Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-36625 State: PUBLISHED Published: 2024-11-29T00:00:00 Last Updated: 2024-11-29T17:09:49.937Z Vendors: n/a Products: n/a Problem Types: n/a Description: Zulip 8.3 is vulnerable to Cross Site Scripting (XSS) via the replace_emoji_with_text function in ui_util.ts. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/zulip/zulip/commit/191345f9d61f5b15762fe3ce19bf635bf885176a - https://github.com/zulip/zulip/blob/8.3/web/src/ui_util.ts#L24 - https://gist.github.com/1047524396/f7ada389ed2686481efef9e1f8307c51
CVE ID: CVE-2024-36626 State: PUBLISHED Published: 2024-11-29T00:00:00 Last Updated: 2024-11-29T17:07:03.796Z Vendors: n/a Products: n/a Problem Types: n/a Description: In prestashop 8.1.4, a NULL pointer dereference was identified in the math_round function within Tools.php. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/prestashop/prestashop/commit/20fa542294da2cfa034a48041e292acaed0c2a7f - https://github.com/PrestaShop/PrestaShop/blob/8.1.4/classes/Tools.php#L1774 - https://gist.github.com/1047524396/25c45b61a6374e0fdaf720c9863c6bcd
CVE ID: CVE-2024-36647 State: PUBLISHED Published: 2024-06-13T00:00:00 Last Updated: 2024-08-02T03:37:05.396Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stored cross-site scripting (XSS) vulnerability in Church CRM v5.8.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Family Name parameter under the Register a New Family page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/ChurchCRM/CRM/issues/7029
CVE ID: CVE-2024-36650 State: PUBLISHED Published: 2024-06-11T00:00:00 Last Updated: 2024-08-02T03:37:05.419Z Vendors: n/a Products: n/a Problem Types: n/a Description: TOTOLINK AC1200 Wireless Dual Band Gigabit Router firmware A3100R V4.1.2cu.5247_B20211129, in the cgi function `setNoticeCfg` of the file `/lib/cste_modules/system.so`, the length of the user input string `NoticeUrl` is not checked. This can lead to a buffer overflow, allowing attackers to construct malicious HTTP or MQTT requests to cause a denial-of-service attack. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://gist.github.com/Swind1er/f442fcac520a48c05c744c7b72362483
CVE ID: CVE-2024-36656 State: PUBLISHED Published: 2024-06-14T00:00:00 Last Updated: 2024-08-02T03:37:05.332Z Vendors: n/a Products: n/a Problem Types: n/a Description: In MintHCM 4.0.3, a registered user can execute arbitrary JavaScript code and achieve a reflected Cross-site Scripting (XSS) attack. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/minthcm/minthcm/issues/67
CVE ID: CVE-2024-36667 State: PUBLISHED Published: 2024-06-05T19:01:21.484Z Last Updated: 2025-02-13T15:59:25.758Z Vendors: n/a Products: n/a Problem Types: n/a Description: idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/idcProType_deal.php?mudi=add&nohrefStr=close Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/sigubbs/cms/blob/main/36/csrf.md
CVE ID: CVE-2024-36668 State: PUBLISHED Published: 2024-06-05T19:00:02.640Z Last Updated: 2025-02-13T15:59:26.331Z Vendors: n/a Products: n/a Problem Types: n/a Description: idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component admin/type_deal.php?mudi=del Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/sigubbs/cms/blob/main/35/csrf.md
CVE ID: CVE-2024-36669 State: PUBLISHED Published: 2024-06-05T18:56:54.546Z Last Updated: 2025-02-13T15:59:26.946Z Vendors: n/a Products: n/a Problem Types: n/a Description: idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component admin/type_deal.php?mudi=add. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/sigubbs/cms/blob/main/34/csrf.md
CVE ID: CVE-2024-36670 State: PUBLISHED Published: 2024-06-05T18:57:12.653Z Last Updated: 2025-02-13T15:59:27.440Z Vendors: n/a Products: n/a Problem Types: n/a Description: idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component admin/vpsClass_deal.php?mudi=del Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/sigubbs/cms/blob/main/33/csrf.md
CVE ID: CVE-2024-36671 State: PUBLISHED Published: 2024-11-29T00:00:00 Last Updated: 2024-12-04T16:57:21.153Z Vendors: n/a Products: n/a Problem Types: n/a Description: nodemcu before v3.0.0-release_20240225 was discovered to contain an integer overflow via the getnum function at /modules/struct.c. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/nodemcu/nodemcu-firmware/pull/3633 - https://github.com/nodemcu/nodemcu-firmware/pull/3634 - https://github.com/nodemcu/nodemcu-firmware/pull/3635 - https://github.com/nodemcu/nodemcu-firmware/commit/193fe3593eb1537667179089535cdb7457327887#diff-5c3fa597431eda03ac3339ae6bf7f05e1a50d6fc7333679ec38e21b337cb6721 - htt
mit/193fe3593eb1537667179089535cdb7457327887#diff-5c3fa597431eda03ac3339ae6bf7f05e1a50d6fc7333679ec38e21b337cb6721 - https://github.com/nodemcu/nodemcu-firmware/issues/3626
CVE ID: CVE-2024-36673 State: PUBLISHED Published: 2024-06-07T12:56:32.289Z Last Updated: 2025-02-13T15:59:28.066Z Vendors: n/a Products: n/a Problem Types: n/a Description: Sourcecodester Pharmacy/Medical Store Point of Sale System 1.0 is vulnerable SQL Injection via login.php. This vulnerability stems from inadequate validation of user inputs for the email and password parameters, allowing attackers to inject malicious SQL queries. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/CveSecLook/cve/issues/39
CVE ID: CVE-2024-36674 State: PUBLISHED Published: 2024-06-03T15:41:29.829Z Last Updated: 2025-02-13T15:59:28.598Z Vendors: n/a Products: n/a Problem Types: n/a Description: LyLme_spage v1.9.5 is vulnerable to Cross Site Scripting (XSS) via admin/link.php. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/LyLme/lylme_spage/issues/91
CVE ID: CVE-2024-36675 State: PUBLISHED Published: 2024-06-04T21:31:16.801Z Last Updated: 2025-02-13T15:59:29.146Z Vendors: n/a Products: n/a Problem Types: n/a Description: LyLme_spage v1.9.5 is vulnerable to Server-Side Request Forgery (SSRF) via the get_head function. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/LyLme/lylme_spage/issues/92
CVE ID: CVE-2024-36676 State: PUBLISHED Published: 2024-07-09T00:00:00 Last Updated: 2024-08-02T03:37:05.349Z Vendors: n/a Products: n/a Problem Types: n/a Description: Incorrect access control in BookStack before v24.05.1 allows attackers to confirm existing system users and perform targeted notification email DoS via public facing forms. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/BookStackApp/BookStack/issues/4993 - https://www.bookstackapp.com/blog/bookstack-release-v24-05-1/ - https://github.com/BookStackApp/BookStack/releases/tag/v24.05.1
CVE ID: CVE-2024-36677 State: PUBLISHED Published: 2024-06-19T00:00:00 Last Updated: 2024-08-02T03:37:05.275Z Vendors: n/a Products: n/a Problem Types: n/a Description: In the module "Login as customer PRO" (loginascustomerpro) <1.2.7 from Weblir for PrestaShop, a guest can access direct link to connect to each customer account of the Shop if the module is not installed OR if a secret accessible to administrator is stolen. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://security.friendsofpresta.org/modules/2024/06/18/loginascustomerpro.html
CVE ID: CVE-2024-36678 State: PUBLISHED Published: 2024-06-19T00:00:00 Last Updated: 2024-08-02T03:37:05.375Z Vendors: n/a Products: n/a Problem Types: n/a Description: In the module "Theme settings" (pk_themesettings) <= 1.8.8 from Promokit.eu for PrestaShop, a guest can perform SQL injection. The script ajax.php have a sensitive SQL call that can be executed with a trivial http call and exploited to forge a SQL injection. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://security.friendsofpresta.org/modules/2024/06/18/pk_themesettings.html
CVE ID: CVE-2024-36679 State: PUBLISHED Published: 2024-06-19T00:00:00 Last Updated: 2024-08-02T03:37:05.342Z Vendors: n/a Products: n/a Problem Types: n/a Description: In the module "Module Live Chat Pro (All in One Messaging)" (livechatpro) <=8.4.0, a guest can perform PHP Code injection. Due to a predictable token, the method `Lcp::saveTranslations()` suffer of a white writer that can inject PHP code into a PHP file. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://security.friendsofpresta.org/modules/2024/06/18/livechatpro.html
CVE ID: CVE-2024-36680 State: PUBLISHED Published: 2024-06-19T00:00:00 Last Updated: 2024-08-02T03:37:05.351Z Vendors: n/a Products: n/a Problem Types: n/a Description: In the module "Facebook" (pkfacebook) <=1.0.1 from Promokit.eu for PrestaShop, a guest can perform SQL injection. The ajax script facebookConnect.php have a sensitive SQL call that can be executed with a trivial http call and exploited to forge a SQL injection. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://security.friendsofpresta.org/modules/2024/06/18/pkfacebook.html
CVE ID: CVE-2024-36681 State: PUBLISHED Published: 2024-06-24T00:00:00 Last Updated: 2024-09-16T22:00:43.964Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL Injection vulnerability in the module "Isotope" (pk_isotope) <=1.7.3 from Promokit.eu for PrestaShop allows attackers to obtain sensitive information and cause other impacts via `pk_isotope::saveData` and `pk_isotope::removeData` methods. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://security.friendsofpresta.org/modules/2024/06/20/pk_isotope.html
CVE ID: CVE-2024-36682 State: PUBLISHED Published: 2024-06-24T00:00:00 Last Updated: 2024-08-02T03:37:05.324Z Vendors: n/a Products: n/a Problem Types: n/a Description: In the module "Theme settings" (pk_themesettings) <= 1.8.8 from Promokit.eu for PrestaShop, a guest can download all email collected while SHOP is in maintenance mode. Due to a lack of permissions control, a guest can access the txt file which collect email when maintenance is enable which can lead to leak of personal information. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://security.friendsofpresta.org/modules/2024/06/20/pk_themesettings.html
CVE ID: CVE-2024-36683 State: PUBLISHED Published: 2024-06-24T00:00:00 Last Updated: 2024-11-14T16:49:47.329Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in the module "Products Alert" (productsalert) before 1.7.4 from Smart Modules for PrestaShop allows attackers to obtain sensitive information and cause other impacts via the ProductsAlertAjaxProcessModuleFrontController::initContent method. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://security.friendsofpresta.org/modules/2024/06/20/productsalert.html
CVE ID: CVE-2024-36684 State: PUBLISHED Published: 2024-06-19T00:00:00 Last Updated: 2024-08-02T03:37:05.421Z Vendors: n/a Products: n/a Problem Types: n/a Description: In the module "Custom links" (pk_customlinks) <= 2.3 from Promokit.eu for PrestaShop, a guest can perform SQL injection. The script ajax.php have a sensitive SQL call that can be executed with a trivial http call and exploited to forge a SQL injection. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://security.friendsofpresta.org/modules/2024/06/18/pk_customlinks.html
CVE ID: CVE-2024-36691 State: PUBLISHED Published: 2024-06-12T00:00:00 Last Updated: 2024-08-21T16:52:12.078Z Vendors: n/a Products: n/a Problem Types: n/a Description: Insecure permissions in the AdminController.AjaxSave() method of PPGo_Jobs v2.8.0 allows authenticated attackers to arbitrarily modify users' account information. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.yuque.com/beimi-tb0gl/yrgtbp/wi8bg26o3wlfqdaf?singleDoc
CVE ID: CVE-2024-36694 State: PUBLISHED Published: 2024-12-18T00:00:00.000Z Last Updated: 2025-01-23T20:35:17.819Z Vendors: n/a Products: n/a Problem Types: n/a Description: OpenCart 4.0.2.3 is vulnerable to Server-Side Template Injection (SSTI) via the Theme Editor Function. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/opencart/opencart/releases/tag/4.0.2.3 - https://github.com/A3h1nt/CVEs/blob/main/OpenCart/Readme.md - https://github.com/opencart/opencart/issues/13863 - https://medium.com/@pawarit.sanguanpang/opencart-v4-0-2-3-server-side-template-injection-0b173a3bdcf9 - https://github.com/PawaritSanguanpang/CVEs/blob/main/OpenCart/CVE-2024-36694/REA
-side-template-injection-0b173a3bdcf9 - https://github.com/PawaritSanguanpang/CVEs/blob/main/OpenCart/CVE-2024-36694/README.md
CVE ID: CVE-2024-36697 State: PUBLISHED Published: 2025-07-10T00:00:00.000Z Last Updated: 2025-07-10T14:21:16.492Z Vendors: n/a Products: n/a Problem Types: n/a Description: A cross-site scripting (XSS) vulnerability in the Admin Login page of Allworx System Software v9.1.9.12 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the SessionID parameter at query.asp. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://allworx.com - https://gist.github.com/roidrage52/d3e419550b91ff041abd55f698fb1e16
CVE ID: CVE-2024-36699 State: REJECTED Published: 2024-06-12T00:00:00 Last Updated: 2024-06-14T14:29:28.560897 Description: No description available.
CVE ID: CVE-2024-36702 State: PUBLISHED Published: 2024-06-11T00:00:00 Last Updated: 2024-08-02T03:37:05.363Z Vendors: n/a Products: n/a Problem Types: n/a Description: libiec61850 v1.5 was discovered to contain a heap overflow via the BerEncoder_encodeLength function at /asn1/ber_encoder.c. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/mz-automation/libiec61850 - http://libiec61850.com - https://github.com/mz-automation/libiec61850/issues/505
CVE ID: CVE-2024-36728 State: PUBLISHED Published: 2024-06-03T13:58:51.113Z Last Updated: 2025-02-13T15:59:29.702Z Vendors: n/a Products: n/a Problem Types: n/a Description: TRENDnet TEW-827DRU devices through 2.06B04 contain a stack-based buffer overflow in the ssi binary. The overflow allows an authenticated user to execute arbitrary code by POSTing to apply.cgi via the action vlan_setting with a sufficiently long dns1 or dns 2 key. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/HouseFuzz/reports/blob/main/trendnet/TEW827/vlan_setting/vlan_setting.md
CVE ID: CVE-2024-36729 State: PUBLISHED Published: 2024-06-03T13:57:31.550Z Last Updated: 2025-03-19T15:45:44.553Z Vendors: n/a Products: n/a Problem Types: n/a Description: TRENDnet TEW-827DRU devices through 2.06B04 contain a stack-based buffer overflow in the ssi binary. The overflow allows an authenticated user to execute arbitrary code by POSTing to apply.cgi via the action wizard_ipv6 with a sufficiently long reboot_type key. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/HouseFuzz/reports/blob/main/trendnet/TEW827/wizard_ipv6/wizard_ipv6.md
CVE ID: CVE-2024-36730 State: PUBLISHED Published: 2024-06-06T19:06:42.448Z Last Updated: 2025-03-14T13:42:08.044Z Vendors: n/a Products: n/a Problem Types: n/a Description: Improper input validation in OneFlow-Inc. Oneflow v0.9.1 allows attackers to cause a Denial of Service (DoS) via inputting negative values into the oneflow.zeros/ones parameter. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gist.github.com/Redmept1on/1c530e191fb3c76f034c2ea1d11eb821
CVE ID: CVE-2024-36732 State: PUBLISHED Published: 2024-06-06T18:51:44.630Z Last Updated: 2025-02-13T15:59:31.347Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in OneFlow-Inc. Oneflow v0.9.1 allows attackers to cause a Denial of Service (DoS) when an empty array is processed with oneflow.tensordot. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://gist.github.com/Redmept1on/3feef7639b2bc7891d0cfda6d932adfd
CVE ID: CVE-2024-36734 State: PUBLISHED Published: 2024-06-06T18:44:36.311Z Last Updated: 2025-02-13T15:59:31.903Z Vendors: n/a Products: n/a Problem Types: n/a Description: Improper input validation in OneFlow-Inc. Oneflow v0.9.1 allows attackers to cause a Denial of Service (DoS) via inputting a negative value into the dim parameter. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gist.github.com/Redmept1on/7420cd59f30defda07cf7bb4bf4a92cd
CVE ID: CVE-2024-36735 State: PUBLISHED Published: 2024-06-06T18:41:19.132Z Last Updated: 2025-03-27T19:06:18.956Z Vendors: n/a Products: n/a Problem Types: n/a Description: OneFlow-Inc. Oneflow v0.9.1 does not display an error or warning when the oneflow.eye parameter is floating. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gist.github.com/Redmept1on/4998e9b6435448cea07a8b2dbf96eedc
CVE ID: CVE-2024-36736 State: PUBLISHED Published: 2024-06-06T17:47:22.614Z Last Updated: 2025-03-25T16:30:47.869Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in the oneflow.permute component of OneFlow-Inc. Oneflow v0.9.1 causes an incorrect calculation when the same dimension operation is performed. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gist.github.com/Redmept1on/6de04fb6c7af6956973fe2765c4d4576
CVE ID: CVE-2024-36737 State: PUBLISHED Published: 2024-06-06T17:43:04.792Z Last Updated: 2025-02-13T15:59:33.454Z Vendors: n/a Products: n/a Problem Types: n/a Description: Improper input validation in OneFlow-Inc. Oneflow v0.9.1 allows attackers to cause a Denial of Service (DoS) via inputting a negative value into the oneflow.full parameter. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gist.github.com/Redmept1on/3a77cc722f82b57f99ccbe835aacf27d
CVE ID: CVE-2024-36740 State: PUBLISHED Published: 2024-06-06T18:40:17.853Z Last Updated: 2025-02-13T15:59:34.021Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in OneFlow-Inc. Oneflow v0.9.1 allows attackers to cause a Denial of Service (DoS) when index as a negative number exceeds the range of size. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gist.github.com/Redmept1on/070f5b8b752079c6b761f00f3cab7103
CVE ID: CVE-2024-36742 State: PUBLISHED Published: 2024-06-06T17:10:29.998Z Last Updated: 2025-02-13T15:59:34.501Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in the oneflow.scatter_nd parameter OneFlow-Inc. Oneflow v0.9.1 allows attackers to cause a Denial of Service (DoS) when index parameter exceeds the range of shape. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://gist.github.com/Redmept1on/761f0d0d09a912b8b93e0cf8dd877e94
CVE ID: CVE-2024-36743 State: PUBLISHED Published: 2024-06-06T17:12:58.912Z Last Updated: 2025-02-13T15:59:35.105Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in OneFlow-Inc. Oneflow v0.9.1 allows attackers to cause a Denial of Service (DoS) when an empty array is processed with oneflow.dot. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://gist.github.com/Redmept1on/64aa53d37e99975725a7d3e2dc9d9761
CVE ID: CVE-2024-36745 State: PUBLISHED Published: 2024-06-06T17:16:32.037Z Last Updated: 2025-03-25T17:33:45.408Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in OneFlow-Inc. Oneflow v0.9.1 allows attackers to cause a Denial of Service (DoS) via inputting a negative value into the oneflow.index_select parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://gist.github.com/Redmept1on/42caad5576101cdd93deb6470d979952
CVE ID: CVE-2024-36751 State: PUBLISHED Published: 2025-01-15T00:00:00.000Z Last Updated: 2025-02-03T14:49:11.947Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in parse-uri v1.0.9 allows attackers to cause a Regular expression Denial of Service (ReDoS) via a crafted URL. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Kikobeats/parse-uri/issues/14 - https://gist.github.com/6en6ar/78168687da94e8aa2e0357f2456b0233
CVE ID: CVE-2024-36755 State: PUBLISHED Published: 2024-06-27T00:00:00 Last Updated: 2024-08-02T03:37:05.330Z Vendors: n/a Products: n/a Problem Types: n/a Description: D-Link DIR-1950 up to v1.11B03 does not validate SSL certificates when requesting the latest firmware version and downloading URL. This can allow attackers to downgrade the firmware version or change the downloading URL via a man-in-the-middle attack. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10401
CVE ID: CVE-2024-36760 State: PUBLISHED Published: 2024-06-13T00:00:00 Last Updated: 2024-08-02T03:43:48.902Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stack overflow vulnerability was found in version 1.18.0 of rhai. The flaw position is: (/ SRC/rhai/SRC/eval/STMT. Rs in rhai: : eval: : STMT: : _ $LT $impl $u20 $rhai.. engine.. Engine$GT$::eval_stmt::h3f1d68ce37fc6e96). Due to the stack overflow is a recursive call/SRC/rhai/SRC/eval/STMT. Rs file eval_stmt_block function. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/MageWeiG/VulnerabilityCollection/blob/main/CVE-2024-36760/info.md
CVE ID: CVE-2024-36761 State: PUBLISHED Published: 2024-06-12T00:00:00.000Z Last Updated: 2025-03-13T13:27:18.879Z Vendors: n/a Products: n/a Problem Types: n/a Description: naga v0.14.0 was discovered to contain a stack overflow via the component /wgsl/parse/mod.rs. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/gfx-rs/naga/issues/2591 - https://github.com/MageWeiG/VulnerabilityCollection/blob/main/CVE-2024-36761/info.md
CVE ID: CVE-2024-36773 State: PUBLISHED Published: 2024-06-07T14:28:44.156Z Last Updated: 2025-02-13T15:59:36.183Z Vendors: n/a Products: n/a Problem Types: n/a Description: A cross-site scripting (XSS) vulnerability in Monstra CMS v3.0.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Themes parameter at index.php. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/OoLs5/VulDiscovery/blob/main/cve-2024-36773.md
CVE ID: CVE-2024-36774 State: PUBLISHED Published: 2024-06-06T21:33:53.456Z Last Updated: 2025-02-13T15:59:36.698Z Vendors: n/a Products: n/a Problem Types: n/a Description: An arbitrary file upload vulnerability in Monstra CMS v3.0.4 allows attackers to execute arbitrary code via uploading a crafted PHP file. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/OoLs5/VulDiscovery/blob/main/poc.docx