deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-49320
Published: 2024-10-17
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dennis Encyclopedia / Glossary / Wiki encyclopedia-lexicon-glossary-wiki-dictionary allows Reflected XSS.This issue affects Encyclopedia / Glossary / Wiki: from n/a through <= 1.7.60.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/encyclopedia-lexicon-glossary-wiki-dictionary/vulnerability/wordpress-encyclopedia-glossary-wiki-plugin-1-7-60-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-6728
Published: 2024-10-17
Description: Nokia SR OS bof.cfg file encryption is vulnerable to a brute force attack. This weakness allows an attacker in possession of the encrypted file to decrypt the bof.cfg file and obtain the BOF configuration content.
CVSS Score: 3.3 (LOW)
CWE: CWE-326
References: https://www.nokia.com/about-us/security-and-privacy/product-security-advisory/cve-2023-6728/
CVE: CVE-2023-6729
Published: 2024-10-17
Description: Nokia SR OS routers allow read-write access to the entire file system via SFTP or SCP for users configured with "access console." Consequently, a low privilege authenticated user with "access console" can read or replace the router configuration file as well as other files stored in the Compact Flash or SD card without using CLI commands. This type of attack can lead to a compromise or denial of service of the router after the system is rebooted.
CVSS Score: 7.3 (HIGH)
CWE: CWE-732
References: https://www.nokia.com/about-us/security-and-privacy/product-security-advisory/cve-2023-6729/
CVE: CVE-2024-48021
Published: 2024-10-17
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Scott Paterson Contact Form 7 – PayPal & Stripe Add-on contact-form-7-paypal-add-on allows Reflected XSS.This issue affects Contact Form 7 – PayPal & Stripe Add-on: from n/a through <= 2.3.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/contact-form-7-paypal-add-on/vulnerability/wordpress-contact-form-7-paypal-stripe-add-on-plugin-2-3-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-48022
Published: 2024-10-17
Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in SysBasics Shortcode For Elementor Templates allows Stored XSS.This issue affects Shortcode For Elementor Templates: from n/a through 1.0.0.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/shortcode-support-for-elementor-templates/wordpress-shortcode-for-elementor-templates-plugin-1-0-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-48023
Published: 2024-10-17
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in rconnect305 Restaurant Reservations Widget restaurantconnect-reswidget allows Reflected XSS.This issue affects Restaurant Reservations Widget: from n/a through <= 1.0.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/restaurantconnect-reswidget/vulnerability/wordpress-restaurant-reservations-widget-plugin-1-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-48025
Published: 2024-10-17
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in dogrow Simple Baseball Scoreboard simple-baseball-scoreboard allows Stored XSS.This issue affects Simple Baseball Scoreboard: from n/a through <= 1.3.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/simple-baseball-scoreboard/vulnerability/wordpress-simple-baseball-scoreboard-plugin-1-3-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-48031
Published: 2024-10-17
Description: Cross-Site Request Forgery (CSRF) vulnerability in sumitsurai Featured Posts with Multiple Custom Groups (FPMCG) featured-posts-with-multiple-custom-groups-fpmcg allows Cross Site Request Forgery.This issue affects Featured Posts with Multiple Custom Groups (FPMCG): from n/a through <= 4.0.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/featured-posts-with-multiple-custom-groups-fpmcg/vulnerability/wordpress-featured-posts-with-multiple-custom-groups-fpmcg-plugin-4-0-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2024-48032
Published: 2024-10-17
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sumitsurai Featured Posts with Multiple Custom Groups (FPMCG) featured-posts-with-multiple-custom-groups-fpmcg allows Reflected XSS.This issue affects Featured Posts with Multiple Custom Groups (FPMCG): from n/a through <= 4.0.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/featured-posts-with-multiple-custom-groups-fpmcg/vulnerability/wordpress-featured-posts-with-multiple-custom-groups-fpmcg-plugin-4-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-48036
Published: 2024-10-17
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sonalsinha21 SKT Blocks skt-blocks.This issue affects SKT Blocks: from n/a through <= 1.6.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/skt-blocks/vulnerability/wordpress-skt-blocks-plugin-1-6-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-48037
Published: 2024-10-17
Description: Cross-Site Request Forgery (CSRF) vulnerability in A WP Life Contact Form Widget new-contact-form-widget allows Cross Site Request Forgery.This issue affects Contact Form Widget: from n/a through <= 1.4.2.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/new-contact-form-widget/vulnerability/wordpress-contact-form-widget-contact-query-contact-page-form-maker-query-table-plugin-1-4-2-csrf-vulnerability?_s_id=cve
CVE: CVE-2024-48046
Published: 2024-10-17
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in supsystic Contact Form by Supsystic contact-form-by-supsystic allows Stored XSS.This issue affects Contact Form by Supsystic: from n/a through <= 1.7.28.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/contact-form-by-supsystic/vulnerability/wordpress-contact-form-by-supsystic-plugin-1-7-28-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-48048
Published: 2024-10-17
Description: Cross-Site Request Forgery (CSRF) vulnerability in GabbyKhrmon Wsify Widget wsify-widget allows Stored XSS.This issue affects Wsify Widget: from n/a through <= 1.0.
CVSS Score: 7.1 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/wsify-widget/vulnerability/wordpress-wsify-widget-plugin-1-0-csrf-to-stored-xss-vulnerability?_s_id=cve
CVE: CVE-2024-49579
Published: 2024-10-17
Description: In JetBrains YouTrack before 2024.3.47197 insecure plugin iframe allowed arbitrary JavaScript execution and unauthorized API requests
CVSS Score: 8.1 (HIGH)
CWE: CWE-940
References: https://www.jetbrains.com/privacy-security/issues-fixed/
CVE: CVE-2024-49580
Published: 2024-10-17
Description: In JetBrains Ktor before 2.3.13 improper caching in HttpCache Plugin could lead to response information disclosure
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-524
References: https://www.jetbrains.com/privacy-security/issues-fixed/
CVE: CVE-2005-10003
Published: 2024-10-17
Description: A vulnerability classified as critical has been found in mikexstudios Xcomic up to 0.8.2. This affects an unknown part. The manipulation of the argument cmd leads to os command injection. It is possible to initiate the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. Upgrading to version 0.8.3 is able to address this issue. The patch is named 6ed8e3cc336e29f09c7e791863d0559939da98bf. It is recommended to upgrade the affected component.
CVSS Score: 5.6 (MEDIUM)
CWE: CWE-78
References: http://xcomic.mikexstudios.com/forum/viewtopic.php?id=130; https://github.com/mikexstudios/xcomic/commit/6ed8e3cc336e29f09c7e791863d0559939da98bf; https://github.com/mikexstudios/xcomic/releases/tag/v0.8.3
CVE: CVE-2024-49315
Published: 2024-10-17
Description: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in CodeFlock FREE DOWNLOAD MANAGER free-download-manager allows Path Traversal.This issue affects FREE DOWNLOAD MANAGER: from n/a through <= 1.0.0.
CVSS Score: 8.6 (HIGH)
CWE: CWE-22
References: https://patchstack.com/database/Wordpress/Plugin/free-download-manager/vulnerability/wordpress-free-download-manager-plugin-1-0-0-arbitrary-file-deletion-vulnerability?_s_id=cve
CVE: CVE-2024-6333
Published: 2024-10-17
Description: Authenticated Remote Code Execution in Altalink, Versalink & WorkCentre Products.
CVSS Score: 7.2 (HIGH)
CWE: CWE-77, CWE-78
References: https://securitydocs.business.xerox.com/wp-content/uploads/2024/10/Xerox-Security-Bulletin-XRX24-015-for-Altalink-Versalink-and-WorkCentre-%E2%80%93-CVE-2024-6333-.pdf; http://seclists.org/fulldisclosure/2024/Oct/17
CVE: CVE-2024-10069
Published: 2024-10-17
Description: A vulnerability was found in ESAFENET CDG 5. It has been rated as critical. Affected by this issue is the function actionPassMainApplication of the file /com/esafenet/servlet/client/MailDecryptApplicationService.java. The manipulation of the argument id leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://flowus.cn/share/20a4440e-1268-4df1-ab95-8583b450b7c4?code=G8A6P3; https://vuldb.com/?ctiid.280718; https://vuldb.com/?id.280718
CVE: CVE-2024-10070
Published: 2024-10-17
Description: A vulnerability classified as critical has been found in ESAFENET CDG 5. This affects the function actionPolicyPush of the file /com/esafenet/policy/action/PolicyPushControlAction.java. The manipulation of the argument policyId leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://flowus.cn/share/b2afb61c-cdbe-4303-b799-f7c82a9643fb?code=G8A6P3; https://vuldb.com/?ctiid.280719; https://vuldb.com/?id.280719
CVE: CVE-2024-47459
Published: 2024-10-17
Description: Substance3D - Sampler versions 4.5 and earlier are affected by a NULL Pointer Dereference vulnerability that could lead to an application denial-of-service (DoS) condition. An attacker could exploit this vulnerability to crash the application, resulting in a DoS. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://helpx.adobe.com/security/products/substance3d-sampler/apsb24-65.html
CVE: CVE-2024-48920
Published: 2024-10-17
Description: PutongOJ is online judging software. Prior to version 2.1.0-beta.1, unprivileged users can escalate privileges by constructing requests. This can lead to unauthorized access, enabling users to perform admin-level operations, potentially compromising sensitive data and system integrity. This problem has been fixed in v2.1.0.beta.1. As a workaround, one may apply the patch from commit `211dfe9` manually.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-306
References: https://github.com/acm309/PutongOJ/commit/211dfe9ebf1c6618ce5396b0338de4f9b580715e#diff-782628b47d666d5d551e040815ca3f80c[PII_REDACTED]718f0e0f31164608ea7beL118-R120; https://github.com/acm309/PutongOJ/releases/tag/v2.1.0-beta.1; https://github.com/acm309/PutongOJ/security/advisories/GHSA-gj6h-73c5-xw6f
CVE: CVE-2024-9683
Published: 2024-10-17
Description: A vulnerability was found in Quay, which allows successful authentication even when a truncated password version is provided. This flaw affects the authentication mechanism, reducing the overall security of password enforcement.  While the risk is relatively low due to the typical length of the passwords used (73 characters), this vulnerability can still be exploited to reduce the complexity of brute-force or password-guessing attacks. The truncation of passwords weakens the overall authentication process, thereby reducing the effectiveness of password policies and potentially increasing the risk of unauthorized access in the future.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-305, CWE-287
References: https://access.redhat.com/security/cve/CVE-2024-9683; https://bugzilla.redhat.com/show_bug.cgi?id=2317559
CVE: CVE-2018-25104
Published: 2024-10-17
Description: A vulnerability was found in CoinGate Plugin up to 1.2.7 on PrestaShop. It has been rated as problematic. Affected by this issue is the function postProcess of the file modules/coingate/controllers/front/callback.php of the component Payment Handler. The manipulation leads to business logic errors. The attack may be launched remotely. Upgrading to version 1.2.8 is able to address this issue. The patch is identified as 0a3097db0aec7c5d66686c142c6abaa1e126ca16. It is recommended to upgrade the affected component.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-840
References: https://github.com/coingate/prestashop-plugin/commit/0a3097db0aec7c5d66686c142c6abaa1e126ca16; https://github.com/coingate/prestashop-plugin/releases/tag/v1.2.8; https://vuldb.com/?ctiid.280358
CVE: CVE-2024-10071
Published: 2024-10-17
Description: A vulnerability classified as critical was found in ESAFENET CDG 5. This vulnerability affects the function actionUpdateEncryptPolicyEdit of the file /com/esafenet/servlet/policy/EncryptPolicyService.java. The manipulation of the argument encryptPolicyId leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://flowus.cn/share/d1a29ce2-346c-4a8e-836a-e9533c32fad1?code=G8A6P3; https://vuldb.com/?ctiid.280720; https://vuldb.com/?id.280720
CVE: CVE-2024-9414
Published: 2024-10-17
Description: In LAquis SCADA version 4.7.1.511, a cross-site scripting vulnerability could allow an attacker to inject arbitrary code into a web page. This could allow an attacker to steal cookies, redirect users, or perform unauthorized actions.
CWE: CWE-79
References: https://www.cisa.gov/news-events/ics-advisories/icsa-24-291-02
CVE: CVE-2024-10072
Published: 2024-10-17
Description: A vulnerability, which was classified as critical, has been found in ESAFENET CDG 5. This issue affects the function actionAddEncryptPolicyGroup of the file /com/esafenet/servlet/policy/EncryptPolicyService.java. The manipulation of the argument checklist leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://flowus.cn/share/dd690c21-bb5c-4db4-a737-afb2cf54c8e1?code=G8A6P3; https://vuldb.com/?ctiid.280721; https://vuldb.com/?id.280721
CVE: CVE-2024-10073
Published: 2024-10-17
Description: A vulnerability, which was classified as critical, was found in flairNLP flair 0.14.0. Affected is the function ClusteringModel of the file flair\models\clustering.py of the component Mode File Loader. The manipulation leads to code injection. It is possible to launch the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-94
References: https://github.com/bayuncao/vul-cve-20; https://github.com/bayuncao/vul-cve-20/blob/main/PoC.py; https://vuldb.com/?ctiid.280722
CVE: CVE-2024-48192
Published: 2024-10-17
Description: Tenda G3 v15.01.0.5(2848_755)_EN was discovered to contain a hardcoded password vulnerability in /etc_ro/shadow, which allows attackers to log in as root
CVSS Score: 8.0 (HIGH)
CWE: CWE-798
References: https://colorful-meadow-5b9.notion.site/G3_HardCode_vuln-6b5ae19473b745d7abe5e01b4529caf8?pvs=4
CVE: CVE-2024-49396
Published: 2024-10-17
Description: The affected product is vulnerable due to insufficiently protected credentials, which may allow an attacker to impersonate Elvaco and send false information.
CWE: CWE-522
References: https://www.cisa.gov/news-events/ics-advisories/icsa-24-291-01
CVE: CVE-2024-49397
Published: 2024-10-17
Description: The affected product is vulnerable to a cross-site scripting attack which may allow an attacker to bypass authentication and takeover admin accounts.
CWE: CWE-79
References: https://www.cisa.gov/news-events/ics-advisories/icsa-24-291-01
CVE: CVE-2024-49398
Published: 2024-10-17
Description: The affected product is vulnerable to unrestricted file uploads, which may allow an attacker to remotely execute code.
CWE: CWE-434
References: https://www.cisa.gov/news-events/ics-advisories/icsa-24-291-01
CVE: CVE-2024-49399
Published: 2024-10-17
Description: The affected product is vulnerable to an attacker being able to use commands without providing a password which may allow an attacker to leak information.
CWE: CWE-306
References: https://www.cisa.gov/news-events/ics-advisories/icsa-24-291-01
CVE: CVE-2024-43997
Published: 2024-10-17
Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in easy.Jobs EasyJobs allows Reflected XSS.This issue affects EasyJobs: from n/a through 2.4.14.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/easyjobs/wordpress-easy-jobs-best-recruitment-plugin-for-job-board-listing-manager-career-page-for-elementor-gutenberg-plugin-2-4-14-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-47304
Published: 2024-10-17
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Shahjahan Jewel Fluent Support fluent-support allows SQL Injection.This issue affects Fluent Support: from n/a through <= 1.8.0.
CVSS Score: 8.5 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/Wordpress/Plugin/fluent-support/vulnerability/wordpress-fluent-support-plugin-1-8-0-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2024-47312
Published: 2024-10-17
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WP Grim Classic Editor and Classic Widgets classic-editor-and-classic-widgets allows SQL Injection.This issue affects Classic Editor and Classic Widgets: from n/a through <= 1.4.1.
CVSS Score: 8.5 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/Wordpress/Plugin/classic-editor-and-classic-widgets/vulnerability/wordpress-classic-editor-and-classic-widgets-plugin-1-4-1-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2024-48629
Published: 2024-10-17
Description: D-Link DIR_882_FW130B06 and DIR_878 DIR_878_FW130B08 were discovered to contain a command injection vulnerability via the IPAddress parameter in the SetGuestZoneRouterSettings function. This vulnerability allows attackers to execute arbitrary OS commands via a crafted POST request.
CVSS Score: 8.0 (HIGH)
CWE: CWE-78
References: https://github.com/pjqwudi1/my_vuln/blob/main/D-link4/vuln_34/34.md; https://www.dlink.com/en/security-bulletin/
CVE: CVE-2024-48630
Published: 2024-10-17
Description: D-Link DIR_882_FW130B06 and DIR_878 DIR_878_FW130B08 were discovered to contain a command injection vulnerability via the MacAddress parameter in the SetMACFilters2 function. This vulnerability allows attackers to execute arbitrary OS commands via a crafted POST request.
CVSS Score: 8.0 (HIGH)
CWE: CWE-78
References: https://github.com/pjqwudi1/my_vuln/blob/main/D-link4/vuln_41/41.md; https://www.dlink.com/en/security-bulletin/
CVE: CVE-2024-48631
Published: 2024-10-17
Description: D-Link DIR_882_FW130B06 and DIR_878 DIR_878_FW130B08 were discovered to contain a command injection vulnerability via the SSID parameter in the SetWLanRadioSettings function. This vulnerability allows attackers to execute arbitrary OS commands via a crafted POST request.
CVSS Score: 8.0 (HIGH)
CWE: CWE-78
References: https://github.com/pjqwudi1/my_vuln/blob/main/D-link4/vuln_32/32.md; https://www.dlink.com/en/security-bulletin/
CVE: CVE-2024-48632
Published: 2024-10-17
Description: D-Link DIR_882_FW130B06 and DIR_878 DIR_878_FW130B08 were discovered to contain multiple command injection vulnerabilities via the LocalIPAddress, TCPPorts, and UDPPorts parameters in the SetPortForwardingSettings function. This vulnerability allows attackers to execute arbitrary OS commands via a crafted POST request.
CVSS Score: 8.0 (HIGH)
CWE: CWE-78
References: https://github.com/pjqwudi1/my_vuln/blob/main/D-link4/vuln_39/39.md; https://www.dlink.com/en/security-bulletin/
CVE: CVE-2024-48633
Published: 2024-10-17
Description: D-Link DIR_882_FW130B06 and DIR_878 DIR_878_FW130B08 were discovered to contain multiple command injection vulnerabilities via the ExternalPort, InternalPort, ProtocolNumber, and LocalIPAddress parameters in the SetVirtualServerSettings function. This vulnerability allows attackers to execute arbitrary OS commands via a crafted POST request.
CVSS Score: 8.0 (HIGH)
CWE: CWE-78
References: https://github.com/pjqwudi1/my_vuln/blob/main/D-link4/vuln_40/40.md; https://www.dlink.com/en/security-bulletin/
CVE: CVE-2024-48634
Published: 2024-10-17
Description: D-Link DIR_882_FW130B06 and DIR_878 DIR_878_FW130B08 were discovered to contain a command injection vulnerability via the key parameter in the SetWLanRadioSecurity function. This vulnerability allows attackers to execute arbitrary OS commands via a crafted POST request.
CVSS Score: 8.0 (HIGH)
CWE: CWE-78
References: https://github.com/pjqwudi1/my_vuln/blob/main/D-link4/vuln_33/33.md; https://www.dlink.com/en/security-bulletin/
CVE: CVE-2024-48635
Published: 2024-10-17
Description: D-Link DIR_882_FW130B06 and DIR_878 DIR_878_FW130B08 were discovered to contain a command injection vulnerability via the VLANID:2/VID parameter in the SetVLANSettings function. This vulnerability allows attackers to execute arbitrary OS commands via a crafted POST request.
CVSS Score: 8.0 (HIGH)
CWE: CWE-78
References: https://github.com/pjqwudi1/my_vuln/tree/main/D-link4/vuln_38; https://www.dlink.com/en/security-bulletin/
CVE: CVE-2024-48636
Published: 2024-10-17
Description: D-Link DIR_882_FW130B06 and DIR_878 DIR_878_FW130B08 were discovered to contain a command injection vulnerability via the VLANID:0/VID parameter in the SetVLANSettings function. This vulnerability allows attackers to execute arbitrary OS commands via a crafted POST request.
CVSS Score: 8.0 (HIGH)
CWE: CWE-78
References: https://github.com/pjqwudi1/my_vuln/blob/main/D-link4/vuln_36/36.md; https://www.dlink.com/en/security-bulletin/
CVE: CVE-2024-48637
Published: 2024-10-17
Description: D-Link DIR_882_FW130B06 and DIR_878 DIR_878_FW130B08 were discovered to contain a command injection vulnerability via the VLANID:1/VID parameter in the SetVLANSettings function. This vulnerability allows attackers to execute arbitrary OS commands via a crafted POST request.
CVSS Score: 8.0 (HIGH)
CWE: CWE-78
References: https://github.com/pjqwudi1/my_vuln/blob/main/D-link4/vuln_37/37.md; https://www.dlink.com/en/security-bulletin/