alirezaaminzadeh/cve-riskrank huggingface dataset:
CVE-2024-39910 (published 2024-09-16)
decidim is a Free Open-Source participatory democracy, citizen participation and open government for cities and organizations. The WYSWYG editor QuillJS is subject to potential XSS attach in case the attacker manages to modify the HTML before being uploaded to the server. The attacker is able to change e.g. to <svg onload=alert('XSS')> if they know how to craft these requests themselves. This issue has been addressed in release version 0.27.7. All users are advised to upgrade. Users unable to upgrade should review the user accounts that have access to the admin panel (i.e. general Administrators, and participatory space's Administrators) and remove access to them if they don't need it. Disable the "Enable rich text editor for participants" setting in the admin dashboard
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: decidim
Affected products: decidim
CVE-2024-39911 (published 2024-07-18)
1Panel is a web-based linux server management control panel. 1Panel contains an unspecified sql injection via User-Agent handling. This issue has been addressed in version 1.10.12-lts. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-89
Affected vendors: fit2cloud
Affected products: 1panel
CVE-2024-39912 (published 2024-07-15)
web-auth/webauthn-lib is an open source set of PHP libraries and a Symfony bundle to allow developers to integrate that authentication mechanism into their web applications. The ProfileBasedRequestOptionsBuilder method returns allowedCredentials without any credentials if no username was found. When WebAuthn is used as the first or only authentication method, an attacker can enumerate usernames based on the absence of the `allowedCredentials` property in the assertion options response. This allows enumeration of valid or invalid usernames. By knowing which usernames are valid, attackers can focus their efforts on a smaller set of potential targets, increasing the efficiency and likelihood of successful attacks. This issue has been addressed in version 4.9.0 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
Weakness: CWE-204
CVE-2024-39914 (published 2024-07-12)
FOG is a cloning/imaging/rescue suite/inventory management system. Prior to 1.5.10.34, packages/web/lib/fog/reportmaker.class.php in FOG was affected by a command injection via the filename parameter to /fog/management/export.php. This vulnerability is fixed in 1.5.10.34.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-77
Affected vendors: fogproject
Affected products: fogproject
CVE-2024-39915 (published 2024-07-15)
Thruk is a multibackend monitoring webinterface for Naemon, Nagios, Icinga and Shinken using the Livestatus API. This authenticated RCE in Thruk allows authorized users with network access to inject arbitrary commands via the URL parameter during PDF report generation. The Thruk web application does not properly process the url parameter when generating a PDF report. An authorized attacker with access to the reporting functionality could inject arbitrary commands that would be executed when the script /script/html2pdf.sh is called. The vulnerability can be exploited by an authorized user with network access. This issue has been addressed in version 3.16. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H)
Weakness: CWE-94
CVE-2024-39916 (published 2024-07-12)
FOG is a free open-source cloning/imaging/rescue suite/inventory management system. There is a security issue with the NFS configuration in /etc/exports generated by the installer that allows an attacker to modify files outside the export in the default installation. The exports have the no_subtree_check option. The no_subtree_check option means that if a client performs a file operation, the server will only check if the requested file is on the correct filesystem, not if it is in the correct directory. This enables modifying files in /images, accessing other files on the same filesystem, and accessing files on other filesystems. This vulnerability is fixed in 1.5.10.30.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N)
Weakness: CWE-453
Affected vendors: fogproject
Affected products: fogproject
CVE-2024-39917 (published 2024-07-12)
xrdp is an open source RDP server. xrdp versions prior to 0.10.0 have a vulnerability that allows attackers to make an infinite number of login attempts. The number of max login attempts is supposed to be  limited by a configuration parameter `MaxLoginRetry` in `/etc/xrdp/sesman.ini`. However, this mechanism was not effectively working. As a result, xrdp allows an infinite number of login attempts. 
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-307
Affected vendors: neutrinolabs
Affected products: xrdp
CVE-2024-39918 (published 2024-07-15)
@jmondi/url-to-png is an open source URL to PNG utility featuring parallel rendering using Playwright for screenshots and with storage caching via Local, S3, or CouchDB. Input of the `ImageId` in the code is not sanitized and may lead to path traversal. This allows an attacker to store an image in an arbitrary location that the server has permission to access. This issue has been addressed in version 2.1.2 and all users are advised to upgrade. There are no known workarounds for this vulnerability.

Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N)
Weakness: CWE-22
CVE-2024-39919 (published 2024-07-15)
@jmondi/url-to-png is an open source URL to PNG utility featuring parallel rendering using Playwright for screenshots and with storage caching via Local, S3, or CouchDB. The package includes an `ALLOW_LIST` where the host can specify which services the user is permitted to capture screenshots of. By default, capturing screenshots of web services running on localhost, 127.0.0.1, or the [::] is allowed. If someone hosts this project on a server, users could then capture screenshots of other web services running locally. This issue has been addressed in version 2.1.1 with the addition of a blocklist. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Severity: LOW (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N)
Weakness: CWE-200
CVE-2024-3992 (published 2024-06-14)
The Amen WordPress plugin through 3.3.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: joshua_vandercar
Affected products: amen
CVE-2024-39920 (published 2024-07-03)
The TCP protocol in RFC 9293 has a timing side channel that makes it easier for remote attackers to infer the content of one TCP connection from a client system (to any server), when that client system is concurrently obtaining TCP data at a slow rate from an attacker-controlled server, aka the "SnailLoad" issue. For example, the attack can begin by measuring RTTs via the TCP segments whose role is to provide an ACK control bit and an Acknowledgment Number.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
Weakness: CWE-1255
CVE-2024-39921 (published 2024-09-04)
Observable timing discrepancy issue exists in IPCOM EX2 Series V01L02NF0001 to V01L06NF0401, V01L20NF0001 to V01L20NF0401, V02L20NF0001 to V02L21NF0301, and IPCOM VE2 Series V01L04NF0001 to V01L06NF0112. If this vulnerability is exploited, some of the encrypted communication may be decrypted by an attacker who can obtain the contents of the communication.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-203
Affected vendors: fujitsu
Affected products: ipcom_ex2_dc_3200, ipcom_ex2_dc_3200_firmware, ipcom_ex2_dc_3500, ipcom_ex2_dc_3500_firmware, ipcom_ex2_in_3200, ipcom_ex2_in_3200_firmware, ipcom_ex2_in_3500, ipcom_ex2_in_3500_firmware, ipcom_ex2_lb_3200, ipcom_ex2_lb_3200_firmware, ipcom_ex2_lb_3500, ipcom_ex2_lb_3500_firmware, ipcom_ex2_sc_3200, ipcom_ex2_sc_3200_firmware, ipcom_ex2_sc_3500, ipcom_ex2_sc_3500_firmware, ipcom_ve2_ls_100, ipcom_ve2_ls_100_firmware, ipcom_ve2_ls_200, ipcom_ve2_ls_200_firmware, ipcom_ve2_ls_220, ipcom_ve2_ls_220_firmware, ipcom_ve2_ls_plus2_200, ipcom_ve2_ls_plus2_200_firmware, ipcom_ve2_ls_plus2_220
CVE-2024-39922 (published 2024-08-13)
A vulnerability has been identified in LOGO! 12/24RCE (6ED1052-1MD08-0BA1) (All versions), LOGO! 12/24RCEo (6ED1052-2MD08-0BA1) (All versions), LOGO! 230RCE (6ED1052-1FB08-0BA1) (All versions), LOGO! 230RCEo (6ED1052-2FB08-0BA1) (All versions), LOGO! 24CE (6ED1052-1CC08-0BA1) (All versions), LOGO! 24CEo (6ED1052-2CC08-0BA1) (All versions), LOGO! 24RCE (6ED1052-1HB08-0BA1) (All versions), LOGO! 24RCEo (6ED1052-2HB08-0BA1) (All versions), SIPLUS LOGO! 12/24RCE (6AG1052-1MD08-7BA1) (All versions), SIPLUS LOGO! 12/24RCEo (6AG1052-2MD08-7BA1) (All versions), SIPLUS LOGO! 230RCE (6AG1052-1FB08-7BA1) (All versions), SIPLUS LOGO! 230RCEo (6AG1052-2FB08-7BA1) (All versions), SIPLUS LOGO! 24CE (6AG1052-1CC08-7BA1) (All versions), SIPLUS LOGO! 24CEo (6AG1052-2CC08-7BA1) (All versions), SIPLUS LOGO! 24RCE (6AG1052-1HB08-7BA1) (All versions), SIPLUS LOGO! 24RCEo (6AG1052-2HB08-7BA1) (All versions). Affected devices store user passwords in plaintext without proper protection. This could allow a physical attacker to retrieve them from the embedded storage ICs.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-256
CVE-2024-39924 (published 2024-09-13)
An issue was discovered in Vaultwarden (formerly Bitwarden_RS) 1.30.3. A vulnerability has been identified in the authentication and authorization process of the endpoint responsible for altering the metadata of an emergency access. It permits an attacker with granted emergency access to escalate their privileges by changing the access level and modifying the wait time. Consequently, the attacker can gain full control over the vault (when only intended to have read access) while bypassing the necessary wait period.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-276
Affected vendors: dani-garcia
Affected products: vaultwarden
CVE-2024-39925 (published 2024-09-13)
An issue was discovered in Vaultwarden (formerly Bitwarden_RS) 1.30.3. It lacks an offboarding process for members who leave an organization. As a result, the shared organization key is not rotated when a member departs. Consequently, the departing member, whose access should be revoked, retains a copy of the organization key. Additionally, the application fails to adequately protect some encrypted data stored on the server. Consequently, an authenticated user could gain unauthorized access to encrypted data of any organization, even if the user is not a member of the targeted organization. However, the user would need to know the corresponding organizationId. Hence, if a user (whose access to an organization has been revoked) already possesses the organization key, that user could use the key to decrypt the leaked data.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-200
Affected vendors: dani-garcia
Affected products: vaultwarden
CVE-2024-39926 (published 2024-09-13)
An issue was discovered in Vaultwarden (formerly Bitwarden_RS) 1.30.3. A stored cross-site scripting (XSS) or, due to the default CSP, HTML injection vulnerability has been discovered in the admin dashboard. This potentially allows an authenticated attacker to inject malicious code into the dashboard, which is then executed or rendered in the context of an administrator's browser when viewing the injected content. However, it is important to note that the default Content Security Policy (CSP) of the application blocks most exploitation paths, significantly mitigating the potential impact.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: dani-garcia
Affected products: vaultwarden
CVE-2024-39927 (published 2024-07-10)
Out-of-bounds write vulnerability exists in Ricoh MFPs and printers. If a remote attacker sends a specially crafted request to the affected products, the products may be able to cause a denial-of-service (DoS) condition and/or user's data may be destroyed.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H)
Weakness: CWE-787
CVE-2024-39928 (published 2024-09-25)
In Apache Linkis <= 1.5.0, a Random string security vulnerability in Spark EngineConn, random string generated by the Token when starting Py4j uses the Commons Lang's RandomStringUtils.
Users are recommended to upgrade to version 1.6.0, which fixes this issue.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-326
Affected vendors: apache
Affected products: linkis
CVE-2024-39929 (published 2024-07-04)
Exim through 4.97.1 misparses a multiline RFC 2231 header filename, and thus remote attackers can bypass a $mime_filename extension-blocking protection mechanism, and potentially deliver executable attachments to the mailboxes of end users.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N)
Weakness: CWE-116
Affected vendors: exim
Affected products: exim
CVE-2024-3993 (published 2024-06-14)
The AZAN Plugin WordPress plugin through 0.6 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L)
Weakness: CWE-352
Affected vendors: wp-master
Affected products: azan
CVE-2024-39930 (published 2024-07-04)
The built-in SSH server of Gogs through 0.13.0 allows argument injection in internal/ssh/ssh.go, leading to remote code execution. Authenticated attackers can exploit this by opening an SSH connection and sending a malicious --split-string env request if the built-in SSH server is activated. Windows installations are unaffected.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H)
Weakness: CWE-88
Affected vendors: gogs
Affected products: gogs
CVE-2024-39931 (published 2024-07-04)
Gogs through 0.13.0 allows deletion of internal files.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H)
Weakness: CWE-552
Affected vendors: gogs
Affected products: gogs
CVE-2024-39932 (published 2024-07-04)
Gogs through 0.13.0 allows argument injection during the previewing of changes.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H)
Weakness: CWE-94
Affected vendors: gogs
Affected products: gogs
CVE-2024-39933 (published 2024-07-04)
Gogs through 0.13.0 allows argument injection during the tagging of a new release.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N)
Weakness: CWE-88
Affected vendors: gogs
Affected products: gogs
CVE-2024-39934 (published 2024-07-04)
Robotmk before 2.0.1 allows a local user to escalate privileges (e.g., to SYSTEM) if automated Python environment setup is enabled, because the "shared holotree usage" feature allows any user to edit any Python environment.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-284
CVE-2024-39935 (published 2024-07-04)
jc21 NGINX Proxy Manager before 2.11.3 allows backend/internal/certificate.js OS command injection by an authenticated user (with certificate management privileges) via untrusted input to the DNS provider configuration. NOTE: this is not part of any NGINX software shipped by F5.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-78
Affected vendors: jc21
Affected products: nginx_proxy_manager
CVE-2024-39936 (published 2024-07-04)
An issue was discovered in HTTP2 in Qt before 5.15.18, 6.x before 6.2.13, 6.3.x through 6.5.x before 6.5.7, and 6.6.x through 6.7.x before 6.7.3. Code to make security-relevant decisions about an established connection may execute too early, because the encrypted() signal has not yet been emitted and processed..
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-367
Affected vendors: qt
Affected products: qt
CVE-2024-39937 (published 2024-07-04)
supOS 5.0 allows api/image/download?fileName=../ directory traversal for reading files.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-22
Affected vendors: supos
Affected products: supos
CVE-2024-3994 (published 2024-04-25)
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'tutor_instructor_list' shortcode in all versions up to, and including, 2.6.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: themeum
Affected products: tutor_lms
CVE-2024-39943 (published 2024-07-04)
rejetto HFS (aka HTTP File Server) 3 before 0.52.10 on Linux, UNIX, and macOS allows OS command execution by remote authenticated users (if they have Upload permissions). This occurs because a shell is used to execute df (i.e., with execSync instead of spawnSync in child_process in Node.js).
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-78
Affected vendors: rejetto
Affected products: http_file_server
CVE-2024-39944 (published 2024-07-31)
A vulnerability has been found in Dahua products.Attackers
can send carefully crafted data packets to the interface with vulnerabilities,
causing the device to crash.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-770
Affected vendors: dahuasecurity
Affected products: ipc-hfs8449g-z7-led, ipc-hfs8449g-z7-led_firmware, ipc-hfs8849g-z3-led, ipc-hfs8849g-z3-led_firmware, nvr4104-4ks2\/l, nvr4104-4ks2\/l_firmware, nvr4104-4ks3, nvr4104-4ks3_firmware, nvr4104-p-4ks2\/l, nvr4104-p-4ks2\/l_firmware, nvr4104-p-4ks3, nvr4104-p-4ks3\(960g\), nvr4104-p-4ks3\(960g\)_firmware, nvr4104-p-4ks3_firmware, nvr4104hs-4ks2\/l, nvr4104hs-4ks2\/l_firmware, nvr4104hs-4ks3, nvr4104hs-4ks3\(960g\), nvr4104hs-4ks3\(960g\)_firmware, nvr4104hs-4ks3_firmware, nvr4104hs-p-4ks2\/l, nvr4104hs-p-4ks2\/l_firmware, nvr4104hs-p-4ks3, nvr4104hs-p-4ks3\(960g\), nvr4104hs-p-4ks3\(960g\)_firmware
CVE-2024-39945 (published 2024-07-31)
A vulnerability has been found in Dahua products.  After
obtaining the administrator's username and password, the attacker can send a
carefully crafted data packet to the interface with vulnerabilities, causing
the device to crash.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-703
Affected vendors: dahuasecurity
Affected products: nvr4104-4ks2\/l, nvr4104-4ks2\/l_firmware, nvr4104-4ks3, nvr4104-4ks3_firmware, nvr4104-p-4ks2\/l, nvr4104-p-4ks2\/l_firmware, nvr4104-p-4ks3, nvr4104-p-4ks3\(960g\), nvr4104-p-4ks3\(960g\)_firmware, nvr4104-p-4ks3_firmware, nvr4104hs-4ks2\/l, nvr4104hs-4ks2\/l_firmware, nvr4104hs-4ks3, nvr4104hs-4ks3\(960g\), nvr4104hs-4ks3\(960g\)_firmware, nvr4104hs-4ks3_firmware, nvr4104hs-p-4ks2\/l, nvr4104hs-p-4ks2\/l_firmware, nvr4104hs-p-4ks3, nvr4104hs-p-4ks3\(960g\), nvr4104hs-p-4ks3\(960g\)_firmware, nvr4104hs-p-4ks3_firmware, nvr4108-4ks2\/l, nvr4108-4ks2\/l_firmware, nvr4108-4ks3
CVE-2024-39946 (published 2024-07-31)
A vulnerability has been found in Dahua products.After obtaining the administrator's username and password, the attacker can send a carefully crafted data packet to the interface with vulnerabilities, causing device initialization.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Affected vendors: dahuasecurity
Affected products: nvr4104-4ks2\/l, nvr4104-4ks2\/l_firmware, nvr4104-4ks3, nvr4104-4ks3_firmware, nvr4104-p-4ks2\/l, nvr4104-p-4ks2\/l_firmware, nvr4104-p-4ks3, nvr4104-p-4ks3\(960g\), nvr4104-p-4ks3\(960g\)_firmware, nvr4104-p-4ks3_firmware, nvr4104hs-4ks2\/l, nvr4104hs-4ks2\/l_firmware, nvr4104hs-4ks3, nvr4104hs-4ks3\(960g\), nvr4104hs-4ks3\(960g\)_firmware, nvr4104hs-4ks3_firmware, nvr4104hs-p-4ks2\/l, nvr4104hs-p-4ks2\/l_firmware, nvr4104hs-p-4ks3, nvr4104hs-p-4ks3\(960g\), nvr4104hs-p-4ks3\(960g\)_firmware, nvr4104hs-p-4ks3_firmware, nvr4108-4ks2\/l, nvr4108-4ks2\/l_firmware, nvr4108-4ks3
CVE-2024-39947 (published 2024-07-31)
A vulnerability has been found in Dahua products.After obtaining the ordinary user's username and password, the attacker can send a carefully crafted data packet to the interface with vulnerabilities, causing the device to crash.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Affected vendors: dahuasecurity
Affected products: nvr4104-4ks2\/l, nvr4104-4ks2\/l_firmware, nvr4104-4ks3, nvr4104-4ks3_firmware, nvr4104-p-4ks2\/l, nvr4104-p-4ks2\/l_firmware, nvr4104-p-4ks3, nvr4104-p-4ks3\(960g\), nvr4104-p-4ks3\(960g\)_firmware, nvr4104-p-4ks3_firmware, nvr4104hs-4ks2\/l, nvr4104hs-4ks2\/l_firmware, nvr4104hs-4ks3, nvr4104hs-4ks3\(960g\), nvr4104hs-4ks3\(960g\)_firmware, nvr4104hs-4ks3_firmware, nvr4104hs-p-4ks2\/l, nvr4104hs-p-4ks2\/l_firmware, nvr4104hs-p-4ks3, nvr4104hs-p-4ks3\(960g\), nvr4104hs-p-4ks3\(960g\)_firmware, nvr4104hs-p-4ks3_firmware, nvr4108-4ks2\/l, nvr4108-4ks2\/l_firmware, nvr4108-4ks3
CVE-2024-39948 (published 2024-07-31)
A vulnerability has been found in Dahua products. Attackers can send carefully crafted data packets to the interface with vulnerabilities, causing the device to crash.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-476
Affected vendors: dahuasecurity
Affected products: nvr4104-4ks2\/l, nvr4104-4ks2\/l_firmware, nvr4104-4ks3, nvr4104-4ks3_firmware, nvr4104-p-4ks2\/l, nvr4104-p-4ks2\/l_firmware, nvr4104-p-4ks3, nvr4104-p-4ks3\(960g\), nvr4104-p-4ks3\(960g\)_firmware, nvr4104-p-4ks3_firmware, nvr4104hs-4ks2\/l, nvr4104hs-4ks2\/l_firmware, nvr4104hs-4ks3, nvr4104hs-4ks3\(960g\), nvr4104hs-4ks3\(960g\)_firmware, nvr4104hs-4ks3_firmware, nvr4104hs-p-4ks2\/l, nvr4104hs-p-4ks2\/l_firmware, nvr4104hs-p-4ks3, nvr4104hs-p-4ks3\(960g\), nvr4104hs-p-4ks3\(960g\)_firmware, nvr4104hs-p-4ks3_firmware, nvr4108-4ks2\/l, nvr4108-4ks2\/l_firmware, nvr4108-4ks3
CVE-2024-39949 (published 2024-07-31)
A vulnerability has been found in Dahua products. Attackers can send carefully crafted data packets to the interface with vulnerabilities, causing the device to crash.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-617
Affected vendors: dahuasecurity
Affected products: nvr4104-4ks2\/l, nvr4104-4ks2\/l_firmware, nvr4104-4ks3, nvr4104-4ks3_firmware, nvr4104-p-4ks2\/l, nvr4104-p-4ks2\/l_firmware, nvr4104-p-4ks3, nvr4104-p-4ks3\(960g\), nvr4104-p-4ks3\(960g\)_firmware, nvr4104-p-4ks3_firmware, nvr4104hs-4ks2\/l, nvr4104hs-4ks2\/l_firmware, nvr4104hs-4ks3, nvr4104hs-4ks3\(960g\), nvr4104hs-4ks3\(960g\)_firmware, nvr4104hs-4ks3_firmware, nvr4104hs-p-4ks2\/l, nvr4104hs-p-4ks2\/l_firmware, nvr4104hs-p-4ks3, nvr4104hs-p-4ks3\(960g\), nvr4104hs-p-4ks3\(960g\)_firmware, nvr4104hs-p-4ks3_firmware, nvr4108-4ks2\/l, nvr4108-4ks2\/l_firmware, nvr4108-4ks3
CVE-2024-3995 (published 2024-06-28)
In Helix ALM versions prior to 2024.2.0, a local command injection was identified.  Reported by Bryan Riggins.
Severity: LOW (CVSS 4.0 vector: CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X)
Weakness: CWE-94
CVE-2024-39950 (published 2024-07-31)
A vulnerability has been found in Dahua products. Attackers can send carefully crafted data packets to the interface with vulnerabilities to initiate device initialization.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-121
Affected vendors: dahuasecurity
Affected products: ipc-hfs8449g-z7-led, ipc-hfs8449g-z7-led_firmware, ipc-hfs8849g-z3-led, ipc-hfs8849g-z3-led_firmware, nvr4104-4ks2\/l, nvr4104-4ks2\/l_firmware, nvr4104-4ks3, nvr4104-4ks3_firmware, nvr4104-p-4ks2\/l, nvr4104-p-4ks2\/l_firmware, nvr4104-p-4ks3, nvr4104-p-4ks3\(960g\), nvr4104-p-4ks3\(960g\)_firmware, nvr4104-p-4ks3_firmware, nvr4104hs-4ks2\/l, nvr4104hs-4ks2\/l_firmware, nvr4104hs-4ks3, nvr4104hs-4ks3\(960g\), nvr4104hs-4ks3\(960g\)_firmware, nvr4104hs-4ks3_firmware, nvr4104hs-p-4ks2\/l, nvr4104hs-p-4ks2\/l_firmware, nvr4104hs-p-4ks3, nvr4104hs-p-4ks3\(960g\), nvr4104hs-p-4ks3\(960g\)_firmware
CVE-2024-39962 (published 2024-07-19)
D-Link DIR-823X AX3000 Dual-Band Gigabit Wireless Router v21_D240126 was discovered to contain a remote code execution (RCE) vulnerability in the ntp_zone_val parameter at /goform/set_ntp. This vulnerability is exploited via a crafted HTTP request.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-94
Affected vendors: dlink
Affected products: dir-823x, dir-823x_firmware
CVE-2024-39963 (published 2024-07-19)
AX3000 Dual-Band Gigabit Wi-Fi 6 Router AX9 V22.03.01.46 and AX3000 Dual-Band Gigabit Wi-Fi 6 Router AX12 V1.0 V22.03.01.46 were discovered to contain an authenticated remote command execution (RCE) vulnerability via the macFilterType parameter at /goform/setMacFilterCfg.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-77
Affected vendors: tenda
Affected products: ax12, ax12_firmware, ax9, ax9_firmware
CVE-2024-3997 (published 2024-05-23)
The Prime Slider – Addons For Elementor (Revolution of a slider, Hero Slider, Ecommerce Slider) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Pagepiling widget in all versions up to, and including, 3.14.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: bdthemes
Affected products: prime_slider
CVE-2024-3998 (published 2024-08-30)
The Betheme theme for WordPress is vulnerable to Stored Cross-Site Scripting via several of the plugin's shortcodes in all versions up to, and including, 27.5.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: muffingroup
Affected products: betheme
CVE-2024-3999 (published 2024-07-02)
The EazyDocs  WordPress plugin before 2.5.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: spider-themes
Affected products: eazydocs
CVE-2024-4000 (published 2024-05-02)
The WordPress Header Builder Plugin – Pearl plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'stm_hb' shortcode in all versions up to, and including, 1.3.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N)
Weakness: CWE-79
CVE-2024-4001 (published 2024-06-05)
The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wpdm_modal_login_form' shortcode in all versions up to, and including, 3.2.93 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: wpdownloadmanager
Affected products: download_manager
CVE-2024-4003 (published 2024-05-02)
The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the eael_team_members_image_rounded parameter in the Team Members widget in all versions up to, and including, 5.9.15 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor access and higher, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-20
Affected vendors: wpdeveloper
Affected products: essential_addons_for_elementor
CVE-2024-40034 (published 2024-07-09)
idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/userLevel_deal.php?mudi=del
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-352
Affected vendors: idccms_project
Affected products: idccms
CVE-2024-40035 (published 2024-07-09)
idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/userLevel_deal.php?mudi=add.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)
Weakness: CWE-352
Affected vendors: idccms
Affected products: idccms
CVE-2024-40036 (published 2024-07-09)
idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/userGroup_deal.php?mudi=add&nohrefStr=close
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-79
Affected vendors: idccms
Affected products: idccms
CVE-2024-40037 (published 2024-07-09)
idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/userScore_deal.php?mudi=del
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-352
Affected vendors: idccms_project
Affected products: idccms
CVE-2024-40038 (published 2024-07-09)
idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/userScore_deal.php?mudi=rev
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L)
Weakness: CWE-352
Affected vendors: idccms
Affected products: idccms
CVE-2024-40039 (published 2024-07-09)
idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/userGroup_deal.php?mudi=del
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-352
Affected vendors: idccms_project
Affected products: idccms
CVE-2024-4005 (published 2024-06-14)
The Social Pixel WordPress plugin through 2.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: labschool
Affected products: social_pixel
CVE-2024-40051 (published 2024-07-22)
IP Guard v4.81.0307.0 was discovered to contain an arbitrary file read vulnerability via the file name parameter.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-22
Affected vendors: ip-guard
Affected products: ip-guard
CVE-2024-4006 (published 2024-04-25)
An issue has been discovered in GitLab CE/EE affecting all versions starting from 16.7 before 16.9.6, all versions starting from 16.10 before 16.10.4, all versions starting from 16.11 before 16.11.1 where personal access scopes were not honored by GraphQL subscriptions
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)
Weakness: CWE-863
Affected vendors: gitlab
Affected products: gitlab
CVE-2024-40060 (published 2024-07-23)
go-chart v2.1.1 was discovered to contain an infinite loop via the drawCanvas() function.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-835
Affected vendors: wcharczuk
Affected products: go-chart
CVE-2024-4007 (published 2024-07-01)
Default credential in install package in ABB ASPECT; NEXUS Series; MATRIX Series version 3.07 allows attacker to login to product instances wrongly configured.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-1392
Affected vendors: abb
Affected products: aspect-ent-12, aspect-ent-12_firmware, aspect-ent-2, aspect-ent-256, aspect-ent-256_firmware, aspect-ent-2_firmware, aspect-ent-96, aspect-ent-96_firmware, matrix-11, matrix-11_firmware, matrix-216, matrix-216_firmware, matrix-232, matrix-232_firmware, matrix-264, matrix-264_firmware, matrix-296, matrix-296_firmware, nexus-2128, nexus-2128_firmware, nexus-264, nexus-264_firmware, nexus-3-2128, nexus-3-2128_firmware, nexus-3-264
CVE-2024-40075 (published 2024-07-22)
Laravel v11.x was discovered to contain an XML External Entity (XXE) vulnerability.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L)
Weakness: CWE-611
CVE-2024-4008 (published 2024-06-05)
FDSK Leak in ABB, Busch-Jaeger, FTS Display (version 1.00) and BCU (version 1.3.0.33) allows attacker to take control via access to local KNX Bus-System
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-497
Affected vendors: abb
Affected products: 2tma310010b0001, 2tma310010b0001_firmware, 2tma310010b0003, 2tma310010b0003_firmware, 2tma310011b0001, 2tma310011b0001_firmware, 2tma310011b0002, 2tma310011b0002_firmware, 2tma310011b0003, 2tma310011b0003_firmware
CVE-2024-40083 (published 2024-10-21)
A Buffer Overflow vulnerabilty in the local_app_set_router_token function of Vilo 5 Mesh WiFi System <= 5.16.1.33 allows remote, unauthenticated attackers to execute arbitrary code via sscanf reading the token and timezone JSON fields into a fixed-length buffer.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)
Weakness: CWE-120
CVE-2024-40084 (published 2024-10-21)
A Buffer Overflow in the Boa webserver of Vilo 5 Mesh WiFi System <= 5.16.1.33 allows remote, unauthenticated attackers to execute arbitrary code via exceptionally long HTTP methods or paths.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)
Weakness: CWE-120
Affected vendors: viloliving
Affected products: vilo_5, vilo_5_firmware
CVE-2024-40085 (published 2024-10-21)
A Buffer Overflow vulnerability in the local_app_set_router_wan function of Vilo 5 Mesh WiFi System <= 5.16.1.33 allows remote, unauthenticated attackers to execute arbitrary code via pppoe_username and pppoe_password fields being larger than 128 bytes in length.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)
Weakness: CWE-120
CVE-2024-40086 (published 2024-10-21)
A Buffer Overflow vulnerability in the local_app_set_router_wifi_SSID_PWD function of Vilo 5 Mesh WiFi System <= 5.16.1.33 allows remote, unauthenticated attackers to execute arbitrary code via a password field larger than 64 bytes in length.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)
Weakness: CWE-120
CVE-2024-40087 (published 2024-10-21)
Vilo 5 Mesh WiFi System <= 5.16.1.33 is vulnerable to Insecure Permissions. Lack of authentication in the custom TCP service on port 5432 allows remote, unauthenticated attackers to gain administrative access over the router.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)
Weakness: CWE-306
Affected vendors: viloliving
Affected products: vilo_5, vilo_5_firmware
CVE-2024-40088 (published 2024-10-21)
A Directory Traversal vulnerability in the Boa webserver of Vilo 5 Mesh WiFi System <= 5.16.1.33 allows remote, unauthenticated attackers to enumerate the existence and length of any file in the filesystem by placing malicious payloads in the path of any HTTP request.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
Weakness: CWE-79
Affected vendors: viloliving
Affected products: vilo_5, vilo_5_firmware
CVE-2024-40089 (published 2024-10-21)
A Command Injection vulnerability in Vilo 5 Mesh WiFi System <= 5.16.1.33 allows remote, authenticated attackers to execute arbitrary code by injecting shell commands into the name of the Vilo device.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H)
Weakness: CWE-77
Affected vendors: viloliving
Affected products: vilo_5, vilo_5_firmware
CVE-2024-4009 (published 2024-06-05)
Replay Attack

in ABB, Busch-Jaeger, FTS Display (version 1.00) and BCU (version 1.3.0.33) allows attacker to capture/replay KNX telegram to local KNX Bus-System
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-294
Affected vendors: abb
Affected products: 2tma310010b0001, 2tma310010b0001_firmware, 2tma310010b0003, 2tma310010b0003_firmware, 2tma310011b0001, 2tma310011b0001_firmware, 2tma310011b0002, 2tma310011b0002_firmware, 2tma310011b0003, 2tma310011b0003_firmware
CVE-2024-40090 (published 2024-10-21)
Vilo 5 Mesh WiFi System <= 5.16.1.33 is vulnerable to Information Disclosure. An information leak in the Boa webserver allows remote, unauthenticated attackers to leak memory addresses of uClibc and the stack via sending a GET request to the index page.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
Weakness: CWE-319
Affected vendors: viloliving
Affected products: vilo_5, vilo_5_firmware
CVE-2024-40091 (published 2024-10-21)
Vilo 5 Mesh WiFi System <= 5.16.1.33 lacks authentication in the Boa webserver, which allows remote, unauthenticated attackers to retrieve logs with sensitive system.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-306
Affected vendors: viloliving
Affected products: vilo_5, vilo_5_firmware
CVE-2024-40094 (published 2024-07-30)
GraphQL Java (aka graphql-java) before 21.5 does not properly consider ExecutableNormalizedFields (ENFs) as part of preventing denial of service via introspection queries. 20.9 and 19.11 are also fixed versions.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
CVE-2024-40096 (published 2024-08-05)
The com.cascadialabs.who (aka Who - Caller ID, Spam Block) application 15.0 for Android places sensitive information in the system log.
Severity: LOW (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)
Weakness: CWE-532
Affected vendors: rd_labs_llc
Affected products: who
CVE-2024-4010 (published 2024-05-15)
The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to unauthorized access of data, modification of data, and loss of data due to a missing capability check on the handle_ajax_request function in all versions up to, and including, 5.7.19. This makes it possible for authenticated attackers, with subscriber-level access and above, to cause a loss of confidentiality, integrity, and availability, by performing multiple unauthorized actions. Some of these actions could also be leveraged to conduct PHP Object Injection and SQL Injection attacks.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-862
CVE-2024-40101 (published 2024-08-06)
A Reflected Cross-site scripting (XSS) vulnerability exists in '/search' in microweber 2.0.15 and earlier allowing unauthenticated remote attackers to inject arbitrary web script or HTML via the 'keywords' parameter.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: microweber
Affected products: microweber
CVE-2024-4011 (published 2024-06-27)
An issue was discovered in GitLab CE/EE affecting all versions starting from 16.1 prior to 16.11.5, starting from 17.0 prior to 17.0.3, and starting from 17.1 prior to 17.1.1, which allows non-project member to promote key results to objectives.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N)
Weakness: CWE-863
Affected vendors: gitlab
Affected products: gitlab
CVE-2024-40110 (published 2024-07-12)
Sourcecodester Poultry Farm Management System v1.0 contains an Unauthenticated Remote Code Execution (RCE) vulnerability via the productimage parameter at /farm/product.php.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-77
Affected vendors: nikhil-bhalerao
Affected products: poultry_farm_management_system
CVE-2024-40111 (published 2024-08-23)
A persistent (stored) cross-site scripting (XSS) vulnerability has been identified in Automad 2.0.0-alpha.4. This vulnerability enables an attacker to inject malicious JavaScript code into the template body. The injected code is stored within the flat file CMS and is executed in the browser of any user visiting the forum.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: automad
Affected products: automad
CVE-2024-40116 (published 2024-07-26)
An issue in Solar-Log 1000 before v2.8.2 and build 52-23.04.2013 was discovered to store plaintext passwords in the export.html, email.html, and sms.html files -- fixed with 3.0.0-60 11.10.2013 for SL 200, 500, 1000 / not existing for SL 250, 300, 1200, 2000, SL 50 Gateway, SL Base.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N)
Weakness: CWE-256
CVE-2024-40117 (published 2024-07-26)
Incorrect access control in Solar-Log 1000 before v2.8.2 and build 52- 23.04.2013 allows attackers to obtain Administrative privileges via connecting to the web administration server. Not existing for SL 200, 500, 1000 / fixed in 4.2.8 for SL 250, 300, 1200, 2000, SL 50 Gateway / fixed in 5.1.2 / 6.0.0 for SL Base.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-284
CVE-2024-40119 (published 2024-07-17)
Nepstech Wifi Router xpon (terminal) model NTPL-Xpon1GFEVN v.1.0 Firmware V2.0.1 contains a Cross-Site Request Forgery (CSRF) vulnerability in the password change function, which allows remote attackers to change the admin password without the user's consent, leading to a potential account takeover.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-352
CVE-2024-40125 (published 2024-09-19)
An arbitrary file upload vulnerability in the Media Manager function of Closed-Loop Technology CLESS Server v4.5.2 allows attackers to execute arbitrary code via uploading a crafted PHP file to the upload endpoint.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-434
Affected vendors: closed-loop
Affected products: cless_server
CVE-2024-40129 (published 2024-07-16)
Open5GS v2.6.4 is vulnerable to Buffer Overflow. via /lib/pfcp/context.c.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-787
Affected vendors: open5gs
Affected products: open5gs
CVE-2024-4013 (published 2024-06-06)
A bug exists in the API, mesh_node_power_off(), which fails to copy the contents of the Replay Protection 
List (RPL) from RAM to NVM before powering down, resulting in the ability to replay unsaved messages. Note that as of June 2024, the Gecko SDK was renamed to the Simplicity SDK, and the versioning scheme 
was changed from Gecko SDK vX.Y.Z to Simplicity SDK YYYY.MM.Patch#.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L)
Weakness: CWE-404
CVE-2024-40130 (published 2024-07-16)
open5gs v2.6.4 is vulnerable to Buffer Overflow. via /lib/core/abts.c.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-787
Affected vendors: open5gs
Affected products: open5gs
CVE-2024-40137 (published 2024-07-24)
Dolibarr ERP CRM before 19.0.2-php8.2 was discovered to contain a remote code execution (RCE) vulnerability via the Computed field parameter under the Users Module Setup function.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:N)
Weakness: CWE-74
CVE-2024-4014 (published 2024-04-20)
The hCaptcha for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's cf7-hcaptcha shortcode in all versions up to, and including, 4.0.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N)
Weakness: CWE-79
CVE-2024-4017 (published 2024-04-19)
Improper Privilege Management vulnerability in BeyondTrust U-Series Appliance on Windows, 64 bit (filesystem modules) allows DLL Side-Loading.This issue affects U-Series Appliance: from 3.4 before 4.0.3.


Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-269
Affected vendors: beyondtrust, microsoft
Affected products: u-series_appliance, windows
CVE-2024-4018 (published 2024-04-19)
Improper Privilege Management vulnerability in BeyondTrust U-Series Appliance on Windows, 64 bit (local appliance api modules) allows Privilege Escalation.This issue affects U-Series Appliance: from 3.4 before 4.0.3.


Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-269
Affected vendors: beyondtrust, microsoft
Affected products: u-series_appliance, windows
CVE-2024-4019 (published 2024-04-20)
A vulnerability classified as critical has been found in Byzoro Smart S80 Management Platform up to 20240411. Affected is an unknown function of the file /importhtml.php. The manipulation of the argument sql leads to deserialization. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-261666 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L)
Weakness: CWE-502
CVE-2024-4020 (published 2024-04-20)
A vulnerability was found in Tenda FH1206 1.2.0.8(8155) and classified as critical. This issue affects the function fromAddressNat of the file /goform/addressNat. The manipulation of the argument entrys leads to buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-261671. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-120
Affected vendors: tenda
Affected products: fh1206, fh1206_firmware