deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2020-26311
Published: 2024-10-26
Description: Useragent is a user agent parser for Node.js. All versions as of time of publication contain one or more regular expressions that are vulnerable to Regular Expression Denial of Service (ReDoS). As of time of publication, no patches are available.
CVSS Score: 7.5 (HIGH)
CWE: CWE-1333
References: https://github.com/3rd-Eden/useragent/issues/167; https://securitylab.github.com/advisories/GHSL-2020-312-redos-useragent/
CVE: CVE-2024-10406
Published: 2024-10-26
Description: A vulnerability, which was classified as critical, has been found in SourceCodester Petrol Pump Management Software 1.0. Affected by this issue is some unknown functionality of the file /admin/edit_fuel.php. The manipulation of the argument id leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/K1nako0/tmp_vuln7/blob/main/README.md; https://vuldb.com/?ctiid.281936; https://vuldb.com/?id.281936
CVE: CVE-2024-10407
Published: 2024-10-27
Description: A vulnerability, which was classified as critical, was found in SourceCodester Petrol Pump Management Software 1.0. This affects an unknown part of the file /admin/edit_customer.php. The manipulation of the argument id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/K1nako0/tmp_vuln8/blob/main/README.md; https://vuldb.com/?ctiid.281937; https://vuldb.com/?id.281937
CVE: CVE-2024-10408
Published: 2024-10-27
Description: A vulnerability has been found in code-projects Blood Bank Management up to 1.0 and classified as critical. This vulnerability affects unknown code of the file /abs.php. The manipulation of the argument search leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://code-projects.org/; https://gist.github.com/higordiego/46090516ba1b13fe3d2607ab4c0114f1; https://vuldb.com/?ctiid.281938
CVE: CVE-2024-10409
Published: 2024-10-27
Description: A vulnerability was found in code-projects Blood Bank Management 1.0 and classified as critical. This issue affects some unknown processing of the file /file/accept.php. The manipulation of the argument reqid leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://code-projects.org/; https://gist.github.com/higordiego/5f927c5e0502b4ec31b3f7ef12556942; https://vuldb.com/?ctiid.281939
CVE: CVE-2024-10410
Published: 2024-10-27
Description: A vulnerability classified as critical was found in SourceCodester Online Hotel Reservation System 1.0. Affected by this vulnerability is the function upload of the file /admin/mod_room/controller.php?action=add. The manipulation of the argument image leads to unrestricted upload. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-434
References: https://github.com/K1nako0/tmp_vuln9/blob/main/README.md; https://vuldb.com/?ctiid.281953; https://vuldb.com/?id.281953
CVE: CVE-2024-10411
Published: 2024-10-27
Description: A vulnerability was found in SourceCodester Online Hotel Reservation System 1.0. It has been classified as critical. Affected is the function doCancelRoom/doCancel/doConfirm/doCancel/doCheckin/doCheckout of the file /marimar/admin/mod_room/controller.php. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/K1nako0/tmp_vuln10/blob/main/README.md; https://vuldb.com/?ctiid.281940; https://vuldb.com/?id.281940
CVE: CVE-2024-50602
Published: 2024-10-27
Description: An issue was discovered in libexpat before 2.6.4. There is a crash within the XML_ResumeParser function because XML_StopParser can stop/suspend an unstarted parser.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-754
References: https://github.com/libexpat/libexpat/pull/915; https://lists.debian.org/debian-lts-announce/2025/04/msg00040.html; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2024-10412
Published: 2024-10-27
Description: A vulnerability was found in Poco-z Guns-Medical 1.0. It has been declared as problematic. Affected by this vulnerability is the function upload of the file /mgr/upload of the component File Upload. The manipulation of the argument picture leads to cross site scripting. The attack can be launched remotely.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://github.com/Poco-z/Guns-Medical/issues/15; https://vuldb.com/?ctiid.281941; https://vuldb.com/?id.281941
CVE: CVE-2024-10413
Published: 2024-10-27
Description: A vulnerability, which was classified as critical, has been found in SourceCodester Online Hotel Reservation System 1.0. Affected by this issue is the function upload of the file /guest/update.php. The manipulation of the argument image leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-434
References: https://github.com/K1nako0/tmp_vuln11/blob/main/README.md; https://vuldb.com/?ctiid.281954; https://vuldb.com/?id.281954
CVE: CVE-2024-10414
Published: 2024-10-27
Description: A vulnerability, which was classified as problematic, was found in PHPGurukul Vehicle Record System 1.0. This affects an unknown part of the file /admin/edit-brand.php. The manipulation of the argument Brand Name leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The initial researcher advisory mentions the parameter "phone_number" to be affected. But this might be a mistake because the textbox field label is "Brand Name".
CVSS Score: 2.4 (LOW)
CWE: CWE-79
References: https://github.com/jadu101/CVE/blob/main/phpgurukul_vehicle_record_system_edit_brand_xss.md; https://phpgurukul.com/; https://vuldb.com/?ctiid.281955
CVE: CVE-2024-10415
Published: 2024-10-27
Description: A vulnerability has been found in code-projects Blood Bank Management System 1.0 and classified as critical. This vulnerability affects unknown code of the file /file/accept.php. The manipulation of the argument reqid leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://code-projects.org/; https://gist.github.com/higordiego/2aba05ef2277d85ea4148dc42189eae0; https://vuldb.com/?ctiid.281956
CVE: CVE-2024-10416
Published: 2024-10-27
Description: A vulnerability was found in code-projects Blood Bank Management System 1.0 and classified as critical. This issue affects some unknown processing of the file /file/cancel.php. The manipulation of the argument reqid leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89, CWE-89
References: https://code-projects.org/; https://gist.github.com/higordiego/18cf04067697c8ceb2cba68980139dcc; https://vuldb.com/?ctiid.281957
CVE: CVE-2024-10417
Published: 2024-10-27
Description: A vulnerability was found in code-projects Blood Bank Management System 1.0. It has been classified as critical. Affected is an unknown function of the file /file/delete.php. The manipulation of the argument bid leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://code-projects.org/; https://gist.github.com/higordiego/bf0cf963ec56cfe0dcaba2956352bafd; https://vuldb.com/?ctiid.281958
CVE: CVE-2024-10418
Published: 2024-10-27
Description: A vulnerability was found in code-projects Blood Bank Management System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /file/infoAdd.php. The manipulation of the argument bg leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://code-projects.org/; https://gist.github.com/higordiego/25a103a1fe84c4db4530e68d2f998d11; https://vuldb.com/?ctiid.281959
CVE: CVE-2024-10419
Published: 2024-10-27
Description: A vulnerability was found in code-projects Blood Bank Management System 1.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /bloodrequest.php. The manipulation of the argument msg leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://code-projects.org/; https://gist.github.com/higordiego/62ad5208270c67834d02818d6ba44126; https://vuldb.com/?ctiid.281960
CVE: CVE-2024-10420
Published: 2024-10-27
Description: A vulnerability classified as critical has been found in SourceCodester Attendance and Payroll System 1.0. This affects the function upload of the file /marimar/guest/update.php. The manipulation of the argument image leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-434
References: https://github.com/K1nako0/tmp_vuln12/blob/main/README.md; https://vuldb.com/?ctiid.281961; https://vuldb.com/?id.281961
CVE: CVE-2024-10421
Published: 2024-10-27
Description: A vulnerability classified as critical was found in SourceCodester Attendance and Payroll System 1.0. This vulnerability affects unknown code of the file /admin/overtime_row.php. The manipulation of the argument id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/K1nako0/tmp_vuln13/blob/main/README.md; https://vuldb.com/?ctiid.281962; https://vuldb.com/?id.281962
CVE: CVE-2024-10422
Published: 2024-10-27
Description: A vulnerability, which was classified as critical, has been found in SourceCodester Attendance and Payroll System 1.0. This issue affects some unknown processing of the file /admin/overtime_add.php. The manipulation of the argument id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/K1nako0/tmp_vuln14/blob/main/README.md; https://vuldb.com/?ctiid.281963; https://vuldb.com/?id.281963
CVE: CVE-2024-10423
Published: 2024-10-27
Description: A vulnerability, which was classified as critical, was found in Project Worlds Student Project Allocation System 1.0. Affected is an unknown function of the file /student/project_selection/project_selection.php of the component Project Selection Page. The manipulation of the argument project_id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/jadu101/CVE/blob/main/phpgurukul_student_project_allocation_system_add_project_sqli.md; https://vuldb.com/?ctiid.281964; https://vuldb.com/?id.281964
CVE: CVE-2024-10424
Published: 2024-10-27
Description: A vulnerability has been found in Project Worlds Student Project Allocation System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /student/project_selection/remove_project.php of the component Project Selection Page. The manipulation of the argument no leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/jadu101/CVE/blob/main/phpgurukul_student_project_allocation_system_remove_project_sqli.md; https://vuldb.com/?ctiid.281965; https://vuldb.com/?id.281965
CVE: CVE-2024-10425
Published: 2024-10-27
Description: A vulnerability was found in Project Worlds Student Project Allocation System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /student/project_selection/move_up_project.php of the component Project Selection Page. The manipulation of the argument up leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89, CWE-89
References: https://github.com/jadu101/CVE/blob/main/phpgurukul_student_project_allocation_system_move_up_project_sqli.md; https://vuldb.com/?ctiid.281966; https://vuldb.com/?id.281966
CVE: CVE-2024-10426
Published: 2024-10-27
Description: A vulnerability was found in Codezips Pet Shop Management System 1.0. It has been classified as critical. This affects an unknown part of the file /animalsadd.php. The manipulation of the argument id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The initial researcher advisory mentions the parameter "refno" to be affected. But further inspection indicates that the name of the affected parameter is "id".
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/ppp-src/CVE/issues/21; https://vuldb.com/?ctiid.281967; https://vuldb.com/?id.281967
CVE: CVE-2024-10427
Published: 2024-10-27
Description: A vulnerability was found in Codezips Pet Shop Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /deleteanimal.php. The manipulation of the argument t1 leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The initial researcher advisory mentions the parameter "refno" to be affected. But further inspection indicates that the name of the affected parameter is "t1".
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/ppp-src/CVE/issues/22; https://vuldb.com/?ctiid.281968; https://vuldb.com/?id.281968
CVE: CVE-2024-10428
Published: 2024-10-27
Description: A vulnerability was found in WAVLINK WN530H4, WN530HG4 and WN572HG3 up to 20221028. It has been rated as critical. This issue affects the function set_ipv6 of the file firewall.cgi. The manipulation of the argument dhcpGateway leads to command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 7.2 (HIGH)
CWE: CWE-77
References: https://docs.google.com/document/d/11NGSJBOZzbgm_qanDno6SyucWyso7Em6/; https://vuldb.com/?ctiid.281969; https://vuldb.com/?id.281969
CVE: CVE-2024-10429
Published: 2024-10-27
Description: A vulnerability classified as critical has been found in WAVLINK WN530H4, WN530HG4 and WN572HG3 up to 20221028. Affected is the function set_ipv6 of the file internet.cgi. The manipulation of the argument IPv6OpMode/IPv6IPAddr/IPv6WANIPAddr/IPv6GWAddr leads to command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 7.2 (HIGH)
CWE: CWE-77
References: https://docs.google.com/document/d/1ktuys5jr7MKwz503QBbEfxZ5mZbXlbvl/; https://vuldb.com/?ctiid.281970; https://vuldb.com/?id.281970
CVE: CVE-2024-50610
Published: 2024-10-27
Description: GSL (GNU Scientific Library) through 2.8 has an integer signedness error in gsl_siman_solve_many in siman/siman.c. When params.n_tries is negative, incorrect memory allocation occurs.
CVSS Score: 3.6 (LOW)
CWE: CWE-190
References: https://git.savannah.gnu.org/cgit/gsl.git/log/siman/siman.c; https://github.com/silviadefra/GolDRuSh/blob/main/vulnerabilities/gsl.md; https://www.gnu.org/software/gsl/doc/html/siman.html
CVE: CVE-2024-50611
Published: 2024-10-27
Description: CycloneDX cdxgen through 10.10.7, when run against an untrusted codebase, may execute code contained within build-related files such as build.gradle.kts, a similar issue to CVE-2022-24441. cdxgen is used by, for example, OWASP dep-scan. NOTE: this has been characterized as a design limitation, rather than an implementation mistake.
CVSS Score: 7.2 (HIGH)
CWE: CWE-94
References: https://github.com/CycloneDX/cdxgen/issues/1328; https://github.com/CycloneDX/cdxgen/releases; https://owasp.org/www-project-dep-scan/
CVE: CVE-2024-50612
Published: 2024-10-27
Description: libsndfile through 1.2.2 has an ogg_vorbis.c vorbis_analysis_wrote out-of-bounds read.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125, CWE-125
References: https://github.com/libsndfile/libsndfile/issues/1035
CVE: CVE-2024-50613
Published: 2024-10-27
Description: libsndfile through 1.2.2 has a reachable assertion, that may lead to application exit, in mpeg_l3_encode.c mpeg_l3_encoder_close.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-617, CWE-617
References: https://github.com/libsndfile/libsndfile/issues/1034
CVE: CVE-2024-50614
Published: 2024-10-27
Description: TinyXML2 through 10.0.0 has a reachable assertion for UINT_MAX/16, that may lead to application exit, in tinyxml2.cpp XMLUtil::GetCharacterRef.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-617
References: https://github.com/leethomason/tinyxml2/issues/996
CVE: CVE-2024-50615
Published: 2024-10-27
Description: TinyXML2 through 10.0.0 has a reachable assertion for UINT_MAX/digit, that may lead to application exit, in tinyxml2.cpp XMLUtil::GetCharacterRef.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-617
References: https://github.com/leethomason/tinyxml2/issues/997
CVE: CVE-2024-50616
Published: 2024-10-27
Description: Ironman PowerShell Universal 5.x before 5.0.12 allows an authenticated attacker to elevate their privileges and view job information.
CVSS Score: 8.8 (HIGH)
References: https://docs.powershelluniversal.com/changelogs/cves#cve-tbd-10-17-2024-privilege-escalation-and-information-disclosure
CVE: CVE-2024-10430
Published: 2024-10-27
Description: A vulnerability, which was classified as critical, has been found in Codezips Pet Shop Management System 1.0. This issue affects some unknown processing of the file /animalsupdate.php. The manipulation of the argument id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-89
References: https://github.com/ppp-src/CVE/issues/23; https://vuldb.com/?ctiid.281981; https://vuldb.com/?id.281981
CVE: CVE-2024-10431
Published: 2024-10-27
Description: A vulnerability, which was classified as critical, was found in Codezips Pet Shop Management System 1.0. Affected is an unknown function of the file /deletebird.php. The manipulation of the argument t1 leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-89
References: https://github.com/ppp-src/CVE/issues/24; https://vuldb.com/?ctiid.281982; https://vuldb.com/?id.281982
CVE: CVE-2024-10432
Published: 2024-10-28
Description: A vulnerability has been found in Project Worlds Simple Web-Based Chat Application 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /index.php. The manipulation of the argument username leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-89
References: https://github.com/jadu101/CVE/blob/main/project_worlds_simple_web_based_chat_app_index_sqli.md; https://vuldb.com/?ctiid.281983; https://vuldb.com/?id.281983
CVE: CVE-2024-10433
Published: 2024-10-28
Description: A vulnerability was found in Project Worlds Simple Web-Based Chat Application 1.0 and classified as problematic. Affected by this issue is some unknown functionality of the file /index.php. The manipulation of the argument Name/Comment leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The initial researcher advisory mentions different parameters to be affected which do not correlate with the screenshots of a successful attack.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://github.com/jadu101/CVE/blob/main/project_worlds_simple_web_based_chat_app_index_xss.md; https://vuldb.com/?ctiid.281984; https://vuldb.com/?id.281984
CVE: CVE-2024-50623
Published: 2024-10-28
Description: In Cleo Harmony before 5.8.0.21, VLTrader before 5.8.0.21, and LexiCom before 5.8.0.21, there is an unrestricted file upload and download that could lead to remote code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434, CWE-434, CWE-434
References: https://support.cleo.com/hc/en-us/articles/[PII_REDACTED]7799-Cleo-Product-Security-Advisory; https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-50623
CVE: CVE-2024-50624
Published: 2024-10-28
Description: ispdbservice.cpp in KDE Kmail before 6.2.0 allows man-in-the-middle attackers to trigger use of an attacker-controlled mail server because cleartext HTTP is used for a URL such as http://autoconfig.example.com or http://example.com/.well-known/autoconfig for retrieving the configuration. This is related to kmail-account-wizard.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-319
References: https://bugs.kde.org/show_bug.cgi?id=487882; https://invent.kde.org/pim/kmail-account-wizard/-/commit/9784f5ab41c3aff435d4a88afb25585180a62ee4; https://invent.kde.org/pim/kmail/-/tags
CVE: CVE-2024-10434
Published: 2024-10-28
Description: A vulnerability was found in Tenda AC1206 up to 20241027. It has been classified as critical. This affects the function ate_Tenda_mfg_check_usb/ate_Tenda_mfg_check_usb3 of the file /goform/ate. The manipulation of the argument arg leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 8.8 (HIGH)
CWE: CWE-121, CWE-787
References: https://github.com/physicszq/Routers/blob/main/Tenda/README.md; https://vuldb.com/?ctiid.281985; https://vuldb.com/?id.281985
CVE: CVE-2024-10435
Published: 2024-10-28
Description: A vulnerability was found in didi Super-Jacoco 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /cov/triggerEnvCov. The manipulation of the argument uuid leads to command injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-77
References: https://github.com/didi/super-jacoco/issues/48; https://vuldb.com/?ctiid.281986; https://vuldb.com/?id.281986
CVE: CVE-2024-23843
Published: 2024-10-28
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Genians Genian NAC V5.0, Genians Genian NAC LTS V5.0.This issue affects Genian NAC V5.0: from V5.0.0 through V5.0.60; Genian NAC LTS V5.0: from 5.0.0 LTS through 5.0.55 LTS(Revision 125558), from 5.0.0 LTS through 5.0.56 LTS(Revision 125560).
CVSS Score: 2.2 (LOW)
CWE: CWE-89
References: https://docs.genians.com/release/ko/advisories/GN-SA-2024-001.html
CVE: CVE-2024-10438
Published: 2024-10-28
Description: The eHRD CTMS from Sunnet has an Authentication Bypass vulnerability, allowing unauthenticated remote attackers to bypass authentication by satisfying specific conditions in order to access certain functionalities.
CVSS Score: 7.5 (HIGH)
CWE: CWE-288
References: https://www.twcert.org.tw/en/cp-139-8165-7da2f-2.html; https://www.twcert.org.tw/tw/cp-132-8164-fe7c5-1.html