deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-24017
Published: 2025-01-21
Description: YesWiki is a wiki system written in PHP. Versions up to and including 4.4.5 are vulnerable to any end-user crafting a DOM based XSS on all of YesWiki's pages which is triggered when a user clicks on a malicious link. The vulnerability makes use of the search by tag feature. When a tag doesn't exist, the tag is reflected on the page and isn't properly sanitized on the server side which allows a malicious user to generate a link that will trigger an XSS on the client's side when clicked. This vulnerability allows any user to generate a malicious link that will trigger an account takeover when clicked, therefore allowing a user to steal other accounts, modify pages, comments, permissions, extract user data (emails), thus impacting the integrity, availability and confidentiality of a YesWiki instance. Version 4.5.0 contains a patch for the issue.
CVSS Score: 7.6 (HIGH)
CWE: CWE-79
References: https://github.com/YesWiki/yeswiki/commit/c1e28b[PII_REDACTED]2c31c850219e4504a20db98b; https://github.com/YesWiki/yeswiki/security/advisories/GHSA-wphc-5f2j-jhvg
CVE: CVE-2024-45687
Published: 2025-01-21
Description: Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting') vulnerability in Payara Platform Payara Server (Grizzly, REST Management Interface modules), Payara Platform Payara Micro (Grizzly modules) allows Manipulating State, Identity Spoofing.This issue affects Payara Server: from 4.1.151 through 4.1.2.191.51, from 5.20.0 through 5.70.0, from 5.2020.2 through 5.2022.5, from 6.2022.1 through 6.2024.12, from 6.0.0 through 6.21.0; Payara Micro: from 4.1.152 through 4.1.2.191.51, from 5.20.0 through 5.70.0, from 5.2020.2 through 5.2022.5, from 6.2022.1 through 6.2024.12, from 6.0.0 through 6.21.0.
CWE: CWE-113
References: https://docs.payara.fish/community/docs/6.2025.1/Release%20Notes/Release%20Notes%206.2025.1.html; https://docs.payara.fish/enterprise/docs/5.71.0/Release%20Notes/Release%20Notes%205.71.0.html; https://docs.payara.fish/enterprise/docs/Release%20Notes/Release%20Notes%206.22.0.html
CVE: CVE-2025-0623
Published: 2025-01-21
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE: CVE-2025-24018
Published: 2025-01-21
Description: YesWiki is a wiki system written in PHP. In versions up to and including 4.4.5, it is possible for an authenticated user with rights to edit/create a page or comment to trigger a stored XSS which will be reflected on any page where the resource is loaded. The vulnerability makes use of the content edition feature and more specifically of the `{{attach}}` component allowing users to attach files/medias to a page. When a file is attached using the `{{attach}}` component, if the resource contained in the `file` attribute doesn't exist, then the server will generate a file upload button containing the filename. This vulnerability allows any malicious authenticated user that has the right to create a comment or edit a page to be able to steal accounts and therefore modify pages, comments, permissions, extract user data (emails), thus impacting the integrity, availability and confidentiality of a YesWiki instance. Version 4.5.0 contains a patch for the issue.
CVSS Score: 7.6 (HIGH)
CWE: CWE-79
References: https://github.com/YesWiki/yeswiki/blob/v4.4.5/tools/attach/libs/attach.lib.php#L660; https://github.com/YesWiki/yeswiki/commit/c1e28b[PII_REDACTED]2c31c850219e4504a20db98b; https://github.com/YesWiki/yeswiki/security/advisories/GHSA-w59h-3x3q-3p6j
CVE: CVE-2024-54792
Published: 2025-01-21
Description: A Cross-Site Request Forgery (CSRF) vulnerability has been found in SpagoBI v3.5.1 in the user administration panel. An authenticated user can lead another user into executing unwanted actions inside the application they are logged in, like adding, editing or deleting users.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-352
References: https://github.com/MarioTesoro/CVE-2024-54792; https://github.com/MarioTesoro/vulnerability-research/tree/main/CVE-2024-54792
CVE: CVE-2024-54794
Published: 2025-01-21
Description: The script input feature of SpagoBI 3.5.1 allows arbitrary code execution.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-77
References: https://github.com/MarioTesoro/CVE-2024-54794; https://github.com/MarioTesoro/vulnerability-research/tree/main/CVE-2024-54794
CVE: CVE-2024-54795
Published: 2025-01-21
Description: SpagoBI v3.5.1 contains multiple Stored Cross-Site Scripting (XSS) vulnerabilities in the create/edit forms of the worksheet designer function.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/MarioTesoro/CVE-2024-54795; https://github.com/MarioTesoro/vulnerability-research/tree/main/CVE-2024-54795
CVE: CVE-2025-22150
Published: 2025-01-21
Description: Undici is an HTTP/1.1 client. Starting in version 4.5.0 and prior to versions 5.28.5, 6.21.1, and 7.2.3, undici uses `Math.random()` to choose the boundary for a multipart/form-data request. It is known that the output of `Math.random()` can be predicted if several of its generated values are known. If there is a mechanism in an app that sends multipart requests to an attacker-controlled website, they can use this to leak the necessary values. Therefore, an attacker can tamper with the requests going to the backend APIs if certain conditions are met. This is fixed in versions 5.28.5, 6.21.1, and 7.2.3. As a workaround, do not issue multipart requests to attacker controlled servers.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-330
References: https://blog.securityevaluators.com/hacking-the-javascript-lottery-80cc437e3b7f; https://github.com/nodejs/undici/blob/8b06b8250907d92fead664b3368f1d2aa27c1f35/lib/web/fetch/body.js#L113; https://github.com/nodejs/undici/commit/711e20772764c29f6622ddc937c63b6eefdf07d0
CVE: CVE-2025-22267
Published: 2025-01-21
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpweaver Weaver Themes Shortcode Compatibility weaver-themes-shortcode-compatibility allows Stored XSS.This issue affects Weaver Themes Shortcode Compatibility: from n/a through <= 1.0.4.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/weaver-themes-shortcode-compatibility/vulnerability/wordpress-weaver-themes-shortcode-compatibility-plugin-1-0-4-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-22276
Published: 2025-01-21
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in enguerranws Related Post Shortcode related-post-shortcode allows Stored XSS.This issue affects Related Post Shortcode: from n/a through <= 1.2.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/related-post-shortcode/vulnerability/wordpress-related-post-shortcode-plugin-1-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-22661
Published: 2025-01-21
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in vcita Online Payments – Get Paid with PayPal, Square & Stripe paypal-payment-button-by-vcita allows Stored XSS.This issue affects Online Payments – Get Paid with PayPal, Square & Stripe: from n/a through <= 3.20.0.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/paypal-payment-button-by-vcita/vulnerability/wordpress-online-payments-plugin-3-20-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-22721
Published: 2025-01-21
Description: Missing Authorization vulnerability in Farhan Noor ApplyOnline apply-online allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ApplyOnline: from n/a through <= 2.6.7.1.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/apply-online/vulnerability/wordpress-applyonline-plugin-2-6-7-1-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-22722
Published: 2025-01-21
Description: Missing Authorization vulnerability in Marketing Fire Widget Options widget-options allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Widget Options: from n/a through <= 4.0.8.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/widget-options/vulnerability/wordpress-widget-options-plugin-4-0-8-broken-access-control-to-notice-dimissal-vulnerability?_s_id=cve
CVE: CVE-2025-23454
Published: 2025-01-21
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in flashmaniac Nature FlipBook vertical-diamond-flipbook-flash allows Reflected XSS.This issue affects Nature FlipBook: from n/a through <= 1.7.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/vertical-diamond-flipbook-flash/vulnerability/wordpress-nature-flipbook-wordpress-plugin-plugin-1-7-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-23461
Published: 2025-01-21
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in xkollsoftware Social2Blog social2blog allows Reflected XSS.This issue affects Social2Blog: from n/a through <= 0.2.990.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/social2blog/vulnerability/wordpress-social2blog-plugin-0-2-990-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-23477
Published: 2025-01-21
Description: Missing Authorization vulnerability in realtyworkstation Realty Workstation realty-workstation allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Realty Workstation: from n/a through <= 1.0.45.
CVSS Score: 8.2 (HIGH)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/realty-workstation/vulnerability/wordpress-realty-workstation-plugin-1-0-45-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-23489
Published: 2025-01-21
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brian Messenlehner WP-Announcements wp-announcements allows Reflected XSS.This issue affects WP-Announcements: from n/a through <= 1.8.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/wp-announcements/vulnerability/wordpress-wp-announcements-plugin-1-8-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-23551
Published: 2025-01-21
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in razvypp SexBundle sexbundle allows Reflected XSS.This issue affects SexBundle: from n/a through <= 1.4.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/sexbundle/vulnerability/wordpress-sexbundle-plugin-1-4-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-23580
Published: 2025-01-21
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Matthew BizLibrary bizlibrary allows Reflected XSS.This issue affects BizLibrary: from n/a through <= 1.1.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/bizlibrary/vulnerability/wordpress-bizlibrary-plugin-1-1-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-23994
Published: 2025-01-21
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Estatebud Estatebud – Properties & Listings estatebud-properties-listings allows Stored XSS.This issue affects Estatebud – Properties & Listings: from n/a through <= 5.5.0.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/estatebud-properties-listings/vulnerability/wordpress-estatebud-properties-listings-plugin-5-5-0-csrf-to-stored-xss-vulnerability?_s_id=cve
CVE: CVE-2025-23996
Published: 2025-01-21
Description: Cross-Site Request Forgery (CSRF) vulnerability in AnyRoad AnyRoad anyguide allows Cross Site Request Forgery.This issue affects AnyRoad: from n/a through <= 1.3.2.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/anyguide/vulnerability/wordpress-anyroad-plugin-1-3-2-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-24019
Published: 2025-01-21
Description: YesWiki is a wiki system written in PHP. In versions up to and including 4.4.5, it is possible for any authenticated user, through the use of the filemanager to delete any file owned by the user running the FastCGI Process Manager (FPM) on the host without any limitation on the filesystem's scope. This vulnerability allows any authenticated user to arbitrarily remove content from the Wiki resulting in partial loss of data and defacement/deterioration of the website. In the context of a container installation of YesWiki without any modification, the `yeswiki` files (for example .php) are not owned by the same user (root) as the one running the FPM process (www-data). However in a standard installation, www-data may also be the owner of the PHP files, allowing a malicious user to completely cut the access to the wiki by deleting all important PHP files (like index.php or core files of YesWiki). Version 4.5.0 contains a patch for this issue.
CVSS Score: 7.1 (HIGH)
CWE: CWE-22
References: https://github.com/YesWiki/yeswiki/commit/3ddd833d22703caf9025659eb174f7765df7147c; https://github.com/YesWiki/yeswiki/security/advisories/GHSA-43c9-gw4x-pcx6
CVE: CVE-2025-24020
Published: 2025-01-21
Description: WeGIA is a Web manager for charitable institutions. An Open Redirect vulnerability was identified in the `control.php` endpoint of versions up to and including 3.2.10 of the WeGIA application. The vulnerability allows the `nextPage` parameter to be manipulated, redirecting authenticated users to arbitrary external URLs without validation. The issue stems from the lack of validation for the `nextPage` parameter, which accepts external URLs as redirection destinations. This vulnerability can be exploited to perform phishing attacks or redirect users to malicious websites. Version 3.2.11 contains a fix for the issue.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: https://github.com/LabRedesCefetRJ/WeGIA/commit/89d98bf074cebf6c4ed95fca6f64e325c0b1d2f0; https://github.com/LabRedesCefetRJ/WeGIA/releases/tag/v3.2.11; https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-27g8-5q48-xmw6
CVE: CVE-2025-24456
Published: 2025-01-21
Description: In JetBrains Hub before 2024.3.55417 privilege escalation was possible via LDAP authentication mapping
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-288, CWE-306
References: https://www.jetbrains.com/privacy-security/issues-fixed/
CVE: CVE-2025-24457
Published: 2025-01-21
Description: In JetBrains YouTrack before 2024.3.55417 permanent tokens could be exposed in logs
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-532
References: https://www.jetbrains.com/privacy-security/issues-fixed/
CVE: CVE-2025-24458
Published: 2025-01-21
Description: In JetBrains YouTrack before 2024.3.55417 account takeover was possible via spoofed email and Helpdesk integration
CVSS Score: 7.1 (HIGH)
CWE: CWE-290
References: https://www.jetbrains.com/privacy-security/issues-fixed/
CVE: CVE-2025-24459
Published: 2025-01-21
Description: In JetBrains TeamCity before 2024.12.1 reflected XSS was possible on the Vault Connection page
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-79
References: https://www.jetbrains.com/privacy-security/issues-fixed/
CVE: CVE-2025-24460
Published: 2025-01-21
Description: In JetBrains TeamCity before 2024.12.1 improper access control allowed to see Projects’ names in the agent pool
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-863
References: https://www.jetbrains.com/privacy-security/issues-fixed/
CVE: CVE-2025-24461
Published: 2025-01-21
Description: In JetBrains TeamCity before 2024.12.1 decryption of connection secrets without proper permissions was possible via Test Connection endpoint
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862
References: https://www.jetbrains.com/privacy-security/issues-fixed/
CVE: CVE-2024-51417
Published: 2025-01-21
Description: An issue in System.Linq.Dynamic.Core before 1.6.0 allows remote access to properties on reflection types and static properties/fields.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-863
References: https://dynamic-linq.net/expression-language#operators; https://github.com/zzzprojects/System.Linq.Dynamic.Core/issues/867; https://zzzprojects.com/
CVE: CVE-2024-55504
Published: 2025-01-21
Description: An issue in RAR Extractor - Unarchiver Free and Pro v.6.4.0 allows local attackers to inject arbitrary code potentially leading to remote control and unauthorized access to sensitive user data via the exploit_combined.dylib component on MacOS.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-94
References: https://apps.apple.com/us/app/rar-extractor-unarchiver-pro/id647505820?mt=12; https://github.com/Audit00r/RAR-Extractor-Unarchiver-Pro-Dylib-injection; https://github.com/SyFi/CVE-2024-55504
CVE: CVE-2025-23369
Published: 2025-01-21
Description: An improper verification of cryptographic signature vulnerability was identified in GitHub Enterprise Server that allowed signature spoofing for unauthorized internal users.  Instances not utilizing SAML single sign-on or where the attacker is not already an existing user were not impacted. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.12.14, 3.13.10, 3.14.7, 3.15.2, and 3.16.0. This vulnerability was reported via the GitHub Bug Bounty program.
CVSS Score: 8.8 (HIGH)
CWE: CWE-347
References: https://docs.github.com/en/enterprise-server@3.12/admin/release-notes#3.12.14; https://docs.github.com/en/enterprise-server@3.13/admin/release-notes#3.13.10; https://docs.github.com/en/enterprise-server@3.14/admin/release-notes#3.14.7
CVE: CVE-2023-45908
Published: 2025-01-21
Description: Homarr before v0.14.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Notebook widget.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/CosasDePuma/CVE-Research/tree/main/CVE-2023-45908; https://github.com/ajnart/homarr; https://homarr.dev/
CVE: CVE-2024-42936
Published: 2025-01-21
Description: The mqlink.elf is service component in Ruijie RG-EW300N with firmware ReyeeOS 1.300.1422 is vulnerable to Remote Code Execution via a modified MQTT broker message.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: https://gist.github.com/smrx86/2008111b12ab47882b3928d0cbc9e415
CVE: CVE-2025-24024
Published: 2025-01-21
Description: Mjolnir is a moderation tool for Matrix. Mjolnir v1.9.0 responds to management commands from any room the bot is member of. This can allow users who aren't operators of the bot to use the bot's functions, including server administration components if enabled. Version 1.9.1 reverts the feature that introduced the bug, and version 1.9.2 reintroduces the feature safely. Downgrading to version 1.8.3 is recommended if upgrading to 1.9.1 or higher isn't possible.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-671
References: https://github.com/matrix-org/mjolnir/commit/b437fa16b[PII_REDACTED]df861987c836affd51eea; https://github.com/matrix-org/mjolnir/commit/d0ef527a9e3eb45e17143d5295a64b775ccaa23d; https://github.com/matrix-org/mjolnir/security/advisories/GHSA-3jq6-xc85-m394
CVE: CVE-2024-21245
Published: 2025-01-21
Description: Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Business Logic Infra SEC).  Supported versions that are affected are Prior to 9.2.9.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools.  Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in JD Edwards EnterpriseOne Tools, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of JD Edwards EnterpriseOne Tools accessible data as well as  unauthorized read access to a subset of JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N).
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-346, CWE-346
References: https://www.oracle.com/security-alerts/cpujan2025.html
CVE: CVE-2024-48392
Published: 2025-01-21
Description: OrangeScrum v2.0.11 is vulnerable to Cross Site Scripting (XSS). An attacker can inject malicious JavaScript code into user email due to lack of input validation, which could lead to account takeover.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/Renzusclarke/CVE-2024-48392-PoC; https://github.com/Renzusclarke/CVE-2024-48392-PoC/blob/main/poc.txt; https://www.orangescrum.com/
CVE: CVE-2024-55958
Published: 2025-01-21
Description: Northern.tech CFEngine Enterprise Mission Portal 3.24.0, 3.21.5, and below allows XSS. The fixed versions are 3.24.1 and 3.21.6.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://Northern.tech; https://cfengine.com/blog/2025/cve-2024-55958/
CVE: CVE-2024-55959
Published: 2025-01-21
Description: Northern.tech Mender Client 4.x before 4.0.5 has Insecure Permissions.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-276
References: https://Northern.tech; https://mender.io/blog/cve-2024-55959
CVE: CVE-2024-57360
Published: 2025-01-21
Description: https://www.gnu.org/software/binutils/ nm >=2.43 is affected by: Incorrect Access Control. The type of exploitation is: local. The component is: `nm --without-symbol-version` function.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-284
References: https://sourceware.org/bugzilla/show_bug.cgi?id=32467
CVE: CVE-2024-57536
Published: 2025-01-21
Description: Linksys E8450 v1.2.00.360516 was discovered to contain a command injection vulnerability via wizard_status.
CVSS Score: 8.0 (HIGH)
CWE: CWE-77
References: https://github.com/Wood1314/Linksys_E8450_vul/blob/main/8/8.md; https://github.com/Wood1314/Linksys_E8450_vul/blob/main/8/8.md
CVE: CVE-2024-57537
Published: 2025-01-21
Description: Linksys E8450 v1.2.00.360516 was discovered to contain a buffer overflow vulnerability. The parsed field (page) is copied to the stack without length verification.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-120
References: https://github.com/Wood1314/Linksys_E8450_vul/blob/main/1/1.md; https://github.com/Wood1314/Linksys_E8450_vul/blob/main/1/1.md
CVE: CVE-2024-57538
Published: 2025-01-21
Description: Linksys E8450 v1.2.00.360516 was discovered to contain a buffer overflow vulnerability. The parsed field (anonymous_protect_status) is copied to the stack without length verification.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-120
References: https://github.com/Wood1314/Linksys_E8450_vul/blob/main/10/10.md
CVE: CVE-2024-57539
Published: 2025-01-21
Description: Linksys E8450 v1.2.00.360516 was discovered to contain a command injection vulnerability via userEmail.
CVSS Score: 8.2 (HIGH)
CWE: CWE-77
References: https://github.com/Wood1314/Linksys_E8450_vul/blob/main/3/3.md
CVE: CVE-2024-57540
Published: 2025-01-21
Description: Linksys E8450 v1.2.00.360516 was discovered to contain a buffer overflow vulnerability. The parsed field (action) is copied to the stack without length verification.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-120
References: https://github.com/Wood1314/Linksys_E8450_vul/blob/main/2/2.md
CVE: CVE-2024-57541
Published: 2025-01-21
Description: Linksys E8450 v1.2.00.360516 was discovered to contain a buffer overflow vulnerability. The parsed field (ipv6_protect_status) is copied to the stack without length verification.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-120
References: https://github.com/Wood1314/Linksys_E8450_vul/blob/main/9/9.md; https://github.com/Wood1314/Linksys_E8450_vul/blob/main/9/9.md