deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-49693
Published: 2024-10-24
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kraft Plugins Mega Elements mega-elements-addons-for-elementor allows Stored XSS.This issue affects Mega Elements: from n/a through <= 1.2.6.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/mega-elements-addons-for-elementor/vulnerability/wordpress-mega-elements-addons-for-elementor-plugin-1-2-6-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-49695
Published: 2024-10-24
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Spiffy Plugins WP Flow Plus wp-imageflow2 allows Stored XSS.This issue affects WP Flow Plus: from n/a through <= 5.2.3.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/wp-imageflow2/vulnerability/wordpress-wp-flow-plus-plugin-5-2-3-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-49696
Published: 2024-10-24
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in robosoft Robo Gallery robo-gallery allows Stored XSS.This issue affects Robo Gallery: from n/a through <= 3.2.21.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/robo-gallery/vulnerability/wordpress-photo-gallery-images-slider-in-rbs-image-gallery-plugin-3-2-21-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-49702
Published: 2024-10-24
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Saad Iqbal myCred Elementor mycred-for-elementor allows Stored XSS.This issue affects myCred Elementor: from n/a through <= 1.2.6.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/mycred-for-elementor/vulnerability/wordpress-mycred-elementor-plugin-1-2-6-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-45031
Published: 2024-10-24
Description: When editing objects in the Syncope Console, incomplete HTML tags could be used to bypass HTML sanitization. This made it possible to inject stored XSS payloads which would trigger for other users during ordinary usage of the application.
XSS payloads could also be injected in Syncope Enduser when editing “Personal Information” or “User Requests”: such payloads would trigger for administrators in Syncope Console, thus enabling session hijacking.

Users are recommended to upgrade to version 3.0.9, which fixes this issue.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://lists.apache.org/thread/fn567pfmo3s55ofkc42drz8b4kgbhp9m; http://www.openwall.com/lists/oss-security/2024/10/24/2
CVE: CVE-2024-48538
Published: 2024-10-24
Description: Incorrect access control in the firmware update and download processes of Neye3C v4.5.2.0 allows attackers to access sensitive information by analyzing the code and data within the APK file.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-862
References: http://neye3c.com; http://www.netdvr.cn/page6; https://github.com/HankJames/Vul-Reports/blob/main/FirmwareLeakage/com.gooclient.anycam.neye3ctwo/com.gooclient.anycam.neye3ctwo.md
CVE: CVE-2024-10335
Published: 2024-10-24
Description: A vulnerability was found in SourceCodester Garbage Collection Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file login.php. The manipulation of the argument username/password leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The initial researcher advisory only mentions the parameter "username" to be affected. But it must be assumed that the parameter "password" is affected as well.
CVSS Score: 7.3 (HIGH)
CWE: CWE-89
References: https://github.com/tang-0717/VUL/blob/main/Garbage-Collection-Management-System-01.md; https://vuldb.com/?ctiid.281680; https://vuldb.com/?id.281680
CVE: CVE-2024-10336
Published: 2024-10-24
Description: A vulnerability was found in SourceCodeHero Clothes Recommendation System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /admin/index.php of the component Admin Login Page. The manipulation of the argument t1 leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-89
References: https://vuldb.com/?ctiid.281681; https://vuldb.com/?id.281681; https://vuldb.com/?submit.427442
CVE: CVE-2024-40810
Published: 2024-10-24
Description: An out-of-bounds write issue was addressed with improved input validation. This issue is fixed in macOS Sonoma 14.6. An app may be able to cause a coprocessor crash.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://support.apple.com/en-us/120911
CVE: CVE-2024-44141
Published: 2024-10-24
Description: The issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14.6. A person with physical access to an unlocked Mac may be able to gain root code execution.
CVSS Score: 6.8 (MEDIUM)
References: https://support.apple.com/en-us/120911
CVE: CVE-2024-44185
Published: 2024-10-24
Description: The issue was addressed with improved checks. This issue is fixed in Safari 17.6, iOS 17.6 and iPadOS 17.6, macOS Sonoma 14.6, tvOS 17.6, visionOS 1.3, watchOS 10.6. Processing maliciously crafted web content may lead to an unexpected process crash.
CVSS Score: 5.5 (MEDIUM)
References: https://support.apple.com/en-us/120909; https://support.apple.com/en-us/120911; https://support.apple.com/en-us/120913
CVE: CVE-2024-44205
Published: 2024-10-24
Description: A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in iOS 16.7.9 and iPadOS 16.7.9, iOS 17.6 and iPadOS 17.6, macOS Monterey 12.7.6, macOS Sonoma 14.6, macOS Ventura 13.6.8. A sandboxed app may be able to access sensitive user data in system logs.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-532, CWE-532
References: https://support.apple.com/en-us/120908; https://support.apple.com/en-us/120909; https://support.apple.com/en-us/120910
CVE: CVE-2024-44206
Published: 2024-10-24
Description: An issue in the handling of URL protocols was addressed with improved logic. This issue is fixed in Safari 17.6, iOS 17.6 and iPadOS 17.6, macOS Sonoma 14.6, tvOS 17.6, visionOS 1.3, watchOS 10.6. A user may be able to bypass some web content restrictions.
CVSS Score: 9.3 (CRITICAL)
References: https://support.apple.com/en-us/120909; https://support.apple.com/en-us/120911; https://support.apple.com/en-us/120913
CVE: CVE-2024-48539
Published: 2024-10-24
Description: Neye3C v4.5.2.0 was discovered to contain a hardcoded encryption key in the firmware update mechanism.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798
References: http://neye3c.com; http://www.netdvr.cn/page6; https://github.com/HankJames/Vul-Reports/blob/main/FirmwareLeakage/com.gooclient.anycam.neye3ctwo/com.gooclient.anycam.neye3ctwo_key.md
CVE: CVE-2024-48540
Published: 2024-10-24
Description: Incorrect access control in XIAO HE Smart 4.3.1 allows attackers to access sensitive information by analyzing the code and data within the APK file.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-863
References: https://github.com/HankJames/Vul-Reports/blob/main/FirmwareLeakage/com.hle.china.smarthome.xiaohe/com.hle.china.smarthome.xiaohe.md
CVE: CVE-2024-48541
Published: 2024-10-24
Description: Incorrect access control in the firmware update and download processes of Ruochan Smart v4.4.7 allows attackers to access sensitive information by analyzing the code and data within the APK file.
CVSS Score: 8.4 (HIGH)
CWE: CWE-863
References: http://www.ruochanit.com/; https://github.com/HankJames/Vul-Reports/blob/main/FirmwareLeakage/com.ruochan.dabai/com.ruochan.dabai.md
CVE: CVE-2024-48542
Published: 2024-10-24
Description: Incorrect access control in the firmware update and download processes of Yamaha Headphones Controller v1.6.7 allows attackers to access sensitive information by analyzing the code and data within the APK file.
CVSS Score: 8.4 (HIGH)
CWE: CWE-863
References: https://github.com/HankJames/Vul-Reports/blob/main/FirmwareLeakage/com.yamaha.sc.hpcontroller/com.yamaha.sc.hpcontroller.md
CVE: CVE-2024-48544
Published: 2024-10-24
Description: Incorrect access control in the firmware update and download processes of Sylvania Smart Home v3.0.3 allows attackers to access sensitive information by analyzing the code and data within the APK file.
CVSS Score: 8.4 (HIGH)
CWE: CWE-863
References: http://sylvania.com; https://github.com/HankJames/Vul-Reports/blob/main/FirmwareLeakage/com.ledvance.smartplus/com.ledvance.smartplus.md
CVE: CVE-2024-48545
Published: 2024-10-24
Description: Incorrect access control in the firmware update and download processes of IVY Smart v4.5.0 allows attackers to access sensitive information by analyzing the code and data within the APK file.
CVSS Score: 8.4 (HIGH)
CWE: CWE-863
References: https://github.com/HankJames/Vul-Reports/blob/main/FirmwareLeakage/com.ivyiot.IvySmart/com.ivyiot.IvySmart.md
CVE: CVE-2024-48546
Published: 2024-10-24
Description: Incorrect access control in the firmware update and download processes of Wear Sync v1.2.0 allows attackers to access sensitive information by analyzing the code and data within the APK file.
CVSS Score: 8.4 (HIGH)
CWE: CWE-863
References: https://github.com/HankJames/Vul-Reports/blob/main/FirmwareLeakage/com.yingsheng.nadai/com.yingsheng.nadai.md; https://haylou.com
CVE: CVE-2024-48547
Published: 2024-10-24
Description: Incorrect access control in the firmware update and download processes of DreamCatcher Life v1.8.7 allows attackers to access sensitive information by analyzing the code and data within the APK file.
CVSS Score: 8.4 (HIGH)
CWE: CWE-863
References: https://github.com/HankJames/Vul-Reports/blob/main/FirmwareLeakage/com.dc.dreamcatcherlife/com.dc.dreamcatcherlife.md
CVE: CVE-2024-48548
Published: 2024-10-24
Description: The APK file in Cloud Smart Lock v2.0.1 has a leaked a URL that can call an API for binding physical devices. This vulnerability allows attackers to arbitrarily construct a request to use the app to bind to unknown devices by finding a valid serial number via a bruteforce attack.
CVSS Score: 9.3 (CRITICAL)
CWE: CWE-863
References: https://cloudsmartlock.com/m/app.html; https://github.com/HankJames/Vul-Reports/blob/main/FirmwareLeakage/com.seamooncloud.cloudsmartlock/com.seamooncloud.cloudsmartlock.md
CVE: CVE-2024-9692
Published: 2024-10-24
Description: VIMESA VHF/FM Transmitter Blue Plus is suffering from a Denial-of-Service (DoS) vulnerability. An unauthenticated attacker can issue an unauthorized HTTP GET request to the unprotected endpoint 'doreboot' and restart the transmitter operations.
CWE: CWE-284
References: https://www.cisa.gov/news-events/ics-advisories/icsa-24-298-01
CVE: CVE-2024-10295
Published: 2024-10-24
Description: A flaw was found in Gateway. Sending a non-base64 'basic' auth with special characters can cause APICast to incorrectly authenticate a request. A malformed basic authentication header containing special characters bypasses authentication and allows unauthorized access to the backend. This issue can occur due to a failure in the base64 decoding process, which causes APICast to skip the rest of the authentication checks and proceed with routing the request upstream.
CVSS Score: 7.5 (HIGH)
CWE: CWE-863, CWE-863
References: https://access.redhat.com/security/cve/CVE-2024-10295; https://bugzilla.redhat.com/show_bug.cgi?id=2321258
CVE: CVE-2024-10313
Published: 2024-10-24
Description: iniNet Solutions SpiderControl SCADA PC HMI Editor has a path traversal 
vulnerability. When the software loads a malicious ‘ems' project 
template file constructed by an attacker, it can write files to 
arbitrary directories. This can lead to overwriting system files, 
causing system paralysis, or writing to startup items, resulting in 
remote control.
CVSS Score: 8.0 (HIGH)
CWE: CWE-22
References: https://www.cisa.gov/news-events/ics-advisories/icsa-24-298-02
CVE: CVE-2024-10337
Published: 2024-10-24
Description: A vulnerability classified as critical has been found in SourceCodeHero Clothes Recommendation System 1.0. Affected is an unknown function of the file /admin/home.php?con=add. The manipulation of the argument cat/subcat/ t1/t2/text leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-89, CWE-89
References: https://vuldb.com/?ctiid.281682; https://vuldb.com/?id.281682; https://vuldb.com/?submit.427443
CVE: CVE-2024-10338
Published: 2024-10-24
Description: A vulnerability classified as critical was found in SourceCodeHero Clothes Recommendation System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/home.php. The manipulation of the argument view/view1 leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-89
References: https://vuldb.com/?ctiid.281683; https://vuldb.com/?id.281683; https://vuldb.com/?submit.427447
CVE: CVE-2024-38314
Published: 2024-10-24
Description: IBM Maximo Application Suite - Monitor Component 8.10, 8.11, and 9.0 could disclose information in the form of the hard-coded cryptographic key to an attacker that has compromised environment.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-321
References: https://www.ibm.com/support/pages/node/7173988
CVE: CVE-2024-46478
Published: 2024-10-24
Description: HTMLDOC v1.9.18 contains a buffer overflow in parse_pre function,ps-pdf.cxx:5681.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120
References: https://github.com/michaelrsweet/htmldoc/commit/683bec548e642cf4a17e003fb34f6bbaf2d27b98; https://github.com/michaelrsweet/htmldoc/issues/529
CVE: CVE-2024-48440
Published: 2024-10-24
Description: Shenzhen Tuoshi Network Communications Co.,Ltd 5G CPE Router NR500-EA RG500UEAABxCOMSLICv3.2.2543.12.18 was discovered to contain a command injection vulnerability via the component at_command.asp.
CVSS Score: 8.8 (HIGH)
CWE: CWE-77
References: https://medium.com/%40sengkyaut/unauthenticated-factory-mode-reset-and-at-command-injection-in-jboneos-or-jbonecloud-firmware-1dec156b7ddd
CVE: CVE-2024-48441
Published: 2024-10-24
Description: Wuhan Tianyu Information Industry Co., Ltd Tianyu CPE Router CommonCPExCPETS_v3.2.468.11.04_P4 was discovered to contain a command injection vulnerability via the component at_command.asp.
CVSS Score: 8.8 (HIGH)
CWE: CWE-77
References: https://medium.com/%40sengkyaut/unauthenticated-factory-mode-reset-and-at-command-injection-in-jboneos-or-jbonecloud-firmware-1dec156b7ddd
CVE: CVE-2024-48442
Published: 2024-10-24
Description: Incorrect access control in Shenzhen Tuoshi Network Communications Co.,Ltd 5G CPE Router NR500-EA RG500UEAABxCOMSLICv3.2.2543.12.18 allows attackers to access the SSH protocol without authentication.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-306
References: https://medium.com/%40sengkyaut/unauthenticated-factory-mode-reset-and-at-command-injection-in-jboneos-or-jbonecloud-firmware-1dec156b7ddd
CVE: CVE-2024-48514
Published: 2024-10-24
Description: php-heic-to-jpg <= 1.0.5 is vulnerable to code injection (fixed in 1.0.6). An attacker who can upload heic images is able to execute code on the remote server via the file name. As a result, the CIA is no longer guaranteed. This affects php-heic-to-jpg 1.0.5 and below.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: https://advisories.gitlab.com/pkg/composer/maestroerror/php-heic-to-jpg/CVE-2024-48514/; https://github.com/MaestroError/php-heic-to-jpg; https://github.com/advisories/GHSA-g8v9-c8m3-942v
CVE: CVE-2024-46994
Published: 2024-10-24
Description: baserCMS is a website development framework. Versions prior to 5.1.2 have a cross-site scripting vulnerability in Blog posts and Contents list Feature. Version 5.1.2 fixes this issue.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://basercms.net/security/JVN_00876083; https://github.com/baserproject/basercms/security/advisories/GHSA-wrjc-fmfq-w3jr
CVE: CVE-2024-46995
Published: 2024-10-24
Description: baserCMS is a website development framework. Versions prior to 5.1.2 have a cross-site scripting vulnerability in HTTP 400 Bad Request. Version 5.1.2 fixes this issue.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://basercms.net/security/JVN_06274755; https://github.com/baserproject/basercms/security/advisories/GHSA-mr7q-fv7j-jcgv
CVE: CVE-2024-46996
Published: 2024-10-24
Description: baserCMS is a website development framework. Versions prior to 5.1.2 have a cross-site scripting vulnerability in the Blog posts feature. Version 5.1.2 fixes this issue.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-79
References: https://basercms.net/security/JVN_00876083; https://github.com/baserproject/basercms/security/advisories/GHSA-66jv-qrm3-vvfg
CVE: CVE-2024-46998
Published: 2024-10-24
Description: baserCMS is a website development framework. Versions prior to 5.1.2 have a cross-site scripting vulnerability in the Edit Email Form Settings Feature. Version 5.1.2 fixes the issue.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://basercms.net/security/JVN_98693329; https://github.com/baserproject/basercms/security/advisories/GHSA-p3m2-mj3j-j49x
CVE: CVE-2024-47173
Published: 2024-10-24
Description: Aimeos is an e-commerce framework. All SaaS and marketplace setups using the Aimeos GraphQL API admin interface version from 2024.04 up to 2024.07.1 are affected by a potential denial of service attack. Version 2024.07.2 fixes the issue.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-270
References: https://github.com/aimeos/ai-admin-graphql/security/advisories/GHSA-qxgx-hvg3-v92w
CVE: CVE-2024-48139
Published: 2024-10-24
Description: A prompt injection vulnerability in the chatbox of Blackbox AI v1.3.95 allows attackers to access and exfiltrate all previous and subsequent chat data between the user and the AI assistant via a crafted message.
CVSS Score: 7.5 (HIGH)
CWE: CWE-77
References: https://github.com/soursec/CVEs/tree/main/CVE-2024-48139; https://marketplace.visualstudio.com/items?itemName=Blackboxapp.blackbox
CVE: CVE-2024-48140
Published: 2024-10-24
Description: A prompt injection vulnerability in the chatbox of Butterfly Effect Limited Monica Your AI Copilot powered by ChatGPT4 v6.3.0 allows attackers to access and exfiltrate all previous and subsequent chat data between the user and the AI assistant via a crafted message.
CVSS Score: 7.5 (HIGH)
CWE: CWE-77
References: https://chromewebstore.google.com/detail/monica-your-ai-copilot-po/ofpnmcalabcbjgholdjcjblkibolbppb?hl=en; https://github.com/soursec/CVEs/tree/main/CVE-2024-48140
CVE: CVE-2024-48141
Published: 2024-10-24
Description: A prompt injection vulnerability in the chatbox of Zhipu AI CodeGeeX v2.17.0 allows attackers to access and exfiltrate all previous and subsequent chat data between the user and the AI assistant via a crafted message.
CVSS Score: 7.5 (HIGH)
CWE: CWE-77
References: https://github.com/soursec/CVEs/tree/main/CVE-2024-48141; https://marketplace.visualstudio.com/items?itemName=aminer.codegeex
CVE: CVE-2024-48142
Published: 2024-10-24
Description: A prompt injection vulnerability in the chatbox of Butterfly Effect Limited Monica ChatGPT AI Assistant v2.4.0 allows attackers to access and exfiltrate all previous and subsequent chat data between the user and the AI assistant via a crafted message.
CVSS Score: 7.5 (HIGH)
CWE: CWE-77
References: https://github.com/soursec/CVEs/tree/main/CVE-2024-48142; https://monica.im/desktop
CVE: CVE-2024-48143
Published: 2024-10-24
Description: A lack of rate limiting in the OTP validation component of Digitory Multi Channel Integrated POS v1.0 allows attackers to gain access to the ordering system and place an excessive amount of food orders.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-307
References: https://digitory.com/multi-channel-integrated-pos/; https://github.com/soursec/CVEs/tree/main/CVE-2024-48143
CVE: CVE-2024-48144
Published: 2024-10-24
Description: A prompt injection vulnerability in the chatbox of Fusion Chat Chat AI Assistant Ask Me Anything v1.2.4.0 allows attackers to access and exfiltrate all previous and subsequent chat data between the user and the AI assistant via a crafted message.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-77
References: https://apps.microsoft.com/detail/9n3ff8j3d7zr?hl=en-US&gl=US; https://github.com/soursec/CVEs/tree/main/CVE-2024-48144
CVE: CVE-2024-48145
Published: 2024-10-24
Description: A prompt injection vulnerability in the chatbox of Netangular Technologies ChatNet AI Version v1.0 allows attackers to access and exfiltrate all previous and subsequent chat data between the user and the AI assistant via a crafted message.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-77
References: https://apps.microsoft.com/detail/9n3zxd05895t?hl=en-us&gl=US; https://github.com/soursec/CVEs/tree/main/CVE-2024-48145
CVE: CVE-2024-48427
Published: 2024-10-24
Description: A SQL injection vulnerability in Sourcecodester Packers and Movers Management System v1.0 allows remote authenticated users to execute arbitrary SQL commands via the id parameter in /mpms/admin/?page=services/manage_service&id
CVSS Score: 8.8 (HIGH)
CWE: CWE-89, CWE-89
References: https://github.com/vighneshnair7/CVE-2024-48427/blob/main/README.md; https://www.sourcecodester.com/php/15360/packers-and-movers-management-system-phpoop-free-source-code.html
CVE: CVE-2024-48454
Published: 2024-10-24
Description: An issue in SourceCodester Purchase Order Management System v1.0 allows a remote attacker to execute arbitrary code via the /admin?page=user component
CVSS Score: 7.2 (HIGH)
CWE: CWE-434
References: https://github.com/N0zoM1z0/CVEs/blob/main/CVE-2024-48454.md; https://www.sourcecodester.com/; https://www.sourcecodester.com/php/14935/purchase-order-management-system-using-php-free-source-code.html
CVE: CVE-2024-45242
Published: 2024-10-24
Description: EnGenius ENH1350EXT A8J-ENH1350EXT devices through 3.9.3.2_c1.9.51 allow (blind) OS Command Injection via shell metacharacters to the Ping or Speed Test utility. During the time of initial setup, the device creates an open unsecured network whose admin panel is configured with the default credentials of admin/admin. An unauthorized attacker in proximity to the Wi-Fi network can exploit this window of time to execute arbitrary OS commands with root-level permissions.
CVSS Score: 7.8 (HIGH)
CWE: CWE-78
References: https://github.com/actuator/cve/blob/main/Engenius/CVE-2024-45242; https://github.com/actuator/cve/blob/main/Engenius/CVE-2024-45242_Extended_Report.pdf
CVE: CVE-2024-45259
Published: 2024-10-24
Description: An issue was discovered on certain GL-iNet devices, including MT6000, MT3000, MT2500, AXT1800, and AX1800 4.6.2. By intercepting an HTTP request and changing the filename property in the download interface, any file on the device can be deleted.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-326
References: https://github.com/gl-inet/CVE-issues/blob/main/4.0.0/Delete%20Any%20File%20via%20Download%20Interface.md