deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-48418
Published: 2025-01-27
Description: In Edimax AC1200 Wi-Fi 5 Dual-Band Router BR-6476AC 1.06, the request /goform/fromSetDDNS does not properly handle special characters in any of user provided parameters, allowing an attacker with access to the web interface to inject and execute arbitrary shell commands.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: http://edimax.com; https://github.com/SpikeReply/advisories/blob/c271ddb997bc[PII_REDACTED]acc380bc71ce9c316b/cve/edimax/cve-2024-48418.md
CVE: CVE-2024-48419
Published: 2025-01-27
Description: Edimax AC1200 Wi-Fi 5 Dual-Band Router BR-6476AC 1.06 suffers from Command Injection issues in /bin/goahead. Specifically, these issues can be triggered through /goform/tracerouteDiagnosis, /goform/pingDiagnosis, and /goform/fromSysToolPingCmd Each of these issues allows an attacker with access to the web interface to inject and execute arbitrary shell commands, with "root" privileges.
CVSS Score: 8.8 (HIGH)
CWE: CWE-77
References: http://edimax.com; https://github.com/SpikeReply/advisories/blob/c271ddb997bc[PII_REDACTED]acc380bc71ce9c316b/cve/edimax/cve-2024-48419.md
CVE: CVE-2024-48420
Published: 2025-01-27
Description: Edimax AC1200 Wi-Fi 5 Dual-Band Router BR-6476AC 1.06 is vulnerable to Buffer Overflow via /goform/getWifiBasic.
CVSS Score: 8.8 (HIGH)
CWE: CWE-120
References: http://edimax.com; https://github.com/SpikeReply/advisories/blob/c271ddb997bc[PII_REDACTED]acc380bc71ce9c316b/cve/edimax/cve-2024-48420.md
CVE: CVE-2024-54145
Published: 2025-01-27
Description: Cacti is an open source performance and fault management framework. Cacti has a SQL injection vulnerability in the get_discovery_results function of automation_devices.php using the network parameter. This vulnerability is fixed in 1.2.29.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/Cacti/cacti/commit/c7e4ee798d263a3209ae6e7ba182c7b65284d8f0; https://github.com/Cacti/cacti/security/advisories/GHSA-fh3x-69rr-qqpp; https://lists.debian.org/debian-lts-announce/2025/02/msg00010.html
CVE: CVE-2024-54146
Published: 2025-01-27
Description: Cacti is an open source performance and fault management framework. Cacti has a SQL injection vulnerability in the template function of host_templates.php using the graph_template parameter. This vulnerability is fixed in 1.2.29.
CVSS Score: 7.6 (HIGH)
CWE: CWE-89
References: https://github.com/Cacti/cacti/commit/c7e4ee798d263a3209ae6e7ba182c7b65284d8f0; https://github.com/Cacti/cacti/security/advisories/GHSA-vj9g-p7f2-4wqj
CVE: CVE-2024-55227
Published: 2025-01-27
Description: A cross-site scripting (XSS) vulnerability in the Events/Agenda module of Dolibarr v21.0.0-beta allows attackers to execute arbitrary web scripts or HTMl via a crafted payload injected into the Title parameter.
CVSS Score: 9.0 (CRITICAL)
CWE: CWE-79, CWE-79
References: https://gist.github.com/Dqtdqt/9762466cd6ec541ea265ba33b09489ff; https://github.com/Dolibarr/dolibarr/commit/56710ce9b79a97df093f586c90bdaf6cce6a5808; https://github.com/Dolibarr/dolibarr/commit/9aa24d9d9aeab36358c725dae3fe20c9631082e7
CVE: CVE-2024-55228
Published: 2025-01-27
Description: A cross-site scripting (XSS) vulnerability in the Product module of Dolibarr v21.0.0-beta allows attackers to execute arbitrary web scripts or HTMl via a crafted payload injected into the Title parameter.
CVSS Score: 9.0 (CRITICAL)
CWE: CWE-79, CWE-79
References: https://gist.github.com/Dqtdqt/a942bbce9a5fc851dce366902411c768; https://github.com/Dolibarr/dolibarr/commit/56710ce9b79a97df093f586c90bdaf6cce6a5808; https://github.com/Dolibarr/dolibarr/commit/9aa24d9d9aeab36358c725dae3fe20c9631082e7
CVE: CVE-2024-57272
Published: 2025-01-27
Description: SecuSTATION Camera V2.5.5.3116-S50-SMA-B20160811A and lower is vulnerable to Cross Site Scripting (XSS).
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/kklzzcun/Camera/blob/main/SecureSTATION%20%E5%AD%98%E5%9C%A8%E5%8F%8D%E5%B0%84%E5%BD%A2XSS%E6%BC%8F%E6%B4%9E.md
CVE: CVE-2024-57276
Published: 2025-01-27
Description: In Electronic Arts Dragon Age Origins 1.05, the DAUpdaterSVC service contains an unquoted service path vulnerability. This service is configured with insecure permissions, allowing users to modify the executable file path used by the service. The service runs with NT AUTHORITY\SYSTEM privileges, enabling attackers to escalate privileges by replacing or placing a malicious executable in the service path.
CVSS Score: 7.3 (HIGH)
CWE: CWE-428
References: https://github.com/yamerooo123/CVE/blob/main/CVE-2024-57276/Description.md; https://github.com/yamerooo123/ResearchNBugBountyEncyclopedia/blob/main/Researches/Dragon%20Age%20Origins/Description.md
CVE: CVE-2025-0729
Published: 2025-01-27
Description: A vulnerability was found in TP-Link TL-SG108E 1.0.0 Build 20201208 Rel. 40304. It has been rated as problematic. This issue affects some unknown processing. The manipulation leads to clickjacking. The attack may be initiated remotely. Upgrading to version 1.0.0 Build 20250124 Rel. 54920(Beta) is able to address this issue. It is recommended to upgrade the affected component. The vendor was contacted early. They reacted very professional and provided a pre-fix version for their customers.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-451
References: https://github.com/TheCyberDiver/Public-Disclosures-CVE-/blob/main/tp-link%20clickjacking.md; https://static.tp-link.com/upload/beta/2025/202501/20250124/TL-SG108E(UN)%206.0_1.0.0%20Build%[PII_REDACTED]%20Rel.54920(Beta)_up.zip; https://vuldb.com/?ctiid.293507
CVE: CVE-2025-0730
Published: 2025-01-27
Description: A vulnerability classified as problematic has been found in TP-Link TL-SG108E 1.0.0 Build 20201208 Rel. 40304. Affected is an unknown function of the file /usr_account_set.cgi of the component HTTP GET Request Handler. The manipulation of the argument username/password leads to use of get request method with sensitive query strings. It is possible to launch the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. Upgrading to version 1.0.0 Build 20250124 Rel. 54920(Beta) is able to address this issue. It is recommended to upgrade the affected component. The vendor was contacted early. They reacted very professional and provided a pre-fix version for their customers.
CVSS Score: 3.7 (LOW)
CWE: CWE-598
References: https://github.com/TheCyberDiver/Public-Disclosures-CVE-/blob/main/tp-link%20sensitive%20info%20in%20GET.md; https://static.tp-link.com/upload/beta/2025/202501/20250124/TL-SG108E(UN)%206.0_1.0.0%20Build%[PII_REDACTED]%20Rel.54920(Beta)_up.zip; https://vuldb.com/?ctiid.293508
CVE: CVE-2025-22604
Published: 2025-01-27
Description: Cacti is an open source performance and fault management framework. Due to a flaw in multi-line SNMP result parser, authenticated users can inject malformed OIDs in the response. When processed by ss_net_snmp_disk_io() or ss_net_snmp_disk_bytes(), a part of each OID will be used as a key in an array that is used as part of a system command, causing a command execution vulnerability. This vulnerability is fixed in 1.2.29.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-78
References: https://github.com/Cacti/cacti/commit/c7e4ee798d263a3209ae6e7ba182c7b65284d8f0; https://github.com/Cacti/cacti/security/advisories/GHSA-c5j8-jxj3-hh36; https://lists.debian.org/debian-lts-announce/2025/02/msg00010.html
CVE: CVE-2024-12740
Published: 2025-01-27
Description: Vision related software from NI used a third-party library for image processing that exposes several vulnerabilities.  These vulnerabilities may result in arbitrary code execution.  Successful exploitation requires an attacker to get a user to open a specially crafted file.
CVSS Score: 7.8 (HIGH)
References: https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/dependency-on-vulnerable-third-party-component-exposes-vulnerabi.html
CVE: CVE-2024-26317
Published: 2025-01-27
Description: In illumos illumos-gate 2024-02-15, an error occurs in the elliptic curve point addition algorithm that uses mixed Jacobian-affine coordinates, causing the algorithm to yield a result of POINT_AT_INFINITY when it should not. A man-in-the-middle attacker could use this to interfere with a connection, resulting in an attacked party computing an incorrect shared secret.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-327
References: https://drive.google.com/file/d/1aGLAFz20-fc7ZLiWouegyK_65jCkGTDb/view?usp=sharing; https://github.com/illumos/illumos-gate; https://rashidkhanpathan.github.io/posts/CVE-2024-26317-Elliptic-curve-point-addition-error/
CVE: CVE-2025-0732
Published: 2025-01-27
Description: A vulnerability, which was classified as problematic, has been found in Discord up to 1.0.9177 on Windows. Affected by this issue is some unknown functionality in the library profapi.dll. The manipulation leads to untrusted search path. The attack needs to be approached locally. The complexity of an attack is rather high. The exploitation is known to be difficult. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 4.5 (MEDIUM)
CWE: CWE-426
References: https://vuldb.com/?ctiid.293510; https://vuldb.com/?id.293510; https://vuldb.com/?submit.481209
CVE: CVE-2025-0733
Published: 2025-01-27
Description: A vulnerability, which was classified as problematic, was found in Postman up to 11.20 on Windows. This affects an unknown part in the library profapi.dll. The manipulation leads to untrusted search path. An attack has to be approached locally. The complexity of an attack is rather high. The exploitability is told to be difficult. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 4.5 (MEDIUM)
CWE: CWE-426
References: https://vuldb.com/?ctiid.293511; https://vuldb.com/?id.293511; https://vuldb.com/?submit.481185
CVE: CVE-2025-23197
Published: 2025-01-27
Description: matrix-hookshot is a Matrix bot for connecting to external services like GitHub, GitLab, JIRA, and more. When Hookshot 6 version 6.0.1 or below, or Hookshot 5 version 5.4.1 or below, is configured with GitHub support, it is vulnerable to a Denial of Service (DoS) whereby it can crash on restart due to a missing check. The impact is greater to you untrusted users can add their own GitHub organizations to Hookshot in order to connect their room to a repository. This vulnerability is fixed in 6.0.2 and 5.4.2.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-754
References: https://github.com/matrix-org/matrix-hookshot/commit/e51d8210233ac759e7f7dfebc2c4f1bf6ce94802; https://github.com/matrix-org/matrix-hookshot/security/advisories/GHSA-cr4q-jf47-3645
CVE: CVE-2025-24354
Published: 2025-01-27
Description: imgproxy is server for resizing, processing, and converting images. Imgproxy does not block the 0.0.0.0 address, even with IMGPROXY_ALLOW_LOOPBACK_SOURCE_ADDRESSES set to false. This can expose services on the local host. This vulnerability is fixed in 3.27.2.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-918
References: https://github.com/imgproxy/imgproxy/commit/3d4fed6842aa8930ec224d0ad75b0079b858e081; https://github.com/imgproxy/imgproxy/security/advisories/GHSA-j2hp-6m75-v4j4
CVE: CVE-2025-24356
Published: 2025-01-27
Description: fastd is a VPN daemon which tunnels IP packets and Ethernet frames over UDP. When receiving a data packet from an unknown IP address/port combination, fastd will assume that one of its connected peers has moved to a new address and initiate a reconnect by sending a handshake packet. This "fast reconnect" avoids having to wait for a session timeout (up to ~90s) until a new connection is established. Even a 1-byte UDP packet just containing the fastd packet type header can trigger a much larger handshake packet (~150 bytes of UDP payload). Including IPv4 and UDP headers, the resulting amplification factor is roughly 12-13. By sending data packets with a spoofed source address to fastd instances reachable on the internet, this amplification of UDP traffic might be used to facilitate a Distributed Denial of Service attack. This vulnerability is fixed in v23.
CVSS Score: 7.5 (HIGH)
CWE: CWE-405
References: https://github.com/neocturne/fastd/commit/1f233bee76b722c0b3f9024f2c39c72e9f7e5843; https://github.com/neocturne/fastd/commit/3940150e801d0c91460491bec32cbcc5bbc89d5f; https://github.com/neocturne/fastd/commit/5f63fcfc18ae9cad023fa463b152d5e14192b5a8
CVE: CVE-2025-24357
Published: 2025-01-27
Description: vLLM is a library for LLM inference and serving. vllm/model_executor/weight_utils.py implements hf_model_weights_iterator to load the model checkpoint, which is downloaded from huggingface. It uses the torch.load function and the weights_only parameter defaults to False. When torch.load loads malicious pickle data, it will execute arbitrary code during unpickling. This vulnerability is fixed in v0.7.0.
CVSS Score: 7.5 (HIGH)
CWE: CWE-502
References: https://github.com/vllm-project/vllm/commit/d3d6bb13fb62da3234addf6574922a4ec0513d04; https://github.com/vllm-project/vllm/pull/12366; https://github.com/vllm-project/vllm/security/advisories/GHSA-rh4j-5rhw-hr54
CVE: CVE-2025-24364
Published: 2025-01-27
Description: vaultwarden is an unofficial Bitwarden compatible server written in Rust, formerly known as bitwarden_rs. Attacker with authenticated access to the vaultwarden admin panel can execute arbitrary code in the system. The attacker could then change some settings to use sendmail as mail agent but adjust the settings in such a way that it would use a shell command. It then also needed to craft a special favicon image which would have the commands embedded to run during for example sending a test email. This vulnerability is fixed in 1.33.0.
CVSS Score: 7.2 (HIGH)
CWE: CWE-74
References: https://github.com/dani-garcia/vaultwarden/releases/tag/1.33.0; https://github.com/dani-garcia/vaultwarden/security/advisories/GHSA-h6cc-rc6q-23j4
CVE: CVE-2025-24365
Published: 2025-01-27
Description: vaultwarden is an unofficial Bitwarden compatible server written in Rust, formerly known as bitwarden_rs. Attacker can obtain owner rights of other organization. Hacker should know the ID of victim organization (in real case the user can be a part of the organization as an unprivileged user) and be the owner/admin of other organization (by default you can create your own organization) in order to attack. This vulnerability is fixed in 1.33.0.
CVSS Score: 8.1 (HIGH)
CWE: CWE-284
References: https://github.com/dani-garcia/vaultwarden/releases/tag/1.33.0; https://github.com/dani-garcia/vaultwarden/security/advisories/GHSA-j4h8-vch3-f797
CVE: CVE-2025-24367
Published: 2025-01-27
Description: Cacti is an open source performance and fault management framework. An authenticated Cacti user can abuse graph creation and graph template functionality to create arbitrary PHP scripts in the web root of the application, leading to remote code execution on the server. This vulnerability is fixed in 1.2.29.
CVSS Score: 8.8 (HIGH)
CWE: CWE-144
References: https://github.com/Cacti/cacti/commit/c7e4ee798d263a3209ae6e7ba182c7b65284d8f0; https://github.com/Cacti/cacti/security/advisories/GHSA-fxrq-fr7h-9rqq; https://lists.debian.org/debian-lts-announce/2025/02/msg00010.html
CVE: CVE-2025-24368
Published: 2025-01-27
Description: Cacti is an open source performance and fault management framework. Some of the data stored in automation_tree_rules.php is not thoroughly checked and is used to concatenate the SQL statement in build_rule_item_filter() function from lib/api_automation.php, resulting in SQL injection. This vulnerability is fixed in 1.2.29.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: https://github.com/Cacti/cacti/commit/c7e4ee798d263a3209ae6e7ba182c7b65284d8f0; https://github.com/Cacti/cacti/security/advisories/GHSA-f9c7-7rc3-574c; https://lists.debian.org/debian-lts-announce/2025/02/msg00010.html
CVE: CVE-2024-56947
Published: 2025-01-27
Description: An issue in Xiamen Meitu Technology Co., Ltd. BeautyCam iOS v12.3.60 allows attackers to access sensitive user information via supplying a crafted link.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-601, CWE-922
References: https://github.com/ZhouZiyi1/Vuls/blob/main/241208-BeautyCam/241208-BeautyCam.pdf
CVE: CVE-2024-56948
Published: 2025-01-27
Description: An issue in KuGou Technology CO. LTD KuGou Music iOS v20.0.0 allows attackers to access sensitive user information via supplying a crafted link.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-601, CWE-922
References: https://github.com/ZhouZiyi1/Vuls/blob/main/241211-KuGouMusic/241211-KuGouMusic.pdf
CVE: CVE-2024-56949
Published: 2025-01-27
Description: An issue in Guangzhou Polar Future Culture Technology Co., Ltd University Search iOS 2.27.0 allows attackers to access sensitive user information via supplying a crafted link.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-601, CWE-922
References: https://github.com/ZhouZiyi1/Vuls/blob/main/241212-UniversitySearch/241212-UniversitySearch.pdf
CVE: CVE-2024-56950
Published: 2025-01-27
Description: An issue in KuGou Technology Co., Ltd KuGou Concept iOS 4.0.61 allows attackers to access sensitive user information via supplying a crafted link.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-601, CWE-922
References: https://github.com/ZhouZiyi1/Vuls/blob/main/241213-KuGouConcept/241213-KuGouConcept.pdf
CVE: CVE-2024-56951
Published: 2025-01-27
Description: An issue in Hangzhou Bobo Technology Co Ltd UU Game Booster iOS 10.6.13 allows attackers to access sensitive user information via supplying a crafted link.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-601, CWE-922
References: https://github.com/ZhouZiyi1/Vuls/blob/main/241216-UUGameBooster/241216-UUGameBooster.pdf
CVE: CVE-2024-56952
Published: 2025-01-27
Description: An issue in Beijing Baidu Netcom Science & Technology Co Ltd Baidu Lite app (iOS version) 6.40.0 allows attackers to access user information via supplying a crafted link.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-601, CWE-922
References: https://github.com/ZhouZiyi1/Vuls/blob/main/241217-BaiduLite/241217-BaiduLite.pdf
CVE: CVE-2024-56953
Published: 2025-01-27
Description: An issue in Baidu (China) Co Ltd Baidu Input Method (iOS version) v12.6.13 allows attackers to access user information via supplying a crafted link.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-601, CWE-922
References: https://github.com/ZhouZiyi1/Vuls/blob/main/241217-BaiduInput/241217-BaiduInput.pdf
CVE: CVE-2024-56954
Published: 2025-01-27
Description: An issue in Beijing Baidu Netcom Science & Technology Co Ltd Haokan Video iOS 7.70.0 allows attackers to access sensitive user information via supplying a crafted link.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-601, CWE-922
References: https://github.com/ZhouZiyi1/Vuls/blob/main/241219-HaokanVideo/241219-HaokanVideo.pdf
CVE: CVE-2024-56955
Published: 2025-01-27
Description: An issue in Tencent Technology (Shenzhen) Company Limited QQMail iOS 6.6.4 allows attackers to access sensitive user information via supplying a crafted link.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-601, CWE-922
References: https://github.com/ZhouZiyi1/Vuls/blob/main/241220-QQMail/241220-QQMail.pdf
CVE: CVE-2024-56957
Published: 2025-01-27
Description: An issue in Kingsoft Office Software Corporation Limited WPS Office iOS 12.20.0 allows attackers to access sensitive user information via supplying a crafted link.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-601, CWE-922
References: https://github.com/ZhouZiyi1/Vuls/blob/main/241222-WPSOffice/241222-WPSOffice.pdf
CVE: CVE-2024-56959
Published: 2025-01-27
Description: An issue in Mashang Consumer Finance Co., Ltd Anyihua iOS 3.6.2 allows attackers to access sensitive user information via supplying a crafted link.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-601, CWE-922
References: https://github.com/ZhouZiyi1/Vuls/blob/main/241225-Anyihua/241225-Anyihua.pdf
CVE: CVE-2024-56960
Published: 2025-01-27
Description: An issue in Tianjin Xiaowu Information technology Co., Ltd BeiKe Holdings iOS 1.3.50 allows attackers to access sensitive user information via supplying a crafted link.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-601, CWE-922
References: https://github.com/ZhouZiyi1/Vuls/blob/main/241226-BeiKeHoldings/241226-BeiKeHoldings.pdf
CVE: CVE-2024-56962
Published: 2025-01-27
Description: An issue in Tencent Technology (Shanghai) Co., Ltd WeSing iOS v9.3.39 allows attackers to access sensitive user information via supplying a crafted link.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-601, CWE-922
References: https://github.com/ZhouZiyi1/Vuls/blob/main/241227-WeSing/241227-WeSing.pdf
CVE: CVE-2024-56963
Published: 2025-01-27
Description: An issue in Beijing Sogou Technology Development Co., Ltd Sogou Input iOS 12.2.0 allows attackers to access sensitive user information via supplying a crafted link.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-601, CWE-922
References: https://github.com/ZhouZiyi1/Vuls/blob/main/241228-SogouInput/241228-SogouInput.pdf
CVE: CVE-2024-56964
Published: 2025-01-27
Description: An issue in Che Hao Duo Used Automobile Agency (Beijing) Co., Ltd Guazi Used Car iOS 10.15.1 allows attackers to access sensitive user information via supplying a crafted link.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-601, CWE-922
References: https://github.com/ZhouZiyi1/Vuls/blob/main/241229-GuaziUsedCar/241229-GuaziUsedCar.pdf
CVE: CVE-2024-56965
Published: 2025-01-27
Description: An issue in Shanghai Shizhi Information Technology Co., Ltd Shihuo iOS 8.16.0 allows attackers to access sensitive user information via supplying a crafted link.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-601, CWE-922
References: https://github.com/ZhouZiyi1/Vuls/blob/main/241230-Shihuo/241230-Shihuo.pdf
CVE: CVE-2024-56966
Published: 2025-01-27
Description: An issue in Shanghai Xuan Ting Entertainment Information & Technology Co., Ltd Qidian Reader iOS 5.9.384 allows attackers to access sensitive user information via supplying a crafted link.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-601, CWE-922
References: https://github.com/ZhouZiyi1/Vuls/blob/main/241231-QidianReader/241231-QidianReader.pdf
CVE: CVE-2024-56967
Published: 2025-01-27
Description: An issue in Cloud Whale Interactive Technology LLC. PolyBuzz iOS 2.0.20 allows attackers to access sensitive user information via supplying a crafted link.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-601, CWE-922
References: https://github.com/ZhouZiyi1/Vuls/blob/main/250103-PolyBuzz/250103-PolyBuzz.pdf
CVE: CVE-2024-56968
Published: 2025-01-27
Description: An issue in Shenzhen Intellirocks Tech Co. Ltd Govee Home iOS 6.5.01 allows attackers to access sensitive user information via supplying a crafted payload.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-601, CWE-922
References: https://github.com/ZhouZiyi1/Vuls/blob/main/250106-GoveeHome/250106-GoveeHome.pdf
CVE: CVE-2024-56969
Published: 2025-01-27
Description: An issue in Pixocial Technology (Singapore) Pte. Ltd BeautyPlus iOS 7.8.010 allows attackers to access sensitive user information via supplying a crafted link.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-601, CWE-922
References: https://github.com/ZhouZiyi1/Vuls/blob/main/250107-BeautyPlus/250107-BeautyPlus.pdf
CVE: CVE-2024-56971
Published: 2025-01-27
Description: An issue in Zhiyuan Yuedu (Guangzhou) Literature Information Technology Co., Ltd Shuqi Novel iOS 5.3.8 allows attackers to access sensitive user information via supplying a crafted link.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-601, CWE-922
References: https://github.com/ZhouZiyi1/Vuls/blob/main/250108-ShuqiNovel/250108-ShuqiNovel.pdf
CVE: CVE-2024-56972
Published: 2025-01-27
Description: An issue in Midea Group Co., Ltd Midea Home iOS 9.3.12 allows attackers to access sensitive user information via supplying a crafted link.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-601, CWE-922
References: https://github.com/ZhouZiyi1/Vuls/blob/main/250109-MideaHome/250109-MideaHome.pdf