Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-9115 State: PUBLISHED Published: 2024-09-26T09:29:42.787Z Last Updated: 2024-09-26T13:32:14.734Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: thechetanvaghela Products: Common Tools for Site Problem Types: CWE-79 Description: The Common Tools for Site plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.0.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file. Additional Analys
ove, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/d0864b6e-e193-4704-99ec-a5f2232c4816?source=cve - https://wordpress.org/plugins/common-tools-for-site/#developers
CVE ID: CVE-2024-9116 State: PUBLISHED Published: 2024-10-26T09:35:20.614Z Last Updated: 2024-10-28T17:41:00.344Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: monkeeboy Products: Monkee-Boy Essentials Problem Types: CWE-79 Description: The Monkee-Boy Essentials plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file. Additional Analyst Notes:
nject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/c44c1a50-e282-4a5b-8b7f-1021c9d6f58e?source=cve - https://wordpress.org/plugins/monkee-boy-wp-essentials/#developers
CVE ID: CVE-2024-9117 State: PUBLISHED Published: 2024-09-26T09:29:42.242Z Last Updated: 2024-09-26T13:30:26.182Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: sekler Products: Mapplic Lite Problem Types: CWE-79 Description: The Mapplic Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file. Additional Analyst Notes: - CISA ADP Vulnrichme
cripts in pages that will execute whenever a user accesses the SVG file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/a19e1713-1a64-46dc-8b30-b53045b2e01d?source=cve - https://wordpress.org/plugins/mapplic-lite/#developers
CVE ID: CVE-2024-9118 State: PUBLISHED Published: 2024-10-01T09:30:31.139Z Last Updated: 2024-10-01T13:35:07.165Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: quomodosoft Products: QS Dark Mode Plugin Problem Types: CWE-79 Description: The QS Dark Mode Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 2.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file. Additional Analyst Notes: -
ect arbitrary web scripts in pages that will execute whenever a user accesses the SVG file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/61fce18a-44ec-442f-879e-f4ceab93d972?source=cve - https://wordpress.org/plugins/qs-dark-mode/#developers - https://plugins.trac.wordpress.org/changeset/3159458/
CVE ID: CVE-2024-9119 State: PUBLISHED Published: 2024-10-01T07:30:07.465Z Last Updated: 2024-10-01T14:02:30.369Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: automatic-rock Products: SVG Complete Problem Types: CWE-79 Description: The SVG Complete plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.0.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file. Additional Analyst Notes: - CISA ADP
rary web scripts in pages that will execute whenever a user accesses the SVG file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/0f8e1495-c5e1-4bb9-92e9-b27b9b997a5f?source=cve - https://wordpress.org/plugins/svg-complete/#developers
CVE ID: CVE-2024-9120 State: PUBLISHED Published: 2024-09-24T18:44:37.867Z Last Updated: 2024-09-26T03:55:46.857Z Vendors: Google Products: Chrome Problem Types: CWE-416 Description: Use after free in Dawn in Google Chrome on Windows prior to 129.0.6668.70 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2024/09/stable-channel-update-for-desktop_24.html - https://issues.chromium.org/issues/365254285
CVE ID: CVE-2024-9121 State: PUBLISHED Published: 2024-09-24T18:44:38.223Z Last Updated: 2024-09-26T03:55:47.869Z Vendors: Google Products: Chrome Problem Types: Inappropriate implementation Description: Inappropriate implementation in V8 in Google Chrome prior to 129.0.6668.70 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page. (Chromium security severity: High) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2024/09/stable-channel-update-for-desktop_24.html - https://issues.chromium.org/issues/363538434
CVE ID: CVE-2024-9122 State: PUBLISHED Published: 2024-09-24T18:44:38.453Z Last Updated: 2024-09-25T16:25:15.238Z Vendors: Google Products: Chrome Problem Types: CWE-843 Description: Type Confusion in V8 in Google Chrome prior to 129.0.6668.70 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. (Chromium security severity: High) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2024/09/stable-channel-update-for-desktop_24.html - https://issues.chromium.org/issues/365802567
CVE ID: CVE-2024-9123 State: PUBLISHED Published: 2024-09-24T18:44:38.706Z Last Updated: 2025-11-20T18:47:30.230Z Vendors: Google Products: Chrome Problem Types: CWE-472 Description: Integer overflow in Skia in Google Chrome prior to 129.0.6668.70 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: High) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2024/09/stable-channel-update-for-desktop_24.html - https://issues.chromium.org/issues/365884464
CVE ID: CVE-2024-9124 State: PUBLISHED Published: 2024-10-08T16:23:09.331Z Last Updated: 2024-11-21T16:55:08.532Z Vendors: Rockwell Automation Products: Drives - PowerFlex 6000T Problem Types: CWE-754 Description: A denial-of-service vulnerability exists in the Rockwell Automation PowerFlex® 600T. If the device is overloaded with requests, it will become unavailable. The device may require a power cycle to recover it if it does not re-establish a connection after it stops receiving requests. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1705.html
CVE ID: CVE-2024-9125 State: PUBLISHED Published: 2024-09-26T09:29:40.487Z Last Updated: 2024-09-26T13:31:17.379Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: mohsensd1373 Products: king_IE Problem Types: CWE-79 Description: The king_IE plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file. Additional Analyst Notes: - CISA ADP Vulnrichment:
ts in pages that will execute whenever a user accesses the SVG file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/486f43cc-cc3f-4a63-b00f-86f29a391269?source=cve - https://wordpress.org/plugins/king-ie/#developers
CVE ID: CVE-2024-9126 State: PUBLISHED Published: 2025-11-14T02:29:57.316Z Last Updated: 2025-11-15T04:56:13.524Z Vendors: Google Products: Chrome Problem Types: CWE-416 Description: Use after free in Internals in Google Chrome on iOS prior to 127.0.6533.88 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a series of curated UI gestures. (Chromium security severity: Medium) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2024/07/stable-channel-update-for-desktop_30.html - https://issues.chromium.org/issues/349653218
CVE ID: CVE-2024-9127 State: PUBLISHED Published: 2024-09-26T09:29:41.207Z Last Updated: 2024-09-26T13:31:00.670Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: solaplugins Products: Super Testimonials Problem Types: CWE-79 Description: The Super Testimonials plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘alignment’ parameter in all versions up to, and including, 3.0.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional
above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/54998b69-7dc5-49a4-8b8b-3419de73ed47?source=cve - https://wordpress.org/plugins/sola-testimonials/#developers - https://plugins.trac.wordpress.org/browser/sola-testimonials/trunk/includes/gutenberg-blocks/single-testimonial/index.php#L39 - https://plugins.trac.wordpress.org/browser/sola-testimonials/trunk/includes/gutenberg-blocks/single-testimonial/index.php#L84
CVE ID: CVE-2024-9129 State: PUBLISHED Published: 2024-10-22T17:09:04.384Z Last Updated: 2024-10-22T17:56:22.159Z Vendors: Zend Products: Zend Server Problem Types: CWE-134 Description: In versions of Zend Server 8.5 and prior to version 9.2 a format string injection was discovered. Reported by Dylan Marino Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://portal.perforce.com/s/detail/a91PA000001SYZFYA4
CVE ID: CVE-2024-9130 State: PUBLISHED Published: 2024-09-27T05:31:02.642Z Last Updated: 2024-09-27T15:14:25.271Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: webdevmattcrom Products: GiveWP – Donation Plugin and Fundraising Platform Problem Types: CWE-89 Description: The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to time-based SQL Injection via the ‘order’ parameter in all versions up to, and including, 3.16.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with GiveWP Manager-level access a
ration on the existing SQL query. This makes it possible for authenticated attackers, with GiveWP Manager-level access and above, to append additional SQL queries into already existing queries within the Legacy View mode, that can be used to extract sensitive information from the database. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/4a3cae01-620d-405e-baf6-2d66a5b429b3?source=cve - https://wordpress.org/plugins/give/#developers - https://plugins.trac.wordpress.org/browser/give/tags/3.16.1/includes/donors/class-give-donors-query.php#L453 - https://givewp.com/documentation/core/give-user-roles/ - https://plugins.tra
s/donors/class-give-donors-query.php#L453 - https://givewp.com/documentation/core/give-user-roles/ - https://plugins.trac.wordpress.org/changeset/3157829/give/trunk/includes/donors/class-give-donors-query.php - https://plugins.trac.wordpress.org/changeset/3157829/
CVE ID: CVE-2024-9131 State: PUBLISHED Published: 2025-01-10T21:28:47.417Z Last Updated: 2025-01-13T15:45:58.848Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Arista Networks Products: Arista Edge Threat Management Problem Types: CWE-88 Description: A user with administrator privileges can perform command injection Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.arista.com/en/support/advisories-notices/security-advisory/20454-security-advisory-0105
CVE ID: CVE-2024-9132 State: PUBLISHED Published: 2025-01-10T21:35:14.483Z Last Updated: 2025-01-13T17:49:01.649Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Arista Networks Products: Arista Edge Threat Management Problem Types: CWE-94 Description: The administrator is able to configure an insecure captive portal script Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.arista.com/en/support/advisories-notices/security-advisory/20454-security-advisory-0105
CVE ID: CVE-2024-9133 State: PUBLISHED Published: 2025-01-10T21:40:24.875Z Last Updated: 2025-01-13T17:50:10.084Z Severity: MEDIUM (CVSS 6.6 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L) Vendors: Arista Networks Products: Arista Edge Threat Management Problem Types: CWE-287 Description: A user with administrator privileges is able to retrieve authentication tokens Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.arista.com/en/support/advisories-notices/security-advisory/20454-security-advisory-0105
CVE ID: CVE-2024-9134 State: PUBLISHED Published: 2025-01-10T21:44:17.415Z Last Updated: 2025-01-13T20:14:00.556Z Severity: HIGH (CVSS 8.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L) Vendors: Arista Networks Products: Arista Edge Threat Management Problem Types: CWE-89 Description: Multiple SQL Injection vulnerabilities exist in the reporting application. A user with advanced report application access rights can exploit the SQL injection, allowing them to execute commands on the underlying operating system with elevated privileges. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.arista.com/en/support/advisories-notices/security-advisory/20454-security-advisory-
nrichment: References: - https://www.arista.com/en/support/advisories-notices/security-advisory/20454-security-advisory-0105
CVE ID: CVE-2024-9135 State: PUBLISHED Published: 2025-03-04T20:12:02.025Z Last Updated: 2025-03-04T20:34:15.951Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: Arista Networks Products: EOS Problem Types: CWE-401 Description: On affected platforms running Arista EOS with BGP Link State configured, BGP peer flap can cause the BGP agent to leak memory. This may result in BGP routing processing being terminated and route flapping. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.arista.com/en/support/advisories-notices/security-advisory/21092-security-advisory-0110
CVE ID: CVE-2024-9136 State: PUBLISHED Published: 2024-09-27T10:24:09.033Z Last Updated: 2025-09-18T06:40:12.820Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Huawei Products: HarmonyOS, EMUI Problem Types: CWE-863 Description: Access permission verification vulnerability in the App Multiplier module Impact: Successful exploitation of this vulnerability may affect service confidentiality. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://consumer.huawei.com/en/support/bulletin/2024/10/
CVE ID: CVE-2024-9137 State: PUBLISHED Published: 2024-10-14T08:09:22.689Z Last Updated: 2025-09-19T08:08:52.357Z Severity: CRITICAL (CVSS 9.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H) Vendors: Moxa Products: EDR-8010 Series, EDR-G9004 Series, EDR-G9010 Series, EDF-G1002-BP Series, NAT-102 Series, OnCell G4302-LTE4 Series, TN-4900 Series, EDS-608 Series, EDS-611 Series, EDS-616 Series, EDS-619 Series, EDS-405A Series, EDS-408A Series, EDS-505A Series, EDS-508A Series, EDS-510A Series, EDS-516A Series, EDS-518A Series, EDS-G509 Series, EDS-P510 Series, EDS-P510A Series, EDS-510E Series, EDS-518E Series, EDS-528E Series, EDS-G508E Series, EDS-G512E Series, EDS-G516E Series, EDS-P506E Serie
EDS-510E Series, EDS-518E Series, EDS-528E Series, EDS-G508E Series, EDS-G512E Series, EDS-G516E Series, EDS-P506E Series, ICS-G7526A Series, ICS-G7528A Series, ICS-G7748A Series, ICS-G7750A Series, ICS-G7752A Series, ICS-G7826A Series, ICS-G7828A Series, ICS-G7848A Series, ICS-G7850A Series, ICS-G7852A Series, IKS-G6524A Series, IKS-6726A Series, IKS-6728A Series, IKS-G6824A Series, SDS-3006 Series, SDS-3008 Series, SDS-3010 Series, SDS-3016 Series, SDS-G3006 Series, SDS-G3008 Series, SDS-G3010 Series, SDS-G3016 Series, PT-7728 Series, PT-7828 Series, PT-G503 Series, PT-G510 Series, PT-G7728 Series, PT-G7828 Series, TN-4500A Series, TN-5500A Series, TN-G4500 Series, TN-G6500 Series Problem
10 Series, PT-G7728 Series, PT-G7828 Series, TN-4500A Series, TN-5500A Series, TN-G4500 Series, TN-G6500 Series Problem Types: CWE-306 Description: The affected product lacks an authentication check when sending commands to the server via the Moxa service. This vulnerability allows an attacker to execute specified commands, potentially leading to unauthorized downloads or uploads of configuration files and system compromise. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.moxa.com/en/support/product-support/security-advisory/mpsa-241154-missing-authentication-and-os-command-injection-vulnerabilities-in-routers-and-network-security-appliances - https://www.moxa.co
authentication-and-os-command-injection-vulnerabilities-in-routers-and-network-security-appliances - https://www.moxa.com/en/support/product-support/security-advisory/mpsa-241156-cve-2024-9137-missing-authentication-vulnerability-in-ethernet-switches
CVE ID: CVE-2024-9138 State: PUBLISHED Published: 2025-01-03T08:14:31.588Z Last Updated: 2025-01-03T14:32:35.370Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Moxa Products: EDR-810 Series, EDR-8010 Series, EDR-G902 Series, EDR-G903 Series, EDR-G9004 Series, EDR-G9010 Series, EDF-G1002-BP Series, NAT-102 Series, OnCell G4302-LTE4 Series, TN-4900 Series Problem Types: CWE-656 Description: Moxa’s cellular routers, secure routers, and network security appliances are affected by a high-severity vulnerability, CVE-2024-9138. This vulnerability involves hard-coded credentials, enabling an authenticated user to escalate privileges and gain root-level access to the
involves hard-coded credentials, enabling an authenticated user to escalate privileges and gain root-level access to the system, posing a significant security risk. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.moxa.com/en/support/product-support/security-advisory/mpsa-241155-privilege-escalation-and-os-command-injection-vulnerabilities-in-cellular-routers,-secure-routers,-and-netwo
CVE ID: CVE-2024-9139 State: PUBLISHED Published: 2024-10-14T08:20:52.200Z Last Updated: 2024-11-06T20:47:06.342Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Moxa Products: EDR-8010 Series, EDR-G9004 Series, EDR-G9010 Series, EDF-G1002-BP Series, NAT-102 Series, OnCell G4302-LTE4 Series, TN-4900 Series, EDR-810 Series Problem Types: CWE-78 Description: The affected product permits OS command injection through improperly restricted commands, potentially allowing attackers to execute arbitrary code. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.moxa.com/en/support/product-support/security-advisory/mpsa-241154-missing-authentica
richment: References: - https://www.moxa.com/en/support/product-support/security-advisory/mpsa-241154-missing-authentication-and-os-command-injection-vulnerabilities-in-routers-and-network-security-appliances
CVE ID: CVE-2024-9140 State: PUBLISHED Published: 2025-01-03T08:26:18.298Z Last Updated: 2025-01-03T14:30:11.567Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Moxa Products: EDR-8010 Series, EDR-G9004 Series, EDR-G9010 Series, EDF-G1002-BP Series, NAT-102 Series, OnCell G4302-LTE4 Series, TN-4900 Series Problem Types: CWE-78 Description: Moxa’s cellular routers, secure routers, and network security appliances are affected by a critical vulnerability, CVE-2024-9140. This vulnerability allows OS command injection due to improperly restricted commands, potentially enabling attackers to execute arbitrary code. This poses a significant risk to the system’s s
cted commands, potentially enabling attackers to execute arbitrary code. This poses a significant risk to the system’s security and functionality. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.moxa.com/en/support/product-support/security-advisory/mpsa-241155-privilege-escalation-and-os-command-injection-vulnerabilities-in-cellular-routers,-secure-routers,-and-netwo
CVE ID: CVE-2024-9141 State: PUBLISHED Published: 2024-09-24T10:50:25.810Z Last Updated: 2024-09-24T13:36:03.793Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N) Vendors: Oct8ne Products: Oct8ne Problem Types: CWE-79 Description: Cross-Site Scripting (XSS) vulnerability in the Oct8ne system. This flaw could allow an attacker to embed harmful JavaScript code into the body of a chat message. This manipulation occurs when the chat content is intercepted and altered, leading to the execution of the JavaScript payload. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/cross-site-scripting-xss-vulnerability-
P Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/cross-site-scripting-xss-vulnerability-oct8ne
CVE ID: CVE-2024-9142 State: PUBLISHED Published: 2024-09-24T08:47:05.277Z Last Updated: 2024-10-14T16:07:53.096Z Vendors: Olgu Computer Systems Products: e-Belediye Problem Types: CWE-73, CWE-732 Description: External Control of File Name or Path, : Incorrect Permission Assignment for Critical Resource vulnerability in Olgu Computer Systems e-Belediye allows Manipulating Web Input to File System Calls.This issue affects e-Belediye: before 2.0.642. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.usom.gov.tr/bildirim/tr-24-1527
CVE ID: CVE-2024-9143 State: PUBLISHED Published: 2024-10-16T17:09:23.844Z Last Updated: 2025-11-03T22:33:18.178Z Vendors: OpenSSL Products: OpenSSL Problem Types: CWE-125, CWE-787 Description: Issue summary: Use of the low-level GF(2^m) elliptic curve APIs with untrusted explicit values for the field polynomial can lead to out-of-bounds memory reads or writes. Impact summary: Out of bound memory writes can lead to an application crash or even a possibility of a remote code execution, however, in all the protocols involving Elliptic Curve Cryptography that we're aware of, either only "named curves" are supported, or, if explicit curve parameters are supported, they specify an X9.62 encoding