deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-43790
Published: 2024-08-22
Description: Vim is an open source command line text editor. When performing a search and displaying the search-count message is disabled (:set shm+=S), the search pattern is displayed at the bottom of the screen in a buffer (msgbuf). When right-left mode (:set rl) is enabled, the search pattern is reversed. This happens by allocating a new buffer. If the search pattern contains some ASCII NUL characters, the buffer allocated will be smaller than the original allocated buffer (because for allocating the reversed buffer, the strlen() function is called, which only counts until it notices an ASCII NUL byte ) and thus the original length indicator is wrong. This causes an overflow when accessing characters inside the msgbuf by the previously (now wrong) length of the msgbuf. The issue has been fixed as of Vim patch v9.1.0689.
CVSS Score: 4.5 (MEDIUM)
CWE: CWE-122
References: https://github.com/vim/vim/commit/cacb6693c10bb19f28a50eca47bc; https://github.com/vim/vim/security/advisories/GHSA-v2x2-cjcg-f9jm; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2024-8081
Published: 2024-08-22
Description: A vulnerability classified as critical was found in itsourcecode Payroll Management System 1.0. Affected by this vulnerability is an unknown functionality of the file login.php. The manipulation of the argument username leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-89
References: https://github.com/ppp-src/ha/issues/6; https://itsourcecode.com/; https://vuldb.com/?ctiid.275563
CVE: CVE-2024-8083
Published: 2024-08-22
Description: A vulnerability, which was classified as critical, has been found in SourceCodester Online Computer and Laptop Store 1.0. Affected by this issue is some unknown functionality of the file /php-ocls/classes/Master.php?f=pay_order. The manipulation of the argument id leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/0xffaaa/cve/blob/main/php-ocls-Arbitrary%20Sqli.md; https://vuldb.com/?ctiid.275564; https://vuldb.com/?id.275564
CVE: CVE-2024-8084
Published: 2024-08-22
Description: A vulnerability, which was classified as problematic, was found in SourceCodester Online Computer and Laptop Store 1.0. This affects an unknown part of the file /php-ocls/classes/SystemSettings.php?f=update_settings of the component Setting Handler. The manipulation of the argument System Name leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 2.4 (LOW)
CWE: CWE-79
References: https://github.com/0xffaaa/cve/blob/main/php-ocls-Arbitrary%20Stored%20Cross-Site%20Scripting(XSS).md; https://vuldb.com/?ctiid.275565; https://vuldb.com/?id.275565
CVE: CVE-2024-38208
Published: 2024-08-22
Description: Microsoft Edge for Android Spoofing Vulnerability
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38208
CVE: CVE-2024-38209
Published: 2024-08-22
Description: Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
CVSS Score: 7.8 (HIGH)
CWE: CWE-843
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38209
CVE: CVE-2024-38210
Published: 2024-08-22
Description: Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38210
CVE: CVE-2024-8086
Published: 2024-08-22
Description: A vulnerability has been found in SourceCodester E-Commerce System 1.0 and classified as critical. This vulnerability affects unknown code of the file /ecommerce/admin/login.php of the component Admin Login. The manipulation of the argument user_email leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-89
References: https://github.com/0xffaaa/cve/blob/main/ecommerce-Universal%20password%20bypasses%20login%20verification.md; https://vuldb.com/?ctiid.275566; https://vuldb.com/?id.275566
CVE: CVE-2024-8087
Published: 2024-08-22
Description: A vulnerability was found in SourceCodester E-Commerce System 1.0 and classified as critical. This issue affects some unknown processing of the file /ecommerce/popup_Item.php. The manipulation of the argument id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89, CWE-89
References: https://github.com/0xffaaa/cve/blob/main/ecommerce-Unauthorized%20sql%20union%20injection.md; https://vuldb.com/?ctiid.275567; https://vuldb.com/?id.275567
CVE: CVE-2024-8089
Published: 2024-08-23
Description: A vulnerability was found in SourceCodester E-Commerce System 1.0. It has been classified as critical. Affected is an unknown function of the file /ecommerce/admin/products/controller.php. The manipulation of the argument photo leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-434
References: https://github.com/0xffaaa/cve/blob/main/ecommerce-Unauthorized%20arbitrary%20file%20upload%20vulnerability.md; https://vuldb.com/?ctiid.275568; https://vuldb.com/?id.275568
CVE: CVE-2024-43477
Published: 2024-08-23
Description: Improper access control in Decentralized Identity Services resulted in a vulnerability that allows an unauthenticated attacker to disable Verifiable ID's on another tenant.
CVSS Score: 7.5 (HIGH)
CWE: CWE-284
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-43477
CVE: CVE-2024-7559
Published: 2024-08-23
Description: The File Manager Pro plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation and capability checks in the mk_file_folder_manager AJAX action in all versions up to, and including, 8.3.7. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
CVSS Score: 8.8 (HIGH)
CWE: CWE-94, CWE-434
References: https://filemanagerpro.io/file-manager-pro/; https://www.wordfence.com/threat-intel/vulnerabilities/id/f4b45791-4b85-4a2d-8019-1d438bd694cb?source=cve
CVE: CVE-2024-7258
Published: 2024-08-23
Description: The WooCommerce Google Feed Manager plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'wppfm_removeFeedFile' function in all versions up to, and including, 2.8.0. This makes it possible for authenticated attackers, with Contributor-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).
CVSS Score: 8.8 (HIGH)
CWE: CWE-862, CWE-862
References: https://plugins.trac.wordpress.org/browser/wp-product-feed-manager/trunk/includes/data/js/wppfm_ajaxdatahandling.js#L537; https://plugins.trac.wordpress.org/browser/wp-product-feed-manager/trunk/includes/data/js/wppfm_ajaxdatahandling.js#L546; https://plugins.trac.wordpress.org/browser/wp-product-feed-manager/trunk/includes/data/js/wppfm_ajaxdatahandling.js#L575
CVE: CVE-2024-3282
Published: 2024-08-23
Description: The WP Table Builder  WordPress plugin through 1.5.0 does not sanitise and escape some of its Table data, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/12bf5e8e-24c9-48b9-b94c-c14ed60d7c15/
CVE: CVE-2024-6715
Published: 2024-08-23
Description: The Ditty  WordPress plugin before 3.1.46 re-introduced a previously fixed security issue (https://wpscan.com/vulnerability/80a9eb3a-2cb1-4844-9004-ba2554b2d46c/) in v3.1.39
CVSS Score: 6.1 (MEDIUM)
References: https://wpscan.com/vulnerability/19406acc-3441-4d4a-9163-ace8f1dceb78/
CVE: CVE-2024-40766
Published: 2024-08-23
Description: An improper access control vulnerability has been identified in the SonicWall SonicOS management access, potentially leading to unauthorized resource access and in specific conditions, causing the firewall to crash. This issue affects SonicWall Firewall Gen 5 and Gen 6 devices, as well as Gen 7 devices running SonicOS 7.0.1-5035 and older versions.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-284
References: https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2024-0015; https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-40766
CVE: CVE-2024-43105
Published: 2024-08-23
Description: Mattermost Plugin Channel Export versions <=1.0.0 fail to restrict concurrent runs of the /export command which allows a user to consume excessive resource by running the /export command multiple times at once.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-400
References: https://mattermost.com/security-updates
CVE: CVE-2024-38807
Published: 2024-08-23
Description: Applications that use spring-boot-loader or spring-boot-loader-classic and contain custom code that performs signature verification of nested jar files may be vulnerable to signature forgery where content that appears to have been signed by one signer has, in fact, been signed by another.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-290, CWE-347
References: https://spring.io/security/cve-2024-38807; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2024-5502
Published: 2024-08-23
Description: The Piotnet Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Image Accordion, Dual Heading, and Vertical Timeline widgets in all versions up to, and including, 2.4.30 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/browser/piotnet-addons-for-elementor/trunk/widgets/pafe-dual-color-headline.php#L392; https://plugins.trac.wordpress.org/browser/piotnet-addons-for-elementor/trunk/widgets/pafe-image-accordion.php#L627; https://plugins.trac.wordpress.org/browser/piotnet-addons-for-elementor/trunk/widgets/pafe-vertical-timeline.php#L622
CVE: CVE-2024-7986
Published: 2024-08-23
Description: A vulnerability exists in the Rockwell Automation ThinManager® ThinServer that allows a threat actor to disclose sensitive information. A threat actor can exploit this vulnerability by abusing the ThinServer™ service to read arbitrary files by creating a junction that points to the target directory.
CVSS Score: 7.5 (HIGH)
CWE: CWE-732, CWE-732
References: https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1692.html
CVE: CVE-2024-43883
Published: 2024-08-23
Description: In the Linux kernel, the following vulnerability has been resolved:

usb: vhci-hcd: Do not drop references before new references are gained

At a few places the driver carries stale pointers
to references that can still be used. Make sure that does not happen.
This strictly speaking closes ZDI-CAN-22273, though there may be
similar races in the driver.
CVSS Score: 7.0 (HIGH)
CWE: CWE-416
References: https://git.kernel.org/stable/c/128e82e41cf7d74a562726c1587d9d2ede1a0a37; https://git.kernel.org/stable/c/4dacdb9720aaab10b6be121eae55820174d97174; https://git.kernel.org/stable/c/585e6bc7d0a9bf73a8be3d3fb34e86b90cc61a14
CVE: CVE-2024-36514
Published: 2024-08-23
Description: Zohocorp ManageEngine ADAudit Plus versions below 8000 are vulnerable to the authenticated SQL injection in file summary option.
CVSS Score: 8.3 (HIGH)
CWE: CWE-89, CWE-89
References: https://www.manageengine.com/products/active-directory-audit/cve-2024-36514.html
CVE: CVE-2024-36515
Published: 2024-08-23
Description: Zohocorp ManageEngine ADAudit Plus versions below 8000 are vulnerable to the authenticated SQL injection in dashboard.
Note: This vulnerability is different from another vulnerability (CVE-2024-36516), both of which have affected ADAudit Plus' dashboard.
CVSS Score: 8.3 (HIGH)
CWE: CWE-89, CWE-89
References: https://www.manageengine.com/products/active-directory-audit/cve-2024-36515.html
CVE: CVE-2024-36516
Published: 2024-08-23
Description: Zohocorp ManageEngine ADAudit Plus versions below 8000 are vulnerable to the authenticated SQL injection in dashboard.
Note: This vulnerability is different from another vulnerability (CVE-2024-36515), both of which have affected ADAudit Plus' dashboard.
CVSS Score: 8.3 (HIGH)
CWE: CWE-89, CWE-89
References: https://www.manageengine.com/products/active-directory-audit/cve-2024-36516.html
CVE: CVE-2024-36517
Published: 2024-08-23
Description: Zohocorp ManageEngine ADAudit Plus versions below 8000 are vulnerable to the authenticated SQL injection in alerts module.
CVSS Score: 8.3 (HIGH)
CWE: CWE-89, CWE-89
References: https://www.manageengine.com/products/active-directory-audit/cve-2024-36517.html
CVE: CVE-2024-5466
Published: 2024-08-23
Description: Zohocorp ManageEngine OpManager and Remote Monitoring and Management versions 128329 and below are vulnerable to the authenticated remote code execution in the deploy agent option.
CVSS Score: 8.8 (HIGH)
CWE: CWE-94, CWE-94
References: https://www.manageengine.com/itom/advisory/cve-2024-5466.html
CVE: CVE-2024-5467
Published: 2024-08-23
Description: Zohocorp ManageEngine ADAudit Plus versions below 8121 are vulnerable to the authenticated SQL injection in account lockout report.
CVSS Score: 8.3 (HIGH)
CWE: CWE-89, CWE-89
References: https://www.manageengine.com/products/active-directory-audit/cve-2024-5467.html
CVE: CVE-2024-5490
Published: 2024-08-23
Description: Zohocorp ManageEngine ADAudit Plus versions below 8000 are vulnerable to the authenticated SQL injection in aggregate reports option.
CVSS Score: 8.3 (HIGH)
CWE: CWE-89, CWE-89
References: https://www.manageengine.com/products/active-directory-audit/cve-2024-5490.html
CVE: CVE-2024-5556
Published: 2024-08-23
Description: Zohocorp ManageEngine ADAudit Plus versions below 8000 are vulnerable to the authenticated SQL injection in reports module.
CVSS Score: 8.3 (HIGH)
CWE: CWE-89, CWE-89
References: https://www.manageengine.com/products/active-directory-audit/cve-2024-5556.html
CVE: CVE-2024-5586
Published: 2024-08-23
Description: Zohocorp ManageEngine ADAudit Plus versions below 8121 are vulnerable to the authenticated SQL injection in extranet lockouts report option.
CVSS Score: 8.3 (HIGH)
CWE: CWE-89, CWE-89
References: https://www.manageengine.com/products/active-directory-audit/cve-2024-5586.html
CVE: CVE-2024-37311
Published: 2024-08-23
Description: Collabora Online is a collaborative online office suite based on LibreOffice. In affected versions of Collabora Online, https connections from coolwsd to other hosts may incompletely verify the remote host's certificate's against the full chain of trust. This vulnerability is fixed in Collabora Online 24.04.4.3, 23.05.14.1, and 22.05.23.1.
CVSS Score: 8.2 (HIGH)
CWE: CWE-295
References: https://github.com/CollaboraOnline/online/security/advisories/GHSA-hvhm-5c44-977x
CVE: CVE-2024-38869
Published: 2024-08-23
Description: Zohocorp ManageEngine Endpoint Central affected by Incorrect authorization vulnerability in remote office deploy configurations.This issue affects Endpoint Central: before 11.3.2416.04 and before 11.3.2400.25.
CVSS Score: 8.3 (HIGH)
CWE: CWE-863, CWE-79
References: https://www.manageengine.com/products/desktop-central/security-updates-config-access.html
CVE: CVE-2024-41150
Published: 2024-08-23
Description: An Stored Cross-site Scripting vulnerability in request module affects Zohocorp ManageEngine ServiceDesk Plus, ServiceDesk Plus MSP and SupportCenter Plus.This issue affects ServiceDesk Plus versions: through 14810; ServiceDesk Plus MSP: through 14800; SupportCenter Plus: through 14800.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.manageengine.com/products/service-desk/CVE-2024-41150.html
CVE: CVE-2024-42040
Published: 2024-08-23
Description: Buffer Overflow vulnerability in the net/bootp.c in DENEX U-Boot from its initial commit in 2002 (3861aa5) up to today on any platform allows an attacker on the local network to leak memory from four up to 32 bytes of memory stored behind the packet to the network depending on the later use of DHCP-provided parameters via crafted DHCP responses.
CVSS Score: 8.1 (HIGH)
CWE: CWE-120
References: https://github.com/u-boot/u-boot/tags; https://www.schutzwerk.com/advisories/SCHUTZWERK-SA-2024-004.txt; http://seclists.org/fulldisclosure/2024/Aug/38
CVE: CVE-2024-42764
Published: 2024-08-23
Description: Kashipara Bus Ticket Reservation System v1.0 is vulnerable to Cross Site Request Forgery (CSRF) via /deleteTicket.php.
CVSS Score: 9.4 (CRITICAL)
CWE: CWE-352
References: https://github.com/takekaramey/CVE_Writeup/blob/main/Kashipara/Bus%20Ticket%20Reservation%20System%20v1.0/CSRF.pdf; https://www.kashipara.com/
CVE: CVE-2024-42765
Published: 2024-08-23
Description: A SQL injection vulnerability in "/login.php" of the Kashipara Bus Ticket Reservation System v1.0 allows remote attackers to execute arbitrary SQL commands and bypass Login via the "email" or "password" Login page parameters.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/takekaramey/CVE_Writeup/blob/main/Kashipara/Bus%20Ticket%20Reservation%20System%20v1.0/SQL%20Injection%20-%20Login.pdf; https://www.kashipara.com/
CVE: CVE-2024-42766
Published: 2024-08-23
Description: Kashipara Bus Ticket Reservation System v1.0 0 is vulnerable to Incorrect Access Control via /deleteTicket.php.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-284
References: https://github.com/takekaramey/CVE_Writeup/blob/main/Kashipara/Bus%20Ticket%20Reservation%20System%20v1.0/Broken%20Access%20Control%20-%20Delete%20Bookings.pdf; https://www.kashipara.com/
CVE: CVE-2024-42915
Published: 2024-08-23
Description: A host header injection vulnerability in Staff Appraisal System v1.0 allows attackers to obtain the password reset token via user interaction with a crafted password reset link. This will allow attackers to arbitrarily reset other users' passwords and compromise their accounts.
CVSS Score: 8.0 (HIGH)
CWE: CWE-640
References: https://github.com/debashish-choudhury/staff-appraisal-system/; https://github.com/soursec/CVEs/tree/main/CVE-2024-42915
CVE: CVE-2024-43782
Published: 2024-08-23
Description: This openedx-translations repository contains translation files from Open edX repositories to be kept in sync with Transifex. Before moving to pulling translations from the openedx-translations repository via openedx-atlas, translations in the edx-platform repository were validated using edx-i18n-tools. This validation included protection against malformed translations and translations-based script injections. Prior to this patch, the validation implemented in the openedx-translations repository did not include the same protections. The maintainer inspected the translations in the edx-platform directory of both the main and open-release/redwood.master branches of the openedx-translations repository and found no evidence of exploited translation strings.
CVSS Score: 7.7 (HIGH)
CWE: CWE-74, CWE-74
References: https://github.com/openedx/openedx-translations/commit/3c4093705dec99590577c4d8270ce263f7fffc5a; https://github.com/openedx/openedx-translations/commit/b2444340e8702c[PII_REDACTED]c1db5fd85b25b92b; https://github.com/openedx/openedx-translations/security/advisories/GHSA-fg8c-2pvj-wx3j
CVE: CVE-2024-43791
Published: 2024-08-23
Description: RequestStore provides per-request global storage for Rack. The files published as part of request_store 1.3.2 have 0666 permissions, meaning that they are world-writable, which allows local users to execute arbitrary code. This version was published in 2017, and most production environments do not allow access for local users, so the chances of this being exploited are very low, given that the vast majority of users will have upgraded, and those that have not, if any, are not likely to be exposed.
CVSS Score: 7.8 (HIGH)
CWE: CWE-276, CWE-276
References: https://github.com/steveklabnik/request_store/security/advisories/GHSA-frp2-5qfc-7r8m
CVE: CVE-2024-8112
Published: 2024-08-23
Description: A vulnerability was found in thinkgem JeeSite 5.3. It has been rated as problematic. This issue affects some unknown processing of the file /js/a/login of the component Cookie Handler. The manipulation of the argument skinName leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: https://gitee.com/thinkgem/jeesite5/issues/IAKGTV; https://vuldb.com/?ctiid.275633; https://vuldb.com/?id.275633
CVE: CVE-2024-8113
Published: 2024-08-23
Description: Stored XSS in organizer and event settings of pretix up to 2024.7.0 allows malicious event organizers to inject HTML tags into e-mail previews on settings page. The default Content Security Policy of pretix prevents execution of attacker-provided scripts, making exploitation unlikely. However, combined with a CSP bypass (which is not currently known) the vulnerability could be used to impersonate other organizers or staff users.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://pretix.eu/about/en/blog/20240823-release-2024-7-1/
CVE: CVE-2024-42364
Published: 2024-08-23
Description: Homepage is a highly customizable homepage with Docker and service API integrations. The default setup of homepage 0.9.1 is vulnerable to DNS rebinding. Homepage is setup without certificate and authentication by default, leaving it to vulnerable to DNS rebinding. In this attack, an attacker will ask a user to visit his/her website. The attacker website will then change the DNS records of their domain from their IP address to the internal IP address of the homepage instance. To tell which IP addresses are valid, we can rebind a subdomain to each IP address we want to check, and see if there is a response. Once potential candidates have been found, the attacker can launch the attack by reading the response of the webserver after the IP address has changed. When the attacker domain is fetched, the response will be from the homepage instance, not the attacker website, because the IP address has been changed. Due to a lack of authentication, a user’s private information such as API keys (fixed after first report) and other private information can then be extracted by the attacker website.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-350, CWE-290
References: https://securitylab.github.com/advisories/GHSL-2024-096_homepage/
CVE: CVE-2024-42523
Published: 2024-08-23
Description: publiccms V4.0.202302.e and before is vulnerable to Any File Upload via publiccms/admin/cmsTemplate/saveMetaData
CVSS Score: 7.2 (HIGH)
CWE: CWE-434
References: https://gist.github.com/ilikeoyt/3dbbca2679c2551eaaeaea9c83acf1a1; https://gitee.com/sanluan/PublicCMS/issues/IADVDM
CVE: CVE-2024-42636
Published: 2024-08-23
Description: DedeCMS V5.7.115 has a command execution vulnerability via file_manage_view.php?fmdo=newfile&activepath.
CVSS Score: 7.2 (HIGH)
CWE: CWE-77
References: https://github.com/iami233/cve/issues/1
CVE: CVE-2024-42756
Published: 2024-08-23
Description: An issue in Netgear DGN1000WW v.1.1.00.45 allows a remote attacker to execute arbitrary code via the Diagnostics page
CVSS Score: 8.8 (HIGH)
CWE: CWE-94
References: https://github.com/Nop3z/CVE/blob/main/Netgear/Netgear%20DGN1000%20RCE/Netgear%20DGN1000%20RCE.md; https://www.netgear.com/about/security/
CVE: CVE-2024-43031
Published: 2024-08-23
Description: autMan v2.9.6 was discovered to contain an access control issue.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-121, CWE-284
References: http://autman.com; https://github.com/hdbjlizhe/fanli