deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-7443
Published: 2024-08-03
Description: ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability classified as critical has been found in Vivotek IB8367A VVTK-0100b. Affected is the function getenv of the file upload_file.cgi. The manipulation of the argument QUERY_STRING leads to command injection. It is possible to launch the attack remotely. The identifier of this vulnerability is VDB-273528. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: Vendor was contacted early and confirmed that the affected release tree is end-of-life.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-77
References: https://vuldb.com/?ctiid.273528; https://vuldb.com/?id.273528; https://vuldb.com/?submit.383844
CVE: CVE-2024-7444
Published: 2024-08-03
Description: A vulnerability classified as critical was found in itsourcecode Ticket Reservation System 1.0. Affected by this vulnerability is an unknown functionality of the file login.php of the component Login Page. The manipulation of the argument username leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-273529 was assigned to this vulnerability.
CVSS Score: 7.3 (HIGH)
CWE: CWE-89
References: https://github.com/DeepMountains/Mirage/blob/main/CVE10-1.md; https://vuldb.com/?ctiid.273529; https://vuldb.com/?id.273529
CVE: CVE-2024-7445
Published: 2024-08-03
Description: A vulnerability, which was classified as critical, has been found in itsourcecode Ticket Reservation System 1.0. Affected by this issue is some unknown functionality of the file checkout_ticket_save.php. The manipulation of the argument data leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-273530 is the identifier assigned to this vulnerability.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-89
References: https://github.com/DeepMountains/Mirage/blob/main/CVE10-2.md; https://vuldb.com/?ctiid.273530; https://vuldb.com/?id.273530
CVE: CVE-2024-7446
Published: 2024-08-03
Description: A vulnerability, which was classified as critical, was found in itsourcecode Ticket Reservation System 1.0. This affects an unknown part of the file list_tickets.php. The manipulation of the argument prefSeat_id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-273531.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-89
References: https://github.com/DeepMountains/Mirage/blob/main/CVE10-3.md; https://vuldb.com/?ctiid.273531; https://vuldb.com/?id.273531
CVE: CVE-2024-6331
Published: 2024-08-04
Description: stitionai/devika main branch as of commit cdfb782b0e634b773b10963c8034dc9207ba1f9f is vulnerable to Local File Read (LFI) by Prompt Injection. The integration of Google Gimini 1.0 Pro with `HarmBlockThreshold.BLOCK_NONE` for `HarmCategory.HARM_CATEGORY_HATE_SPEECH` and `HarmCategory.HARM_CATEGORY_HARASSMENT` in `safety_settings` disables content protection. This allows malicious commands to be executed, such as reading sensitive file contents like `/etc/passwd`.
CVSS Score: 7.5 (HIGH)
CWE: CWE-74, CWE-74
References: https://huntr.com/bounties/d5ac1051-22fa-42f0-8d82-73267482e60f
CVE: CVE-2024-7449
Published: 2024-08-04
Description: A vulnerability, which was classified as critical, was found in itsourcecode Placement Management System 1.0. Affected is an unknown function of the file login.php. The manipulation of the argument email leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-273540.
CVSS Score: 7.3 (HIGH)
CWE: CWE-89
References: https://github.com/DeepMountains/Mirage/blob/main/CVE11-1.md; https://vuldb.com/?ctiid.273540; https://vuldb.com/?id.273540
CVE: CVE-2024-7450
Published: 2024-08-04
Description: A vulnerability has been found in itsourcecode Placement Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /resume_upload.php of the component Image Handler. The manipulation of the argument fileToUpload leads to unrestricted upload. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-273541 was assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-434
References: https://github.com/DeepMountains/Mirage/blob/main/CVE11-2.md; https://vuldb.com/?ctiid.273541; https://vuldb.com/?id.273541
CVE: CVE-2024-7451
Published: 2024-08-04
Description: A vulnerability was found in itsourcecode Placement Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file apply_now.php. The manipulation of the argument id leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-273542 is the identifier assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/DeepMountains/Mirage/blob/main/CVE11-3.md; https://vuldb.com/?ctiid.273542; https://vuldb.com/?id.273542
CVE: CVE-2024-7452
Published: 2024-08-04
Description: A vulnerability was found in itsourcecode Placement Management System 1.0. It has been classified as critical. This affects an unknown part of the file view_company.php. The manipulation of the argument id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-273543.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/DeepMountains/Mirage/blob/main/CVE11-4.md; https://vuldb.com/?ctiid.273543; https://vuldb.com/?id.273543
CVE: CVE-2024-7453
Published: 2024-08-04
Description: A vulnerability was found in FastAdmin 1.5.0.20240328. It has been declared as problematic. This vulnerability affects unknown code of the file /[admins_url].php/general/attachment/edit/ids/4?dialog=1 of the component Attachment Management Section. The manipulation of the argument row[url]/row[imagewidth]/row[imageheight] leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-273544.
CVSS Score: 2.4 (LOW)
CWE: CWE-79
References: https://github.com/Hebing123/cve/issues/65; https://github.com/Hebing123/cve/issues/66; https://vuldb.com/?ctiid.273544
CVE: CVE-2024-7454
Published: 2024-08-04
Description: A vulnerability, which was classified as critical, has been found in SourceCodester Clinics Patient Management System 1.0. Affected by this issue is the function patient_name of the file patients.php. The manipulation leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-273548.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/lche511/cve/blob/main/sql.md; https://vuldb.com/?ctiid.273548; https://vuldb.com/?id.273548
CVE: CVE-2024-7455
Published: 2024-08-04
Description: A vulnerability, which was classified as critical, was found in itsourcecode Tailoring Management System 1.0. This affects an unknown part of the file partedit.php. The manipulation of the argument id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-273549 was assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/Wumshi/cve/issues/3; https://vuldb.com/?ctiid.273549; https://vuldb.com/?id.273549
CVE: CVE-2024-35143
Published: 2024-08-04
Description: IBM Planning Analytics Local 2.0 and 2.1 connects to a MongoDB server. MongoDB, a document-oriented database system, is listening on the remote port, and it is configured to allow connections without password authentication. A remote attacker can gain unauthorized access to the database.  IBM X-Force ID:  292420.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-306, CWE-306
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/292420; https://www.ibm.com/support/pages/node/7157110
CVE: CVE-2024-7458
Published: 2024-08-04
Description: A vulnerability was found in elunez eladmin up to 2.7 and classified as critical. This issue affects some unknown processing of the file /api/deploy/upload /api/database/upload of the component Database Management/Deployment Management. The manipulation of the argument file leads to path traversal: 'dir/../../filename'. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-273551.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-27, CWE-22
References: https://github.com/elunez/eladmin/issues/851; https://vuldb.com/?ctiid.273551; https://vuldb.com/?id.273551
CVE: CVE-2024-7459
Published: 2024-08-04
Description: A vulnerability was found in OSWAPP Warehouse Inventory System 1.0/2.0. It has been classified as problematic. Affected is an unknown function of the file /edit_account.php. The manipulation leads to cross-site request forgery. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-273552.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://gist.github.com/topsky979/26ab4dc35349a3f670fb8688c69a5cad; https://vuldb.com/?ctiid.273552; https://vuldb.com/?id.273552
CVE: CVE-2024-7460
Published: 2024-08-04
Description: A vulnerability was found in OSWAPP Warehouse Inventory System 1.0/2.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /change_password.php. The manipulation leads to cross-site request forgery. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-273553 was assigned to this vulnerability.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://gist.github.com/topsky979/b178dd940d98828d1dfd0ccaaaddeb6b; https://vuldb.com/?ctiid.273553; https://vuldb.com/?id.273553
CVE: CVE-2024-7461
Published: 2024-08-05
Description: A vulnerability was found in ForIP Tecnologia Administração PABX 1.x. It has been rated as critical. Affected by this issue is some unknown functionality of the file /authMonitCallcenter of the component monitcallcenter. The manipulation of the argument user leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-273554 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 7.3 (HIGH)
CWE: CWE-89
References: https://docs.google.com/document/d/1mlEC73Tdqr8L39ogilAbWSj4ZvCRmprtI82zvawWCzE/edit; https://vuldb.com/?ctiid.273554; https://vuldb.com/?id.273554
CVE: CVE-2024-7462
Published: 2024-08-05
Description: A vulnerability classified as critical has been found in TOTOLINK N350RT 9.3.5u.6139_B20201216. This affects the function setWizardCfg of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument ssid leads to buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-273555. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 8.8 (HIGH)
CWE: CWE-120
References: https://github.com/abcdefg-png/IoT-vulnerable/blob/main/TOTOLINK/N350R/setWizardCfg.md; https://vuldb.com/?ctiid.273555; https://vuldb.com/?id.273555
CVE: CVE-2024-7463
Published: 2024-08-05
Description: A vulnerability classified as critical was found in TOTOLINK CP900 6.3c.566. This vulnerability affects the function UploadCustomModule of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument File leads to buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-273556. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 8.8 (HIGH)
CWE: CWE-120
References: https://github.com/abcdefg-png/IoT-vulnerable/blob/main/TOTOLINK/CP900/UploadCustomModule.md; https://vuldb.com/?ctiid.273556; https://vuldb.com/?id.273556
CVE: CVE-2024-7464
Published: 2024-08-05
Description: A vulnerability, which was classified as critical, has been found in TOTOLINK CP900 6.3c.566. This issue affects the function setTelnetCfg of the component Telnet Service. The manipulation of the argument telnet_enabled leads to command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-273557 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-77
References: https://github.com/abcdefg-png/IoT-vulnerable/blob/main/TOTOLINK/CP900/setTelnetCfg.md; https://vuldb.com/?ctiid.273557; https://vuldb.com/?id.273557
CVE: CVE-2024-7465
Published: 2024-08-05
Description: A vulnerability, which was classified as critical, was found in TOTOLINK CP450 4.1.0cu.747_B20191224. Affected is the function loginauth of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument http_host leads to buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-273558 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 8.8 (HIGH)
CWE: CWE-120
References: https://github.com/abcdefg-png/IoT-vulnerable/blob/main/TOTOLINK/CP450/loginauth.md; https://vuldb.com/?ctiid.273558; https://vuldb.com/?id.273558
CVE: CVE-2024-7466
Published: 2024-08-05
Description: A vulnerability has been found in PMWeb 7.2.00 and classified as problematic. Affected by this vulnerability is an unknown functionality of the component Web Application Firewall. The manipulation leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-273559. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 2.4 (LOW)
CWE: CWE-79
References: https://mega.nz/file/nEcUTJxI#L2DCw4f4iwbXuErXlB1NRowprk1UZjWw6FtLgBgBpEA; https://vuldb.com/?ctiid.273559; https://vuldb.com/?id.273559
CVE: CVE-2024-7467
Published: 2024-08-05
Description: A vulnerability was found in Raisecom MSG1200, MSG2100E, MSG2200 and MSG2300 3.90 and classified as critical. Affected by this issue is the function sslvpn_config_mod of the file /vpn/list_ip_network.php of the component Web Interface. The manipulation of the argument template/stylenum leads to os command injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-273560. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-78, CWE-78
References: https://github.com/h0e4a0r1t/h0e4a0r1t.github.io/blob/master/2024/sQrromK7x42JbLgY/Command%20Injection%20Vulnerability%20in%20RAISECOM%20Gateway%20Devices-list_ip_network.php.pdf; https://vuldb.com/?ctiid.273560; https://vuldb.com/?id.273560
CVE: CVE-2024-7468
Published: 2024-08-05
Description: A vulnerability was found in Raisecom MSG1200, MSG2100E, MSG2200 and MSG2300 3.90. It has been classified as critical. This affects the function sslvpn_config_mod of the file /vpn/list_service_manage.php of the component Web Interface. The manipulation of the argument template/stylenum leads to os command injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-273561 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-78
References: https://github.com/h0e4a0r1t/h0e4a0r1t.github.io/blob/master/2024/sQrromK7x42JbLgY/Command%20Injection%20Vulnerability%20in%20RAISECOM%20Gateway%20Devices-list_service_manage.php.pdf; https://vuldb.com/?ctiid.273561; https://vuldb.com/?id.273561
CVE: CVE-2024-7469
Published: 2024-08-05
Description: A vulnerability was found in Raisecom MSG1200, MSG2100E, MSG2200 and MSG2300 3.90. It has been declared as critical. This vulnerability affects the function sslvpn_config_mod of the file /vpn/list_vpn_web_custom.php of the component Web Interface. The manipulation of the argument template/stylenum leads to os command injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-273562 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-78
References: https://github.com/h0e4a0r1t/h0e4a0r1t.github.io/blob/master/2024/sQrromK7x42JbLgY/Command%20Injection%20Vulnerability%20in%20RAISECOM%20Gateway%20Devices-list_vpn_web_custom.php.pdf; https://vuldb.com/?ctiid.273562; https://vuldb.com/?id.273562
CVE: CVE-2024-7470
Published: 2024-08-05
Description: A vulnerability was found in Raisecom MSG1200, MSG2100E, MSG2200 and MSG2300 3.90. It has been rated as critical. This issue affects the function sslvpn_config_mod of the file /vpn/vpn_template_style.php of the component Web Interface. The manipulation of the argument template/stylenum leads to os command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-273563. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-78
References: https://github.com/h0e4a0r1t/h0e4a0r1t.github.io/blob/master/2024/sQrromK7x42JbLgY/Command%20Injection%20Vulnerability%20in%20RAISECOM%20Gateway%20Devices-vpn_template_style.php.pdf; https://vuldb.com/?ctiid.273563; https://vuldb.com/?id.273563
CVE: CVE-2024-39713
Published: 2024-08-05
Description: A Server-Side Request Forgery (SSRF) affects Rocket.Chat's Twilio webhook endpoint before version 6.10.1.
CVSS Score: 8.6 (HIGH)
CWE: CWE-918, CWE-918
References: https://hackerone.com/reports/1886954
CVE: CVE-2024-39838
Published: 2024-08-05
Description: ZWX-2000CSW2-HN firmware versions prior to Ver.0.3.15 uses hard-coded credentials, which may allow a network-adjacent attacker with an administrative privilege to alter the configuration of the device.
CVSS Score: 8.8 (HIGH)
CWE: CWE-798, CWE-798
References: https://jvn.jp/en/jp/JVN70666401/; https://www.zexelon.co.jp/pdf/jvn70666401.pdf
CVE: CVE-2024-41720
Published: 2024-08-05
Description: Incorrect permission assignment for critical resource issue exists in ZWX-2000CSW2-HN firmware versions prior to Ver.0.3.15, which may allow a network-adjacent authenticated attacker to alter the configuration of the device.
CVSS Score: 8.0 (HIGH)
CWE: CWE-732, CWE-732
References: https://jvn.jp/en/jp/JVN70666401/; https://www.zexelon.co.jp/pdf/jvn70666401.pdf
CVE: CVE-2024-41889
Published: 2024-08-05
Description: Multiple Pimax products accept WebSocket connections from unintended endpoints. If this vulnerability is exploited, arbitrary code may be executed by a remote unauthenticated attacker.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-923
References: https://github.com/OpenMAR/PiTool; https://jvn.jp/en/jp/JVN50850706/; https://pimax.com/pages/downloads-manuals
CVE: CVE-2024-6117
Published: 2024-08-05
Description: A Unrestricted upload of file with dangerous type vulnerability in meeting management function in Hamastar MeetingHub Paperless Meetings 2021 allows remote authenticated users to perform arbitrary system commands via a crafted ASP file.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434, CWE-434
References: https://zuso.ai/advisory/za-2024-02
CVE: CVE-2024-6118
Published: 2024-08-05
Description: A Plaintext Storage of a Password vulnerability in ebooknote function in Hamastar MeetingHub Paperless Meetings 2021 allows remote attackers to obtain the other users’ credentials and gain access to the product via an XML file.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-256, CWE-522
References: https://zuso.ai/advisory/za-2024-03
CVE: CVE-2024-2232
Published: 2024-08-05
Description: The  lacks CSRF checks allowing a user to invite any user to any group (including private groups)
CVSS Score: 8.1 (HIGH)
CWE: CWE-352
References: https://wpscan.com/vulnerability/a2df28d3-bf03-4fd3-b231-86e062739899/
CVE: CVE-2024-3636
Published: 2024-08-05
Description: The Pinpoint Booking System  WordPress plugin before 2.9.9.4.8 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/bab46c28-71aa-4610-9683-361e7b008d37/
CVE: CVE-2024-5081
Published: 2024-08-05
Description: The wp-eMember WordPress plugin before v10.7.0 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-352
References: https://wpscan.com/vulnerability/4f02bdb5-5cf6-4519-9586-fd4fb3d45dea/
CVE: CVE-2024-6270
Published: 2024-08-05
Description: The Community Events WordPress plugin before 1.5.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/3d0a6edc-61e8-42fb-8b93-ef083146bd9c/
CVE: CVE-2024-6498
Published: 2024-08-05
Description: The Chatbot for WordPress by Collect.chat ⚡️ WordPress plugin before 2.4.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://wpscan.com/vulnerability/eed58889-4be8-48df-9ef6-269df451e79e/
CVE: CVE-2024-6710
Published: 2024-08-05
Description: The Ditty  WordPress plugin before 3.1.45 does not sanitise and escape some parameters, which could allow users with a role as low as Contributor to perform Cross-Site Scripting attacks.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/1afcf9d4-c2f9-4d47-8d9e-d7fa6ae2358d/