deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-53161
Published: 2024-12-24
Description: In the Linux kernel, the following vulnerability has been resolved:

EDAC/bluefield: Fix potential integer overflow

The 64-bit argument for the "get DIMM info" SMC call consists of mem_ctrl_idx
left-shifted 16 bits and OR-ed with DIMM index.  With mem_ctrl_idx defined as
32-bits wide the left-shift operation truncates the upper 16 bits of
information during the calculation of the SMC argument.

The mem_ctrl_idx stack variable must be defined as 64-bits wide to prevent any
potential integer overflow, i.e. loss of data from upper 16 bits.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-190, CWE-190
References: https://git.kernel.org/stable/c/000930193fe5eb79ce5563ee2e9ddb0c6e4e1bb5; https://git.kernel.org/stable/c/1fe774a93b46bb029b8f6fa9d1f25affa53f06c6; https://git.kernel.org/stable/c/4ad7033de109d0fec99086f352f58a3412e378b8
CVE: CVE-2024-53162
Published: 2024-12-24
Description: In the Linux kernel, the following vulnerability has been resolved:

crypto: qat/qat_4xxx - fix off by one in uof_get_name()

The fw_objs[] array has "num_objs" elements so the > needs to be >= to
prevent an out of bounds read.
CVSS Score: 7.1 (HIGH)
CWE: CWE-125, CWE-125
References: https://git.kernel.org/stable/c/05c9a7a[PII_REDACTED]202a8f3efea4d8ed2d10edb; https://git.kernel.org/stable/c/475b5098043eef6e72751aadeab687992a5b63d1; https://git.kernel.org/stable/c/700852528fc5295897d6089eea0656d67f9b9d88
CVE: CVE-2024-53163
Published: 2024-12-24
Description: In the Linux kernel, the following vulnerability has been resolved:

crypto: qat/qat_420xx - fix off by one in uof_get_name()

This is called from uof_get_name_420xx() where "num_objs" is the
ARRAY_SIZE() of fw_objs[].  The > needs to be >= to prevent an out of
bounds access.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-193, CWE-193
References: https://git.kernel.org/stable/c/91eef1ad75f03d37dba926b73f9dd6f058bc4d58; https://git.kernel.org/stable/c/93a11608fb3720e1bc2b19a2649ac2b49cca1921; https://git.kernel.org/stable/c/c23661a36eea840b657e485d48ed88b246da1bb8
CVE: CVE-2024-12744
Published: 2024-12-24
Description: A SQL injection in the Amazon Redshift JDBC Driver in v2.1.0.31 allows a user to gain escalated privileges via the getSchemas, getTables, or getColumns Metadata APIs. Users should upgrade to the driver version 2.1.0.32 or revert to driver version 2.1.0.30.
CVSS Score: 8.0 (HIGH)
CWE: CWE-89
References: https://aws.amazon.com/security/security-bulletins/AWS-2024-015/; https://github.com/aws/amazon-redshift-jdbc-driver/releases/tag/v2.1.0.32; https://github.com/aws/amazon-redshift-jdbc-driver/security/advisories/GHSA-8596-2jgr-ppj7
CVE: CVE-2024-12745
Published: 2024-12-24
Description: A SQL injection in the Amazon Redshift Python Connector v2.1.4 allows a user to gain escalated privileges via the get_schemas, get_tables, or get_columns Metadata APIs. Users are recommended to upgrade to the driver version 2.1.5 or revert to driver version 2.1.3.
CVSS Score: 8.0 (HIGH)
CWE: CWE-89
References: https://aws.amazon.com/security/security-bulletins/AWS-2024-015/; https://github.com/aws/amazon-redshift-python-driver/releases/tag/v2.1.5; https://github.com/aws/amazon-redshift-python-driver/security/advisories/GHSA-8gc2-vq6m-rwjw
CVE: CVE-2024-12746
Published: 2024-12-24
Description: A SQL injection in the Amazon Redshift ODBC Driver v2.1.5.0 (Windows or Linux) allows a user to gain escalated privileges via the SQLTables or SQLColumns Metadata APIs. Users are recommended to upgrade to the driver version 2.1.6.0 or revert to driver version 2.1.4.0.
CVSS Score: 8.0 (HIGH)
CWE: CWE-89
References: https://aws.amazon.com/security/security-bulletins/AWS-2024-015/; https://github.com/aws/amazon-redshift-odbc-driver/releases/tag/v2.1.6; https://github.com/aws/amazon-redshift-odbc-driver/security/advisories/GHSA-g63m-5vjv-wr3v
CVE: CVE-2019-2483
Published: 2024-12-24
Description: Vulnerability in the Oracle iStore product of Oracle E-Business Suite (component: Shopping Cart).  Supported versions that are affected are 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, 12.2.5, 12.2.6, 12.2.7 and  12.2.8. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle iStore.  Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle iStore, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle iStore accessible data as well as  unauthorized update, insert or delete access to some of Oracle iStore accessible data. CVSS 3.0 Base Score 8.2 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N).
CVSS Score: 8.2 (HIGH)
References: https://www.oracle.com/security-alerts/cpujan2[PII_REDACTED].html
CVE: CVE-2022-21505
Published: 2024-12-24
Description: In the linux kernel, if IMA appraisal is used with the "ima_appraise=log" boot param, lockdown can be defeated with kexec on any machine when Secure Boot is disabled or unavailable. IMA prevents setting "ima_appraise=log" from the boot param when Secure Boot is enabled, but this does not cover cases where lockdown is used without Secure Boot. CVSS 3.1 Base Score 6.7 (Confidentiality, Integrity, Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-346
References: https://git.kernel.org/linus/543ce63b664e2c2f9533d089a4664b559c3e6b5b; https://linux.oracle.com/cve/CVE-2022-21505.html
CVE: CVE-2024-12032
Published: 2024-12-25
Description: The Tourfic – Ultimate Hotel Booking, Travel Booking & Apartment Booking WordPress Plugin | WooCommerce Booking plugin for WordPress is vulnerable to SQL Injection via the 'enquiry_id' parameter of the 'tf_enquiry_reply_email_callback' function in all versions up to, and including, 2.15.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: https://plugins.trac.wordpress.org/browser/tourfic/tags/2.14.1/inc/Core/Enquiry.php#L990; https://plugins.trac.wordpress.org/changeset/3207686/tourfic/trunk/inc/Core/Enquiry.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/35eebcc8-a6bf-4cbb-9cc6-f49bd1625d6b?source=cve
CVE: CVE-2024-12190
Published: 2024-12-25
Description: The Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the bitform-form-entry-edit endpoint in all versions up to, and including,  2.17.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to view all form submissions from other users.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://plugins.trac.wordpress.org/changeset/3204875/bit-form/trunk/includes/Frontend/FormEntryView.php; https://plugins.trac.wordpress.org/changeset/3209668/bit-form/trunk/includes/Frontend/FormEntryView.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/ce9dab37-4118-4e13-857c-9aa072d25edf?source=cve
CVE: CVE-2024-12272
Published: 2024-12-25
Description: The WP Travel Engine – Elementor Widgets | Create Travel Booking Website Using WordPress and Elementor plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.3.7 via several widgets. This makes it possible for authenticated attackers, with Contributor-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.
CVSS Score: 8.8 (HIGH)
CWE: CWE-98
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3212458%40wte-elementor-widgets&new=3212458%40wte-elementor-widgets&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/be5142f6-36da-4715-91d2-7d6665c0efa6?source=cve
CVE: CVE-2024-12413
Published: 2024-12-25
Description: The MarketKing — Ultimate WooCommerce Multivendor Marketplace Solution plugin for WordPress is vulnerable to unauthorized access due to missing capability checks on several functions like 'marketking_delete_team_member', 'marketkingrejectuser', 'marketking_save_profile_settings', and many more in all versions up to, and including, 2.0.00. This makes it possible for unauthenticated attackers to delete users, update settings, approve users, and more.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://plugins.trac.wordpress.org/changeset/3212032/marketking-multivendor-marketplace-for-woocommerce/trunk/includes/class-marketking-core.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/3cb809c9-7167-4333-969f-0141c96342bd?source=cve
CVE: CVE-2024-1609
Published: 2024-12-25
Description: In OPPOStore iOS App, there's a possible escalation of privilege due to improper input validation.
CWE: CWE-287
References: https://security.oppo.com/en/noticeDetail?notice_only_key=NOTICE[PII_REDACTED]048840704
CVE: CVE-2024-12428
Published: 2024-12-25
Description: The WP Data Access – App, Table, Form and Chart Builder plugin plugin for WordPress is vulnerable to SQL Injection via the 'order[user_login][dir]' parameter in all versions up to, and including, 5.5.22 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: https://plugins.trac.wordpress.org/changeset/3210150/wp-data-access/tags/5.5.23/WPDataAccess/Data_Tables/WPDA_Data_Tables.php?old=3206494&old_path=wp-data-access%2Ftags%2F5.5.22%2FWPDataAccess%2FData_Tables%2FWPDA_Data_Tables.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/a1708d6e-14f5-418f-81eb-f9269159b5b1?source=cve
CVE: CVE-2024-12636
Published: 2024-12-25
Description: The Privacy Policy Generator, Terms & Conditions Generator WordPress Plugin : WP Legal Pages plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.2.6. This is due to missing or incorrect nonce validation on the 'create_popup_delete_process' function. This makes it possible for unauthenticated attackers to delete popups via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3212527%40wplegalpages&new=3212527%40wplegalpages&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/8da64b2f-8546-4276-9dbf-b60e885a0309?source=cve
CVE: CVE-2024-10858
Published: 2024-12-25
Description: The Jetpack  WordPress plugin before 14.1 does not properly checks the postmessage origin in its 13.x versions, allowing it to be bypassed and leading to DOM-XSS. The issue only affects websites hosted on WordPress.com.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/7fecba37-d718-4dd4-89f3-285fb36a4165/; https://wpscan.com/vulnerability/7fecba37-d718-4dd4-89f3-285fb36a4165/
CVE: CVE-2024-10862
Published: 2024-12-25
Description: The NEX-Forms – Ultimate Form Builder – Contact forms and much more plugin for WordPress is vulnerable to SQL Injection via the 'search_params' parameter in all versions up to, and including, 8.7.15 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This can be exploited via CSRF due to a lack of nonce validation on the get_table_records AJAX action.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-89
References: https://plugins.trac.wordpress.org/browser/nex-forms-express-wp-form-builder/trunk/includes/classes/class.dashboard.php#L3065; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3225289%40nex-forms-express-wp-form-builder&new=3225289%40nex-forms-express-wp-form-builder&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/ab807beb-0e20-47e4-be3e-9e8f50b84c7b?source=cve
CVE: CVE-2024-11281
Published: 2024-12-25
Description: The WooCommerce Point of Sale plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 6.1.0. This is due to insufficient validation on the 'logged_in_user_id' value when option values are empty and the ability for attackers to change the email of arbitrary user accounts. This makes it possible for unauthenticated attackers to change the email of arbitrary user accounts, including administrators, and reset their password to gain access to the account.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-862
References: https://codecanyon.net/item/wordpress-woocommerce-pos-system-point-of-sale/21254976; https://www.wordfence.com/threat-intel/vulnerabilities/id/2a0671b1-1414-4315-8a2d-bd1aabe091a4?source=cve
CVE: CVE-2024-12335
Published: 2024-12-25
Description: The Avada (Fusion) Builder plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 3.11.12 via the handle_clone_post() function and the 'fusion_blog' shortcode and due to insufficient restrictions on which posts can be included. This makes it possible for authenticated attackers, with contributor-level access and above, to extract data from password protected, private, or draft posts that they should not have access to.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-639
References: https://avada.com; https://www.wordfence.com/threat-intel/vulnerabilities/id/4181dcad-b5bd-46db-b47c-3cdee427123c?source=cve
CVE: CVE-2024-52046
Published: 2024-12-25
Description: The ObjectSerializationDecoder in Apache MINA uses Java’s native deserialization protocol to process
incoming serialized data but lacks the necessary security checks and defenses. This vulnerability allows
attackers to exploit the deserialization process by sending specially crafted malicious serialized data,
potentially leading to remote code execution (RCE) attacks.



					


				


			


		


	
This issue affects MINA core versions 2.0.X, 2.1.X and 2.2.X, and will be fixed by the releases 2.0.27, 2.1.10 and 2.2.4.





It's also important to note that an application using MINA core library will only be affected if the IoBuffer#getObject() method is called, and this specific method is potentially called when adding a ProtocolCodecFilter instance using the ObjectSerializationCodecFactory class in the filter chain. If your application is specifically using those classes, you have to upgrade to the latest version of MINA core library.




Upgrading will  not be enough: you also need to explicitly allow the classes the decoder will accept in the ObjectSerializationDecoder instance, using one of the three new methods:




    /**

     * Accept class names where the supplied ClassNameMatcher matches for

     * deserialization, unless they are otherwise rejected.

     *

     * @param classNameMatcher the matcher to use

     */

    public void accept(ClassNameMatcher classNameMatcher)




    /**

     * Accept class names that match the supplied pattern for

     * deserialization, unless they are otherwise rejected.

     *

     * @param pattern standard Java regexp

     */

    public void accept(Pattern pattern) 





    /**

     * Accept the wildcard specified classes for deserialization,

     * unless they are otherwise rejected.

     *

     * @param patterns Wildcard file name patterns as defined by

     *                  {@link org.apache.commons.io.FilenameUtils#wildcardMatch(String, String) FilenameUtils.wildcardMatch}

     */

    public void accept(String... patterns)







By default, the decoder will reject *all* classes that will be present in the incoming data.







Note: The FtpServer, SSHd and Vysper sub-project are not affected by this issue.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502, CWE-502
References: https://lists.apache.org/thread/4wxktgjpggdbto15d515wdctohb0qmv8; http://www.openwall.com/lists/oss-security/2024/12/25/1; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2024-8950
Published: 2024-12-25
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Arne Informatics Piramit Automation allows Blind SQL Injection.This issue affects Piramit Automation: before 27.09.2024.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-89
References: https://www.usom.gov.tr/bildirim/tr-24-1898
CVE: CVE-2024-39725
Published: 2024-12-25
Description: IBM Engineering Lifecycle Optimization - Engineering Insights 7.0.2 and 7.0.3 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-209
References: https://www.ibm.com/support/pages/node/7176782
CVE: CVE-2024-39727
Published: 2024-12-25
Description: IBM Engineering Lifecycle Optimization - Engineering Insights 7.0.2 and 7.0.3 uses a web link with untrusted references to an external site. A remote attacker could exploit this vulnerability to expose sensitive information or perform unauthorized actions on the victims’ web browser.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-1022
References: https://www.ibm.com/support/pages/node/7176783
CVE: CVE-2023-5117
Published: 2024-12-25
Description: An issue was discovered in GitLab CE/EE affecting all versions before 17.6.0 in which users were unaware that files uploaded to comments on confidential issues and epics of public projects could be accessed without authentication via a direct link to the uploaded file URL.
CVSS Score: 3.7 (LOW)
CWE: CWE-213
References: https://gitlab.com/gitlab-org/gitlab/-/issues/398250
CVE: CVE-2024-47102
Published: 2024-12-25
Description: IBM AIX 7.2, 7.3, VIOS 3.1, and 4.1

could allow a non-privileged local user to exploit a vulnerability in the AIX perfstat kernel extension to cause a denial of service.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-863
References: https://www.ibm.com/support/pages/node/7179826
CVE: CVE-2024-47978
Published: 2024-12-25
Description: Dell NativeEdge, version(s) 2.1.0.0, contain(s) an Execution with Unnecessary Privileges vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-250
References: https://www.dell.com/support/kbdoc/en-us/000258904/dsa-2024-488-security-update-for-dell-nativeedge-multiple-vulnerabilities
CVE: CVE-2024-52535
Published: 2024-12-25
Description: Dell SupportAssist for Home PCs versions 4.6.1 and prior and Dell SupportAssist for Business PCs versions 4.5.0 and prior, contain a symbolic link (symlink) attack vulnerability in the software remediation component. A low-privileged authenticated user could potentially exploit this vulnerability, gaining privileges escalation, leading to arbitrary deletion of files and folders from the system.
CVSS Score: 7.1 (HIGH)
CWE: CWE-61, CWE-59
References: https://www.dell.com/support/kbdoc/en-us/000261086/dsa-2024-470-security-update-for-dell-supportassist-for-home-pcs-and-dell-supportassist-for-business-pcs-vulnerabilities
CVE: CVE-2024-52906
Published: 2024-12-25
Description: IBM AIX 7.2, 7.3, VIOS 3.1, and 4.1



could allow a non-privileged local user to exploit a vulnerability in the TCP/IP kernel extension to cause a denial of service.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-362
References: https://www.ibm.com/support/pages/node/7179826
CVE: CVE-2024-53291
Published: 2024-12-25
Description: Dell NativeEdge, version(s) 2.1.0.0, contain(s) an Exposure of Sensitive Information Through Metadata vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Information disclosure.
CVSS Score: 7.5 (HIGH)
CWE: CWE-1230
References: https://www.dell.com/support/kbdoc/en-us/000258904/dsa-2024-488-security-update-for-dell-nativeedge-multiple-vulnerabilities
CVE: CVE-2024-52534
Published: 2024-12-25
Description: Dell ECS, version(s) prior to ECS 3.8.1.3, contain(s) an Authentication Bypass by Capture-replay vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Session theft.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-294
References: https://www.dell.com/support/kbdoc/en-us/000256642/dsa-2024-483-security-update-for-dell-ecs-multiple-vulnerabilities
CVE: CVE-2024-52543
Published: 2024-12-25
Description: Dell NativeEdge, version(s) 2.1.0.0, contain(s) a Creation of Temporary File With Insecure Permissions vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to Information disclosure.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-378, CWE-668
References: https://www.dell.com/support/kbdoc/en-us/000258904/dsa-2024-488-security-update-for-dell-nativeedge-multiple-vulnerabilities
CVE: CVE-2024-56431
Published: 2024-12-25
Description: oc_huff_tree_unpack in huffdec.c in libtheora in Theora through 1.0 7180717 has an invalid negative left shift. NOTE: this is disputed by third parties because there is no evidence of a security impact, e.g., an application would not crash.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-863
References: https://github.com/UnionTech-Software/libtheora-CVE-2024-56431-PoC; https://github.com/xiph/theora/blob/[PII_REDACTED]af1ebc7da15c83162d6c5d6203aabf/lib/huffdec.c#L193; https://github.com/xiph/theora/issues/17#issuecomment[PII_REDACTED]
CVE: CVE-2024-56430
Published: 2024-12-25
Description: OpenFHE through 1.2.3 has a NULL pointer dereference in BinFHEContext::EvalFloor in lib/binfhe-base-scheme.cpp.
CVSS Score: 2.9 (LOW)
CWE: CWE-476
References: https://github.com/UnionTech-Software/openfhe-PoC; https://github.com/openfheorg/openfhe-development/blob/7b8346f4eac27121543e36c17237b919e03ec058/src/binfhe/lib/binfhe-base-scheme.cpp#L307-L308; https://github.com/openfheorg/openfhe-development/releases/tag/v1.2.3
CVE: CVE-2024-12926
Published: 2024-12-25
Description: A vulnerability classified as critical was found in Codezips Project Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /pages/forms/advanced.php. The manipulation of the argument name leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89
References: https://github.com/dawatermelon/CVE/blob/main/CodeZips%20Project%20Management%20System/README.md; https://vuldb.com/?ctiid.289279; https://vuldb.com/?id.289279
CVE: CVE-2024-12927
Published: 2024-12-25
Description: A vulnerability, which was classified as critical, has been found in 1000 Projects Attendance Tracking Management System 1.0. Affected by this issue is some unknown functionality of the file /faculty/check_faculty_login.php. The manipulation of the argument faculty_emailid leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://1000projects.org/; https://github.com/zzkk0173/CVE/issues/1; https://vuldb.com/?ctiid.289280