldb.com/?ctiid.275042 - https://vuldb.com/?submit.389296 - https://wiki.shikangsi.com/post/share/5de742ae-e5e6-48ed-876b-dca7e74813cb
CVE ID: CVE-2024-7918 State: PUBLISHED Published: 2024-09-09T06:00:02.962Z Last Updated: 2024-09-09T13:13:32.321Z Vendors: Unknown Products: Pocket Widget Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Pocket Widget WordPress plugin through 0.1.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/b1697646-1090-4a2b-9987-cec07428378e/
CVE ID: CVE-2024-7919 State: PUBLISHED Published: 2024-08-19T00:00:10.567Z Last Updated: 2024-08-19T13:36:11.222Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Anhui Deshun Intelligent Technology Products: Jieshun JieLink+ JSOTC2016 Problem Types: CWE-284 Description: A vulnerability, which was classified as critical, has been found in Anhui Deshun Intelligent Technology Jieshun JieLink+ JSOTC2016 up to 20240805. This issue affects some unknown processing of the file /report/ParkChargeRecord/GetDataList. The manipulation leads to improper access controls. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Ad
access controls. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.275069 - https://vuldb.com/?ctiid.275069 - https://vuldb.com/?submit.387124 - https://wiki.shikangsi.com/post/share/fd390bd7-2d60-4ffb-87da-f72cc900f61c
CVE ID: CVE-2024-7920 State: PUBLISHED Published: 2024-08-19T00:00:14.020Z Last Updated: 2024-08-19T15:33:17.409Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: Anhui Deshun Intelligent Technology Products: Jieshun JieLink+ JSOTC2016 Problem Types: CWE-284 Description: A vulnerability, which was classified as problematic, was found in Anhui Deshun Intelligent Technology Jieshun JieLink+ JSOTC2016 up to 20240805. Affected is an unknown function of the file /Report/ParkCommon/GetParkInThroughDeivces. The manipulation leads to improper access controls. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. A
controls. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.275070 - https://vuldb.com/?ctiid.275070 - https://vuldb.com/?submit.387125 - https://wiki.shikangsi.com/post/share/123687c4-ff4b-48e8-8299-6f4950a75af5
CVE ID: CVE-2024-7921 State: PUBLISHED Published: 2024-08-19T02:00:09.824Z Last Updated: 2024-08-19T14:36:29.753Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: Anhui Deshun Intelligent Technology Products: Jieshun JieLink+ JSOTC2016 Problem Types: CWE-284 Description: A vulnerability has been found in Anhui Deshun Intelligent Technology Jieshun JieLink+ JSOTC2016 up to 20240805 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /report/ParkOutRecord/GetDataList. The manipulation leads to improper access controls. The attack can be launched remotely. The exploit has been disclosed to the public and may be u
improper access controls. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.275071 - https://vuldb.com/?ctiid.275071 - https://vuldb.com/?submit.387126 - https://wiki.shikangsi.com/post/share/7d5eb025-1c30-44b4-b609-61938f6d6c05
CVE ID: CVE-2024-7922 State: PUBLISHED Published: 2024-08-19T15:00:06.847Z Last Updated: 2024-08-19T18:23:40.353Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: D-Link Products: DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05, DNS-1550-04 Problem Types: CWE-77 Description: A vulnerability was found in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20240814 and classified as c
R-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20240814 and classified as critical. Affected by this issue is the function cgi_audio_search/cgi_create_playlist/cgi_get_album_all_tracks/cgi_get_alltracks_editlist/cgi_get_artist_all_album/cgi_get_genre_all_tracks/cgi_get_tracks_list/cgi_set_airplay_content/cgi_write_playlist of the file /cgi-bin/myMusic.cgi. The manipulation leads to command injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: Vendor was contacted early and confirmed that the p
fects products that are no longer supported by the maintainer. NOTE: Vendor was contacted early and confirmed that the product is end-of-life. It should be retired and replaced. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.275108 - https://vuldb.com/?ctiid.275108 - https://vuldb.com/?submit.391669 - https://github.com/BuaaIOTTeam/Iot_Dlink_NAS/blob/main/DNS_cgi_create_playlist.md - https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10383 - https://github.com/BuaaIOTTeam/Iot_Dlink_NAS/blob/main/DNS_cgi_get_tracks_list.md
CVE ID: CVE-2024-7923 State: PUBLISHED Published: 2024-09-04T13:41:48.872Z Last Updated: 2025-11-11T16:12:18.584Z Severity: CRITICAL (CVSS 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Red Hat Products: Red Hat Satellite 6.13 for RHEL 8, Red Hat Satellite 6.14 for RHEL 8, Red Hat Satellite 6.15 for RHEL 8, Red Hat Satellite 6.16 for RHEL 8, Red Hat Satellite 6.16 for RHEL 9, Red Hat Update Infrastructure 4 for Cloud Providers Problem Types: CWE-287 Description: An authentication bypass vulnerability has been identified in Pulpcore when deployed with Gunicorn versions prior to 22.0, due to the puppet-pulpcore configuration. This issue arises from Apache's mod_proxy not properly u
rsions prior to 22.0, due to the puppet-pulpcore configuration. This issue arises from Apache's mod_proxy not properly unsetting headers because of restrictions on underscores in HTTP headers, allowing authentication through a malformed header. This flaw impacts all active Satellite deployments (6.13, 6.14 and 6.15) which are using Pulpcore version 3.0+ and could potentially enable unauthorized users to gain administrative access. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://access.redhat.com/errata/RHSA-2024:6335 - https://access.redhat.com/errata/RHSA-2024:6336 - https://access.redhat.com/errata/RHSA-2024:6337 - https://access.redhat.com/errata/RHSA-2024:8906 -
ta/RHSA-2024:6336 - https://access.redhat.com/errata/RHSA-2024:6337 - https://access.redhat.com/errata/RHSA-2024:8906 - https://access.redhat.com/security/cve/CVE-2024-7923 - https://bugzilla.redhat.com/show_bug.cgi?id=2305718
CVE ID: CVE-2024-7924 State: PUBLISHED Published: 2024-08-19T18:00:10.482Z Last Updated: 2024-08-21T15:04:34.469Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: n/a Products: ZZCMS Problem Types: CWE-22 Description: A vulnerability was found in ZZCMS 2023. It has been declared as critical. This vulnerability affects unknown code of the file /I/list.php. The manipulation of the argument skin leads to path traversal. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.275110 - https://vuldb.com/?ctiid.275110 - https://vuldb.co
- CISA ADP Vulnrichment: References: - https://vuldb.com/?id.275110 - https://vuldb.com/?ctiid.275110 - https://vuldb.com/?submit.391876 - https://gitee.com/A0kooo/cve_article/blob/master/zzcms/zzcms%20list.php%20Directory%20traversal.md