deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-11016
Published: 2024-11-11
Description: Webopac from Grand Vice info has a SQL Injection vulnerability, allowing unauthenticated remote attacks to inject arbitrary SQL commands to read, modify, and delete database contents.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://www.twcert.org.tw/en/cp-139-8210-46322-2.html; https://www.twcert.org.tw/tw/cp-132-8209-bf75d-1.html
CVE: CVE-2024-11017
Published: 2024-11-11
Description: Webopac from Grand Vice info does not properly validate uploaded file types, allowing remote attackers with regular privileges to upload and execute webshells, which could lead to arbitrary code execution on the server.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434
References: https://www.twcert.org.tw/en/cp-139-8212-a7d3a-2.html; https://www.twcert.org.tw/tw/cp-132-8211-a2da2-1.html
CVE: CVE-2024-11018
Published: 2024-11-11
Description: Webopac from Grand Vice info does not properly validate uploaded file types, allowing unauthenticated remote attackers to upload and execute webshells, which could lead to arbitrary code execution on the server.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://www.twcert.org.tw/en/cp-139-8214-64fa2-2.html; https://www.twcert.org.tw/tw/cp-132-8213-3413b-1.html
CVE: CVE-2024-11019
Published: 2024-11-11
Description: Webopac from Grand Vice info has a Reflected Cross-site Scripting vulnerability, allowing unauthenticated remote attackers to execute arbitrary JavaScript code in the user's browser through phishing techniques.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.twcert.org.tw/en/cp-139-8216-f7dbf-2.html; https://www.twcert.org.tw/tw/cp-132-8215-98582-1.html
CVE: CVE-2024-52350
Published: 2024-11-11
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in nrmendez CRM 2go crm2go allows DOM-Based XSS.This issue affects CRM 2go: from n/a through <= 1.0.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/crm2go/vulnerability/wordpress-crm-2go-plugin-1-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-52351
Published: 2024-11-11
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BU Web Team BU Slideshow bu-slideshow allows Stored XSS.This issue affects BU Slideshow: from n/a through <= 2.3.10.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/bu-slideshow/vulnerability/wordpress-bu-slideshow-plugin-2-3-10-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-52352
Published: 2024-11-11
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in miloandrew Postcasa Shortcode postcasa allows DOM-Based XSS.This issue affects Postcasa Shortcode: from n/a through <= 1.0.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/postcasa/vulnerability/wordpress-postcasa-shortcode-plugin-1-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-52353
Published: 2024-11-11
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Gabriel Serafini Christian Science Bible Lesson Subjects christian-science-bible-lesson-subjects allows DOM-Based XSS.This issue affects Christian Science Bible Lesson Subjects: from n/a through <= 2.0.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/christian-science-bible-lesson-subjects/vulnerability/wordpress-christian-science-bible-lesson-subjects-plugin-2-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-52354
Published: 2024-11-11
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Cool Plugins Web Stories Widgets For Elementor shortcodes-for-amp-web-stories-and-elementor-widget allows Stored XSS.This issue affects Web Stories Widgets For Elementor: from n/a through <= 1.1.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/shortcodes-for-amp-web-stories-and-elementor-widget/vulnerability/wordpress-web-stories-widgets-for-elementor-plugin-1-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-52355
Published: 2024-11-11
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in MiKa OSM osm.This issue affects OSM: from n/a through <= 6.1.2.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/osm/vulnerability/wordpress-osm-openstreetmap-plugin-6-1-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-11020
Published: 2024-11-11
Description: Webopac from Grand Vice info has a SQL Injection vulnerability, allowing unauthenticated remote attacks to inject arbitrary SQL commands to read, modify, and delete database contents.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://www.twcert.org.tw/en/cp-139-8218-e238b-2.html; https://www.twcert.org.tw/tw/cp-132-8217-05b42-1.html
CVE: CVE-2024-11021
Published: 2024-11-11
Description: Webopac from Grand Vice info has Stored Cross-site Scripting vulnerability. Remote attackers with regular privileges can inject arbitrary JavaScript code into the server. When users visit the compromised page, the code is automatically executed in their browser.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.twcert.org.tw/en/cp-139-8220-e75c2-2.html; https://www.twcert.org.tw/tw/cp-132-8219-f12d0-1.html
CVE: CVE-2024-11062
Published: 2024-11-11
Description: The D-Link DSL6740C modem has an OS Command Injection vulnerability, allowing remote attackers with administrator privileges to inject and execute arbitrary system commands through a specific functionality provided by SSH and Telnet.
CVSS Score: 7.2 (HIGH)
CWE: CWE-78
References: https://www.twcert.org.tw/en/cp-139-8228-1fbb0-2.html; https://www.twcert.org.tw/tw/cp-132-8221-601c3-1.html
CVE: CVE-2024-11063
Published: 2024-11-11
Description: The D-Link DSL6740C modem has an OS Command Injection vulnerability, allowing remote attackers with administrator privileges to inject and execute arbitrary system commands through a specific functionality provided by SSH and Telnet.
CVSS Score: 7.2 (HIGH)
CWE: CWE-78
References: https://www.twcert.org.tw/en/cp-139-8229-3c2ab-2.html; https://www.twcert.org.tw/tw/cp-132-8222-eb5bb-1.html
CVE: CVE-2024-11064
Published: 2024-11-11
Description: The D-Link DSL6740C modem has an OS Command Injection vulnerability, allowing remote attackers with administrator privileges to inject and execute arbitrary system commands through a specific functionality provided by SSH and Telnet.
CVSS Score: 7.2 (HIGH)
CWE: CWE-78
References: https://www.twcert.org.tw/en/cp-139-8230-11430-2.html; https://www.twcert.org.tw/tw/cp-132-8223-f6da0-1.html
CVE: CVE-2024-11065
Published: 2024-11-11
Description: The D-Link DSL6740C modem has an OS Command Injection vulnerability, allowing remote attackers with administrator privileges to inject and execute arbitrary system commands through a specific functionality provided by SSH and Telnet.
CVSS Score: 7.2 (HIGH)
CWE: CWE-78
References: https://www.twcert.org.tw/en/cp-139-8231-2432e-2.html; https://www.twcert.org.tw/tw/cp-132-8224-d939e-1.html
CVE: CVE-2024-11066
Published: 2024-11-11
Description: The D-Link DSL6740C modem has an OS Command Injection vulnerability, allowing remote attackers with administrator privileges to inject and execute arbitrary system commands through the specific web page.
CVSS Score: 7.2 (HIGH)
CWE: CWE-78
References: https://www.twcert.org.tw/en/cp-139-8232-5d94e-2.html; https://www.twcert.org.tw/tw/cp-132-8225-3d882-1.html; https://www.bleepingcomputer.com/news/security/d-link-wont-fix-critical-bug-in-60-000-exposed-eol-modems/
CVE: CVE-2024-11067
Published: 2024-11-11
Description: The D-Link DSL6740C modem has a Path Traversal Vulnerability, allowing unauthenticated remote attackers to exploit this vulnerability to read arbitrary system files. Additionally, since the device's default password is a combination of the MAC address, attackers can obtain the MAC address through this vulnerability and attempt to log in to the device using the default password.
CVSS Score: 7.5 (HIGH)
CWE: CWE-23
References: https://www.twcert.org.tw/en/cp-139-8233-903d9-2.html; https://www.twcert.org.tw/tw/cp-132-8226-0b07b-1.html; https://www.bleepingcomputer.com/news/security/d-link-wont-fix-critical-bug-in-60-000-exposed-eol-modems/
CVE: CVE-2024-11068
Published: 2024-11-11
Description: The D-Link DSL6740C modem has an Incorrect Use of Privileged APIs vulnerability, allowing unauthenticated remote attackers to modify any user’s password by leveraging the API, thereby granting access to Web, SSH, and Telnet services using that user’s account.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-648
References: https://www.twcert.org.tw/en/cp-139-8234-0514c-2.html; https://www.twcert.org.tw/tw/cp-132-8227-f3f3b-1.html; https://www.bleepingcomputer.com/news/security/d-link-wont-fix-critical-bug-in-60-000-exposed-eol-modems/
CVE: CVE-2024-43427
Published: 2024-11-11
Description: A flaw was found in moodle. When creating an export of site administration presets, some sensitive secrets and keys are not being excluded from the export, which could result in them unintentionally being leaked if the presets are shared with a third party.
CVSS Score: 3.7 (LOW)
CWE: CWE-922
References: https://bugzilla.redhat.com/show_bug.cgi?id=2304255; https://moodle.org/mod/forum/discuss.php?d=461195
CVE: CVE-2024-43429
Published: 2024-11-11
Description: A flaw was found in moodle. Some hidden user profile fields are visible in gradebook reports, which could result in users without the "view hidden user fields" capability having access to the information.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-312
References: https://bugzilla.redhat.com/show_bug.cgi?id=2304257; https://moodle.org/mod/forum/discuss.php?d=461197
CVE: CVE-2024-43430
Published: 2024-11-11
Description: A flaw was found in moodle. External API access to Quiz can override contained insufficient access control.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-276
References: https://bugzilla.redhat.com/show_bug.cgi?id=2304258; https://moodle.org/mod/forum/discuss.php?d=461198
CVE: CVE-2024-43432
Published: 2024-11-11
Description: A flaw was found in moodle. The cURL wrapper in Moodle strips HTTPAUTH and USERPWD headers during emulated redirects, but retains other original request headers, so HTTP authorization header information could be unintentionally sent in requests to redirect URLs.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-319
References: https://bugzilla.redhat.com/show_bug.cgi?id=2304260; https://moodle.org/mod/forum/discuss.php?d=461200
CVE: CVE-2024-43433
Published: 2024-11-11
Description: A flaw was found in moodle. Matrix room membership and power levels are incorrectly applied and revoked for suspended Moodle users.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-863
References: https://bugzilla.redhat.com/show_bug.cgi?id=2304261; https://moodle.org/mod/forum/discuss.php?d=461202
CVE: CVE-2024-43435
Published: 2024-11-11
Description: A flaw was found in moodle. Insufficient capability checks make it possible for users with access to restore glossaries in courses to restore them into the global site glossary.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-754
References: https://bugzilla.redhat.com/show_bug.cgi?id=2304263; https://moodle.org/mod/forum/discuss.php?d=461205
CVE: CVE-2024-43437
Published: 2024-11-11
Description: A flaw was found in moodle. Insufficient sanitizing of data when performing a restore could result in a cross-site scripting (XSS) risk from malicious backup files.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://bugzilla.redhat.com/show_bug.cgi?id=2304266; https://moodle.org/mod/forum/discuss.php?d=461207
CVE: CVE-2024-10314
Published: 2024-11-11
Description: In Helix Core versions prior to 2024.2, an unauthenticated remote Denial of Service (DoS) via the auto-generation function was identified.  Reported by Karol Więsek.
CWE: CWE-400
References: https://portal.perforce.com/s/detail/a91PA000001SZNFYA4
CVE: CVE-2024-10344
Published: 2024-11-11
Description: In Helix Core versions prior to 2024.2, an unauthenticated remote Denial of Service (DoS) via the refuse function was identified.  Reported by Karol Więsek.
CWE: CWE-400
References: https://portal.perforce.com/s/detail/a91PA000001SZOrYAO
CVE: CVE-2024-10345
Published: 2024-11-11
Description: In Helix Core versions prior to 2024.2, an unauthenticated remote Denial of Service (DoS) via the shutdown function was identified.  Reported by Karol Więsek.
CWE: CWE-400
References: https://portal.perforce.com/s/detail/a91PA000001SZQTYA4
CVE: CVE-2024-34014
Published: 2024-11-11
Description: Arbitrary file overwrite during recovery due to improper symbolic link handling. The following products are affected: Acronis Backup plugin for cPanel & WHM (Linux) before build 1.8.3.818, Acronis Backup plugin for cPanel & WHM (Linux) before build 1.9.1.892, Acronis Backup extension for Plesk (Linux) before build 1.8.6.599, Acronis Backup plugin for DirectAdmin (Linux) before build 1.2.2.181.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-61
References: https://security-advisory.acronis.com/advisories/SEC-7592
CVE: CVE-2024-34015
Published: 2024-11-11
Description: Sensitive information disclosure during file browsing due to improper symbolic link handling. The following products are affected: Acronis Backup plugin for cPanel & WHM (Linux) before build 1.8.3.818, Acronis Backup plugin for cPanel & WHM (Linux) before build 1.9.1.892.
CVSS Score: 3.3 (LOW)
CWE: CWE-61
References: https://security-advisory.acronis.com/advisories/SEC-7601
CVE: CVE-2024-50263
Published: 2024-11-11
Description: In the Linux kernel, the following vulnerability has been resolved:

fork: only invoke khugepaged, ksm hooks if no error

There is no reason to invoke these hooks early against an mm that is in an
incomplete state.

The change in commit d[PII_REDACTED]7 ("fork: use __mt_dup() to duplicate
maple tree in dup_mmap()") makes this more pertinent as we may be in a
state where entries in the maple tree are not yet consistent.

Their placement early in dup_mmap() only appears to have been meaningful
for early error checking, and since functionally it'd require a very small
allocation to fail (in practice 'too small to fail') that'd only occur in
the most dire circumstances, meaning the fork would fail or be OOM'd in
any case.

Since both khugepaged and KSM tracking are there to provide optimisations
to memory performance rather than critical functionality, it doesn't
really matter all that much if, under such dire memory pressure, we fail
to register an mm with these.

As a result, we follow the example of commit d2081b2bf819 ("mm:
khugepaged: make khugepaged_enter() void function") and make ksm_fork() a
void function also.

We only expose the mm to these functions once we are done with them and
only if no error occurred in the fork operation.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/3b85aa0da8cd01173b9afd1f70080fbb9576c4b0; https://git.kernel.org/stable/c/985da552a98e[PII_REDACTED]8ce5d[PII_REDACTED]11f; https://project-zero.issues.chromium.org/issues/373391951
CVE: CVE-2024-11070
Published: 2024-11-11
Description: A vulnerability, which was classified as problematic, has been found in Sanluan PublicCMS 5.202406.d. This issue affects some unknown processing of the file /admin/cmsTagType/save of the component Tag Type Handler. The manipulation of the argument name leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-94, CWE-79
References: https://gitee.com/sanluan/PublicCMS/issues/IB1Q5J; https://vuldb.com/?ctiid.283853; https://vuldb.com/?id.283853
CVE: CVE-2024-39354
Published: 2024-11-11
Description: If an attacker tricks a valid user into running Delta Electronics DIAScreen with a file containing malicious code, a stack-based buffer overflow in CEtherIPTagItem can be exploited, allowing the attacker to remotely execute arbitrary code.
CVSS Score: 7.8 (HIGH)
CWE: CWE-121, CWE-787
References: https://www.cisa.gov/news-events/ics-advisories/icsa-24-312-02; https://www.deltaww.com/en-US/Cybersecurity_Advisory
CVE: CVE-2024-39605
Published: 2024-11-11
Description: If an attacker tricks a valid user into running Delta Electronics DIAScreen with a file containing malicious code, a stack-based buffer overflow in BACnetParameter can be exploited, allowing the attacker to remotely execute arbitrary code.
CVSS Score: 7.8 (HIGH)
CWE: CWE-121, CWE-787
References: https://www.cisa.gov/news-events/ics-advisories/icsa-24-312-02; https://www.deltaww.com/en-US/Cybersecurity_Advisory
CVE: CVE-2024-47131
Published: 2024-11-11
Description: If an attacker tricks a valid user into running Delta Electronics DIAScreen with a file containing malicious code, a stack-based buffer overflow in BACnetObjectInfo can be exploited, allowing the attacker to remotely execute arbitrary code.
CVSS Score: 7.8 (HIGH)
CWE: CWE-121, CWE-787
References: https://www.cisa.gov/news-events/ics-advisories/icsa-24-312-02; https://www.deltaww.com/en-US/Cybersecurity_Advisory
CVE: CVE-2024-50989
Published: 2024-11-11
Description: A SQL injection vulnerability in /omrs/admin/search.php in PHPGurukul Online Marriage Registration System v1.0 allows an attacker to execute arbitrary SQL commands via the "searchdata " parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/vkcyberexpert/CVE-Writeup/blob/main/PHPGurukul/Marriage%20Registration/SQL%20Injction.pdf.pdf
CVE: CVE-2024-50990
Published: 2024-11-11
Description: A Reflected Cross Site Scriptng (XSS) vulnerability was found in /omrs/user/search.php in PHPGurukul Online Marriage Registration System v1.0, which allows remote attackers to execute arbitrary code via the "searchdata" POST request parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/vkcyberexpert/CVE-Writeup/blob/main/PHPGurukul/Marriage%20Registration/Marriage%20reflected%20in%20userpage.pdf
CVE: CVE-2024-50991
Published: 2024-11-11
Description: A Cross Site Scripting (XSS) vulnerability was found in /ums-sp/admin/registered-users.php in PHPGurukul User Management System v1.0, which allows remote attackers to execute arbitrary code via the "fname" POST request parameter
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/vkcyberexpert/CVE-Writeup/blob/main/PHPGurukul/User%20Management/Ums%20%20XSS%20pdf.pdf
CVE: CVE-2024-51054
Published: 2024-11-11
Description: A Cross Site Scriptng (XSS) vulnerability was found in /omrs/admin/search.php in PHPGurukul Online Marriage Registration System 1.0, which allows remote attackers to execute arbitrary code via the "searchdata" POST request parameter.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/vkcyberexpert/CVE-Writeup/blob/main/PHPGurukul/Marriage%20Registration/Reflected%20Cross%20Site%20Scriptng%20o.pdf
CVE: CVE-2024-43439
Published: 2024-11-11
Description: A flaw was found in moodle. H5P error messages require additional sanitizing to prevent a reflected cross-site scripting (XSS) risk.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://bugzilla.redhat.com/show_bug.cgi?id=2304268; https://moodle.org/mod/forum/discuss.php?d=461209
CVE: CVE-2024-45088
Published: 2024-11-11
Description: IBM Maximo Asset Management 7.6.1.3 is vulnerable to stored cross-site scripting. This vulnerability allows authenticated users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://www.ibm.com/support/pages/node/7174818
CVE: CVE-2024-10917
Published: 2024-11-11
Description: In Eclipse OpenJ9 versions up to 0.47, the JNI function GetStringUTFLength may return an incorrect value which has wrapped around. From 0.48 the value is correct but may be truncated to include a smaller number of characters.
CVSS Score: 3.7 (LOW)
CWE: CWE-190, CWE-190
References: https://github.com/eclipse-openj9/openj9/pull/20362; https://github.com/eclipse-openj9/openj9/releases/tag/openj9-0.48.0; https://gitlab.eclipse.org/security/cve-assignement/-/issues/47
CVE: CVE-2024-11073
Published: 2024-11-11
Description: A vulnerability classified as problematic has been found in SourceCodester Hospital Management System 1.0. This affects an unknown part of the file /vm/patient/delete-account.php. The manipulation of the argument id leads to improper authorization. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-266, CWE-285, CWE-639
References: https://drive.google.com/file/d/1yFo0re8taTry7oR4-EDg3UHwO2lkqO9N/view?usp=sharing; https://github.com/Salah-Tayeh/CVEs-and-Vulnerabilities/blob/main/Hospital%20Management%20System%20-%20IDOR%20Causing%20Deletion%20of%20any%20patient%20account.md; https://vuldb.com/?ctiid.283869
CVE: CVE-2024-45087
Published: 2024-11-11
Description: IBM WebSphere Application Server 8.5 and 9.0 is vulnerable to cross-site scripting. This vulnerability allows a privileged user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.ibm.com/support/pages/node/7175393
CVE: CVE-2024-11074
Published: 2024-11-11
Description: A vulnerability classified as critical was found in itsourcecode Tailoring Management System 1.0. This vulnerability affects unknown code of the file /incadd.php. The manipulation of the argument inccat/desc/date/amount leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The initial researcher advisory only mentions the parameter "inccat" to be affected. But it must be assumed "desc", "date", and "amount" are affected as well.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/dimongshi/cve/issues/1; https://itsourcecode.com/; https://vuldb.com/?ctiid.283870
CVE: CVE-2024-11076
Published: 2024-11-11
Description: A vulnerability, which was classified as critical, has been found in code-projects Job Recruitment 1.0. This issue affects some unknown processing of the file /activation.php. The manipulation of the argument e_hash leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://code-projects.org/; https://github.com/UnrealdDei/cve/blob/main/sql2-rce.md; https://vuldb.com/?ctiid.283871
CVE: CVE-2024-11077
Published: 2024-11-11
Description: A vulnerability, which was classified as critical, was found in code-projects Job Recruitment 1.0. Affected is an unknown function of the file /index.php. The manipulation of the argument email leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://code-projects.org/; https://github.com/UnrealdDei/cve/blob/main/sql3.md; https://vuldb.com/?ctiid.283872
CVE: CVE-2024-50667
Published: 2024-11-11
Description: The boa httpd of Trendnet TEW-820AP 1.01.B01 has a stack overflow vulnerability in /boafrm/formIPv6Addr, /boafrm/formIpv6Setup, /boafrm/formDnsv6. The reason is that the check of ipv6 address is not sufficient, which allows attackers to construct payloads for attacks.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120
References: https://github.com/ixout/iotVuls/blob/main/Trendnet/TEW_820/report.md; https://www.trendnet.com/support/support-detail.asp?prod=100_TEW-820AP