deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-5339
Published: 2024-05-25
Description: A vulnerability was found in Ruijie RG-UAC up to 20240516. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /view/vpn/autovpn/online_check.php. The manipulation of the argument peernode leads to os command injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-266245 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-78
References: https://github.com/h0e4a0r1t/h0e4a0r1t.github.io/blob/master/2024/z%7CYVDv%7CHKA)*%5CdK!/Ruijie%20RG-UAC%20Unified%20Internet%20Behavior%20Management%20Audit%20System%20Backend%20RCE%20Vulnerability-autovpn%3Aonline_check.php.pdf; https://vuldb.com/?ctiid.266245; https://vuldb.com/?id.266245
CVE: CVE-2024-30056
Published: 2024-05-25
Description: Microsoft Edge (Chromium-based) Information Disclosure Vulnerability
CVSS Score: 7.1 (HIGH)
CWE: CWE-359
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-30056; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-30056
CVE: CVE-2024-5340
Published: 2024-05-25
Description: A vulnerability was found in Ruijie RG-UAC up to 20240516. It has been rated as critical. Affected by this issue is some unknown functionality of the file /view/vpn/autovpn/sub_commit.php. The manipulation of the argument key leads to os command injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-266246 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-78
References: https://github.com/h0e4a0r1t/h0e4a0r1t.github.io/blob/master/2024/z%7CYVDv%7CHKA)*%5CdK!/Ruijie%20RG-UAC%20Unified%20Internet%20Behavior%20Management%20Audit%20System%20Backend%20RCE%20Vulnerability-autovpn%3Asub_commit.php.pdf; https://vuldb.com/?ctiid.266246; https://vuldb.com/?id.266246
CVE: CVE-2024-5350
Published: 2024-05-25
Description: A vulnerability was found in anji-plus AJ-Report up to 1.4.1. It has been classified as critical. Affected is the function pageList of the file /pageList. The manipulation of the argument p leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-266262 is the identifier assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/anji-plus/report/files/15363269/aj-report.pdf; https://github.com/anji-plus/report/issues/34; https://vuldb.com/?ctiid.266262
CVE: CVE-2024-5351
Published: 2024-05-26
Description: A vulnerability was found in anji-plus AJ-Report up to 1.4.1. It has been declared as critical. Affected by this vulnerability is the function getValueFromJs of the component Javascript Handler. The manipulation leads to deserialization. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-266263.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-502
References: https://github.com/anji-plus/report/files/15363269/aj-report.pdf; https://github.com/anji-plus/report/issues/34; https://vuldb.com/?ctiid.266263
CVE: CVE-2024-5352
Published: 2024-05-26
Description: A vulnerability was found in anji-plus AJ-Report up to 1.4.1. It has been rated as critical. Affected by this issue is the function validationRules of the component com.anjiplus.template.gaea.business.modules.datasetparam.controller.DataSetParamController#verification. The manipulation leads to deserialization. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-266264.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-502
References: https://github.com/anji-plus/report/files/15363269/aj-report.pdf; https://github.com/anji-plus/report/issues/34; https://vuldb.com/?ctiid.266264
CVE: CVE-2024-5353
Published: 2024-05-26
Description: A vulnerability classified as critical has been found in anji-plus AJ-Report up to 1.4.1. This affects the function decompress of the component ZIP File Handler. The manipulation leads to path traversal. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-266265 was assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-22
References: https://github.com/anji-plus/report/files/15363269/aj-report.pdf; https://github.com/anji-plus/report/issues/34; https://vuldb.com/?ctiid.266265
CVE: CVE-2024-5354
Published: 2024-05-26
Description: A vulnerability classified as problematic was found in anji-plus AJ-Report up to 1.4.1. This vulnerability affects unknown code of the file /reportShare/detailByCode. The manipulation of the argument shareToken leads to information disclosure. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-266266 is the identifier assigned to this vulnerability.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: https://github.com/anji-plus/report/files/15363269/aj-report.pdf; https://github.com/anji-plus/report/issues/34; https://vuldb.com/?ctiid.266266
CVE: CVE-2024-5355
Published: 2024-05-26
Description: A vulnerability, which was classified as critical, has been found in anji-plus AJ-Report up to 1.4.1. This issue affects the function IGroovyHandler. The manipulation leads to command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-266267.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-77
References: https://github.com/anji-plus/report/files/15363269/aj-report.pdf; https://github.com/anji-plus/report/issues/34; https://vuldb.com/?ctiid.266267
CVE: CVE-2024-5356
Published: 2024-05-26
Description: A vulnerability, which was classified as critical, was found in anji-plus AJ-Report up to 1.4.1. Affected is an unknown function of the file /dataSet/testTransform;swagger-ui. The manipulation of the argument dynSentence leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-266268.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/anji-plus/report/files/15363269/aj-report.pdf; https://github.com/anji-plus/report/issues/34; https://vuldb.com/?ctiid.266268
CVE: CVE-2024-5357
Published: 2024-05-26
Description: A vulnerability has been found in PHPGurukul Zoo Management System 2.1 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /admin/forgot-password.php. The manipulation of the argument email leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-266269 was assigned to this vulnerability.
CVSS Score: 7.3 (HIGH)
CWE: CWE-89
References: https://vuldb.com/?ctiid.266269; https://vuldb.com/?id.266269; https://vuldb.com/?submit.343372
CVE: CVE-2024-5358
Published: 2024-05-26
Description: A vulnerability was found in PHPGurukul Zoo Management System 2.1 and classified as critical. Affected by this issue is some unknown functionality of the file /admin/normal-search.php. The manipulation of the argument searchdata leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-266270 is the identifier assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://vuldb.com/?ctiid.266270; https://vuldb.com/?id.266270; https://vuldb.com/?submit.343374
CVE: CVE-2024-5359
Published: 2024-05-26
Description: A vulnerability was found in PHPGurukul Zoo Management System 2.1. It has been classified as critical. This affects an unknown part of the file /admin/foreigner-search.php. The manipulation of the argument searchdata leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-266271.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://vuldb.com/?ctiid.266271; https://vuldb.com/?id.266271; https://vuldb.com/?submit.343716
CVE: CVE-2024-5360
Published: 2024-05-26
Description: A vulnerability was found in PHPGurukul Zoo Management System 2.1. It has been declared as critical. This vulnerability affects unknown code of the file /admin/foreigner-bwdates-reports-details.php. The manipulation of the argument fromdate leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-266272.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://vuldb.com/?ctiid.266272; https://vuldb.com/?id.266272; https://vuldb.com/?submit.343722
CVE: CVE-2024-5361
Published: 2024-05-26
Description: A vulnerability was found in PHPGurukul Zoo Management System 2.1. It has been rated as critical. This issue affects some unknown processing of the file /admin/normal-bwdates-reports-details.php. The manipulation of the argument fromdate leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-266273 was assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://vuldb.com/?ctiid.266273; https://vuldb.com/?id.266273; https://vuldb.com/?submit.343886
CVE: CVE-2024-5362
Published: 2024-05-26
Description: A vulnerability classified as critical has been found in SourceCodester Online Hospital Management System 1.0. Affected is an unknown function of the file departmentDoctor.php. The manipulation of the argument deptid leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-266274 is the identifier assigned to this vulnerability.
CVSS Score: 7.3 (HIGH)
CWE: CWE-89
References: https://github.com/CveSecLook/cve/issues/41; https://vuldb.com/?ctiid.266274; https://vuldb.com/?id.266274
CVE: CVE-2024-5363
Published: 2024-05-26
Description: A vulnerability classified as critical was found in SourceCodester Best House Rental Management System up to 1.0. Affected by this vulnerability is an unknown functionality of the file manage_user.php. The manipulation of the argument id leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-266275.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/rockersiyuan/CVE/blob/main/SourceCodester_House_Rental_Management_System_Sql_Inject-1.md; https://vuldb.com/?ctiid.266275; https://vuldb.com/?id.266275
CVE: CVE-2024-5364
Published: 2024-05-26
Description: A vulnerability, which was classified as critical, has been found in SourceCodester Best House Rental Management System up to 1.0. Affected by this issue is some unknown functionality of the file manage_tenant.php. The manipulation of the argument id leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-266276.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/rockersiyuan/CVE/blob/main/SourceCodester_House_Rental_Management_System_Sql_Inject-2.md; https://vuldb.com/?ctiid.266276; https://vuldb.com/?id.266276
CVE: CVE-2024-5365
Published: 2024-05-26
Description: A vulnerability, which was classified as critical, was found in SourceCodester Best House Rental Management System up to 1.0. This affects an unknown part of the file manage_payment.php. The manipulation of the argument id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-266277 was assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/rockersiyuan/CVE/blob/main/SourceCodester_House_Rental_Management_System_Sql_Inject-3.md; https://vuldb.com/?ctiid.266277; https://vuldb.com/?id.266277
CVE: CVE-2024-29215
Published: 2024-05-26
Description: Mattermost versions 9.5.x <= 9.5.3, 9.7.x <= 9.7.1, 9.6.x <= 9.6.1, 8.1.x <= 8.1.12 fail to enforce proper access control which allows a user to run a slash command in a channel they are not a member of via linking a playbook run to that channel and running a slash command as a playbook task command.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-284
References: https://mattermost.com/security-updates; https://mattermost.com/security-updates
CVE: CVE-2024-31859
Published: 2024-05-26
Description: Mattermost versions 9.5.x <= 9.5.3, 9.6.x <= 9.6.1 and 8.1.x <= 8.1.12 fail to perform proper authorization checks which allows a member running a playbook in an existing channel to be promoted to a channel admin
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-284
References: https://mattermost.com/security-updates; https://mattermost.com/security-updates
CVE: CVE-2024-32045
Published: 2024-05-26
Description: Mattermost versions 9.5.x <= 9.5.3, 9.6.x <= 9.6.1, 8.1.x <= 8.1.12 fail to enforce proper access controls for channel and team membership when linking a playbook run to a channel which allows  members to link their runs to private channels they were not members of.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-284, CWE-639
References: https://mattermost.com/security-updates; https://mattermost.com/security-updates
CVE: CVE-2024-34029
Published: 2024-05-26
Description: Mattermost versions 9.5.x <= 9.5.3, 9.7.x <= 9.7.1 and 8.1.x <= 8.1.12 fail to perform a proper authorization check in the /api/v4/groups/<group-id>/channels/<channel-id>/link endpoint which allows a user to learn the members of an AD/LDAP group that is linked to a team by adding the group to a channel, even if the user has no access to the team.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: https://mattermost.com/security-updates; https://mattermost.com/security-updates
CVE: CVE-2024-34152
Published: 2024-05-26
Description: Mattermost versions 9.5.x <= 9.5.3, 9.6.x <= 9.6.1 and 8.1.x <= 8.1.12 fail to perform proper access control which allows a guest to get the metadata of a public playbook run that linked to the channel they are guest via sending an RHSRuns GraphQL query request to the server
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-284
References: https://mattermost.com/security-updates; https://mattermost.com/security-updates
CVE: CVE-2024-36241
Published: 2024-05-26
Description: Mattermost versions 9.5.x <= 9.5.3, 9.6.x <= 9.6.1 and 8.1.x <= 8.1.12 fail to enforce proper access controls which allows user to view arbitrary post contents via the /playbook add slash command
CVSS Score: 3.1 (LOW)
CWE: CWE-284
References: https://mattermost.com/security-updates; https://mattermost.com/security-updates
CVE: CVE-2024-36255
Published: 2024-05-26
Description: Mattermost versions 9.5.x <= 9.5.3, 9.6.x <= 9.6.1 and 8.1.x <= 8.1.12 fail to perform proper input validation on post actions which allows an attacker to run a playbook checklist task command as another user via creating and sharing a deceptive post action that unexpectedly runs a slash command in some arbitrary channel.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-352
References: https://mattermost.com/security-updates; https://mattermost.com/security-updates
CVE: CVE-2024-5270
Published: 2024-05-26
Description: Mattermost versions 9.5.x <= 9.5.3, 9.7.x <= 9.7.1, 9.6.x <= 9.6.1 and 8.1.x <= 8.1.12 fail to check if the email signup configuration option is enabled when a user requests to switch from SAML to Email. This allows the user to switch their authentication mail from SAML to email and possibly edit personal details that were otherwise non-editable and provided by the SAML provider.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-284
References: https://mattermost.com/security-updates; https://mattermost.com/security-updates
CVE: CVE-2024-5272
Published: 2024-05-26
Description: Mattermost versions 9.5.x <= 9.5.3, 9.6.x <= 9.6.1, 8.1.x <= 8.1.12 fail to restrict the audience of the "custom_playbooks_playbook_run_updated" webhook event, which allows a guest on a channel with a playbook run linked to see all the details of the playbook run when the run is marked by finished.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-284
References: https://mattermost.com/security-updates; https://mattermost.com/security-updates
CVE: CVE-2024-5366
Published: 2024-05-26
Description: A vulnerability has been found in SourceCodester Best House Rental Management System up to 1.0 and classified as critical. This vulnerability affects unknown code of the file edit-cate.php. The manipulation of the argument id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-266278 is the identifier assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/rockersiyuan/CVE/blob/main/SourceCodester_House_Rental_Management_System_Sql_Inject-4.md; https://vuldb.com/?ctiid.266278; https://vuldb.com/?id.266278
CVE: CVE-2024-5367
Published: 2024-05-26
Description: A vulnerability was found in Kashipara College Management System 1.0 and classified as problematic. This issue affects some unknown processing of the file each_extracurricula_activities.php. The manipulation of the argument id leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-266279.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://github.com/E1CHO/cve_hub/blob/main/College%20Management%20System%20-%20xss/College%20Management%20System%20-%20vuln%201.pdf; https://vuldb.com/?ctiid.266279; https://vuldb.com/?id.266279
CVE: CVE-2024-5368
Published: 2024-05-26
Description: A vulnerability was found in Kashipara College Management System 1.0. It has been classified as problematic. Affected is an unknown function of the file delete_faculty.php. The manipulation of the argument id leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-266280.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://github.com/E1CHO/cve_hub/blob/main/College%20Management%20System%20-%20xss/College%20Management%20System%20-%20vuln%202.pdf; https://vuldb.com/?ctiid.266280; https://vuldb.com/?id.266280
CVE: CVE-2024-5369
Published: 2024-05-26
Description: A vulnerability was found in Kashipara College Management System 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file submit_admin.php. The manipulation of the argument admin_name leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-266281 was assigned to this vulnerability.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://github.com/E1CHO/cve_hub/blob/main/College%20Management%20System%20-%20xss/College%20Management%20System%20-%20vuln%203.pdf; https://vuldb.com/?ctiid.266281; https://vuldb.com/?id.266281
CVE: CVE-2024-5370
Published: 2024-05-26
Description: A vulnerability was found in Kashipara College Management System 1.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the file submit_enroll_staff.php. The manipulation of the argument class_name leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-266282 is the identifier assigned to this vulnerability.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://github.com/E1CHO/cve_hub/blob/main/College%20Management%20System%20-%20xss/College%20Management%20System%20-%20vuln%204.pdf; https://vuldb.com/?ctiid.266282; https://vuldb.com/?id.266282
CVE: CVE-2024-5371
Published: 2024-05-26
Description: A vulnerability classified as problematic has been found in Kashipara College Management System 1.0. This affects an unknown part of the file submit_enroll_student.php. The manipulation of the argument class_name leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-266283.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://github.com/E1CHO/cve_hub/blob/main/College%20Management%20System%20-%20xss/College%20Management%20System%20-%20vuln%205.pdf; https://vuldb.com/?ctiid.266283; https://vuldb.com/?id.266283
CVE: CVE-2024-5372
Published: 2024-05-26
Description: A vulnerability classified as problematic was found in Kashipara College Management System 1.0. This vulnerability affects unknown code of the file submit_extracurricular_activity.php. The manipulation of the argument activity_contact leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-266284.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://github.com/E1CHO/cve_hub/blob/main/College%20Management%20System%20-%20xss/College%20Management%20System%20-%20vuln%206.pdf; https://vuldb.com/?ctiid.266284; https://vuldb.com/?id.266284
CVE: CVE-2024-5373
Published: 2024-05-26
Description: A vulnerability, which was classified as problematic, has been found in Kashipara College Management System 1.0. This issue affects some unknown processing of the file submit_login.php. The manipulation of the argument usertype leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-266285 was assigned to this vulnerability.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://github.com/E1CHO/cve_hub/blob/main/College%20Management%20System%20-%20xss/College%20Management%20System%20-%20vuln%207.pdf; https://vuldb.com/?ctiid.266285; https://vuldb.com/?id.266285
CVE: CVE-2024-5374
Published: 2024-05-26
Description: A vulnerability, which was classified as problematic, was found in Kashipara College Management System 1.0. Affected is an unknown function of the file submit_new_faculty.php. The manipulation of the argument address leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-266286 is the identifier assigned to this vulnerability.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://github.com/E1CHO/cve_hub/blob/main/College%20Management%20System%20-%20xss/College%20Management%20System%20-%20vuln%208.pdf; https://vuldb.com/?ctiid.266286; https://vuldb.com/?id.266286
CVE: CVE-2024-5375
Published: 2024-05-26
Description: A vulnerability has been found in Kashipara College Management System 1.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file submit_student.php. The manipulation of the argument address leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-266287.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://github.com/E1CHO/cve_hub/blob/main/College%20Management%20System%20-%20xss/College%20Management%20System%20-%20vuln%209.pdf; https://vuldb.com/?ctiid.266287; https://vuldb.com/?id.266287