deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-6530
Published: 2024-10-10
Description: A cross-site scripting issue has been discovered in GitLab affecting all versions starting from 17.1 prior 17.2.9, starting from 17.3 prior to 17.3.5, and starting from 17.4 prior to 17.4.2. When adding a authorizing an application, it can be made to render as HTML under specific circumstances.
CVSS Score: 7.3 (HIGH)
CWE: CWE-79, CWE-79
References: https://gitlab.com/gitlab-org/gitlab/-/issues/471049; https://hackerone.com/reports/2567533
CVE: CVE-2024-9782
Published: 2024-10-10
Description: A vulnerability was found in D-Link DIR-619L B1 2.06. It has been declared as critical. This vulnerability affects the function formEasySetupWWConfig of the file /goform/formEasySetupWWConfig. The manipulation of the argument curTime leads to buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 8.8 (HIGH)
CWE: CWE-120
References: https://github.com/abcdefg-png/IoT-vulnerable/blob/main/D-Link/DIR-619L/formEasySetupWWConfig.md; https://vuldb.com/?ctiid.279934; https://vuldb.com/?id.279934
CVE: CVE-2024-9783
Published: 2024-10-10
Description: A vulnerability was found in D-Link DIR-619L B1 2.06. It has been rated as critical. This issue affects the function formLogDnsquery of the file /goform/formLogDnsquery. The manipulation of the argument curTime leads to buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 8.8 (HIGH)
CWE: CWE-120, CWE-120
References: https://github.com/abcdefg-png/IoT-vulnerable/blob/main/D-Link/DIR-619L/formLogDnsquery.md; https://vuldb.com/?ctiid.279935; https://vuldb.com/?id.279935
CVE: CVE-2024-9784
Published: 2024-10-10
Description: A vulnerability classified as critical has been found in D-Link DIR-619L B1 2.06. Affected is the function formResetStatistic of the file /goform/formResetStatistic. The manipulation of the argument curTime leads to buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 8.8 (HIGH)
CWE: CWE-120
References: https://github.com/abcdefg-png/IoT-vulnerable/blob/main/D-Link/DIR-619L/formResetStatistic.md; https://vuldb.com/?ctiid.279936; https://vuldb.com/?id.279936
CVE: CVE-2024-35202
Published: 2024-10-10
Description: Bitcoin Core before 25.0 allows remote attackers to cause a denial of service (blocktxn message-handling assertion and node exit) by including transactions in a blocktxn message that are not committed to in a block's merkle root. FillBlock can be called twice for one PartiallyDownloadedBlock instance.
CVSS Score: 7.5 (HIGH)
CWE: CWE-770
References: https://bitcoincore.org/en/2024/10/08/disclose-blocktxn-crash/; https://en.bitcoin.it/wiki/Common_Vulnerabilities_and_Exposures; https://github.com/bitcoin/bitcoin/blob/master/doc/release-notes/release-notes-25.0.md
CVE: CVE-2024-36051
Published: 2024-10-10
Description: Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: CVE-2024-38365. Reason: This record is a duplicate of CVE-2024-38365. Notes: All CVE users should reference CVE-2024-38365 instead of this record. All references and descriptions in this record have been removed to prevent accidental usage.
CVE: CVE-2024-6157
Published: 2024-10-10
Description: An attacker who successfully exploited these vulnerabilities could cause the robot to stop.



A vulnerability exists in the PROFINET stack included in the RobotWare versions listed below. 

This vulnerability arises under specific condition when specially crafted message is processed by the system.

Below are reported vulnerabilities in the Robot Ware versions. 

* IRC5- RobotWare 6 < 6.15.06 except 6.10.10, and 6.13.07
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-476
References: https://search.abb.com/library/Download.aspx?DocumentID=SI20337&LanguageCode=en&DocumentPartId=&Action=Launch
CVE: CVE-2024-9785
Published: 2024-10-10
Description: A vulnerability classified as critical was found in D-Link DIR-619L B1 2.06. Affected by this vulnerability is the function formSetDDNS of the file /goform/formSetDDNS. The manipulation of the argument curTime leads to buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 8.8 (HIGH)
CWE: CWE-120
References: https://github.com/abcdefg-png/IoT-vulnerable/blob/main/D-Link/DIR-619L/formSetDDNS.md; https://vuldb.com/?ctiid.279937; https://vuldb.com/?id.279937
CVE: CVE-2024-9786
Published: 2024-10-10
Description: A vulnerability, which was classified as critical, has been found in D-Link DIR-619L B1 2.06. Affected by this issue is the function formSetLog of the file /goform/formSetLog. The manipulation of the argument curTime leads to buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 8.8 (HIGH)
CWE: CWE-120
References: https://github.com/abcdefg-png/IoT-vulnerable/blob/main/D-Link/DIR-619L/formSetLog.md; https://vuldb.com/?ctiid.279938; https://vuldb.com/?id.279938
CVE: CVE-2024-44711
Published: 2024-10-10
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
CVE: CVE-2024-4658
Published: 2024-10-10
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in TE Informatics Nova CMS allows SQL Injection.This issue affects Nova CMS: before 5.0.
CWE: CWE-89
References: https://www.usom.gov.tr/bildirim/tr-24-1661
CVE: CVE-2024-9312
Published: 2024-10-10
Description: Authd, through version 0.3.6, did not sufficiently randomize user IDs to prevent collisions. A local attacker who can register user names could spoof another user's ID and gain their privileges.
CVSS Score: 7.5 (HIGH)
CWE: CWE-286, CWE-335
References: https://github.com/ubuntu/authd/security/advisories/GHSA-4gfw-wf7c-w6g2; https://www.cve.org/CVERecord?id=CVE-2024-9312
CVE: CVE-2024-9787
Published: 2024-10-10
Description: A vulnerability, which was classified as problematic, was found in Contemporary Control System BASrouter BACnet BASRT-B 2.7.2. This affects an unknown part of the component UDP Packet Handler. The manipulation leads to denial of service. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-404
References: https://github.com/isZzzz/BASRT-B_BriefDoS_Document/blob/main/report.md; https://vuldb.com/?ctiid.279939; https://vuldb.com/?id.279939
CVE: CVE-2024-9788
Published: 2024-10-10
Description: A vulnerability has been found in LyLme_spage 1.9.5 and classified as critical. This vulnerability affects unknown code of the file /admin/tag.php. The manipulation of the argument id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-89
References: https://vuldb.com/?ctiid.279940; https://vuldb.com/?id.279940; https://vuldb.com/?submit.414574
CVE: CVE-2024-9789
Published: 2024-10-10
Description: A vulnerability was found in LyLme_spage 1.9.5 and classified as critical. This issue affects some unknown processing of the file /admin/apply.php. The manipulation of the argument id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-89
References: https://vuldb.com/?ctiid.279941; https://vuldb.com/?id.279941; https://vuldb.com/?submit.414575
CVE: CVE-2024-9790
Published: 2024-10-10
Description: A vulnerability was found in LyLme_spage 1.9.5. It has been classified as critical. Affected is an unknown function of the file /admin/sou.php. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-89
References: https://vuldb.com/?ctiid.279942; https://vuldb.com/?id.279942; https://vuldb.com/?submit.414578
CVE: CVE-2024-9792
Published: 2024-10-10
Description: A vulnerability classified as problematic has been found in D-Link DSL-2750U R5B017. This affects an unknown part of the component Port Forwarding Page. The manipulation of the argument PortMappingDescription leads to cross site scripting. It is possible to initiate the attack remotely.
CVSS Score: 2.4 (LOW)
CWE: CWE-79
References: https://vuldb.com/?ctiid.279945; https://vuldb.com/?id.279945; https://vuldb.com/?submit.415532
CVE: CVE-2023-25581
Published: 2024-10-10
Description: pac4j is a security framework for Java. `pac4j-core` prior to version 4.0.0 is affected by a Java deserialization vulnerability. The vulnerability affects systems that store externally controlled values in attributes of the `UserProfile` class from pac4j-core. It can be exploited by providing an attribute that contains a serialized Java object with a special prefix `{#sb64}` and Base64 encoding. This issue may lead to Remote Code Execution (RCE) in the worst case. Although a `RestrictedObjectInputStream` is in place, that puts some restriction on what classes can be deserialized, it still allows a broad range of java packages and potentially exploitable with different gadget chains. pac4j versions 4.0.0 and greater are not affected by this issue. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CWE: CWE-502
References: https://github.com/frohoff/ysoserial; https://github.com/pac4j/pac4j/blob/5834aeb22ad3a4369dfa572be60d7b20f5784a8f/pac4j-core/src/main/java/org/pac4j/core/profile/InternalAttributeHandler.java#L95; https://portswigger.net/web-security/deserialization
CVE: CVE-2024-9793
Published: 2024-10-10
Description: A vulnerability classified as critical was found in Tenda AC1206 up to 15.03.06.23. This vulnerability affects the function ate_iwpriv_set/ate_ifconfig_set of the file /goform/ate. The manipulation leads to command injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-77, CWE-78
References: https://github.com/ixout/iotVuls/blob/main/Tenda/ac1206_003/report.md; https://github.com/ixout/iotVuls/blob/main/Tenda/ac1206_004/report.md; https://vuldb.com/?ctiid.279946
CVE: CVE-2024-9794
Published: 2024-10-10
Description: A vulnerability, which was classified as critical, has been found in Codezips Online Shopping Portal 1.0. This issue affects some unknown processing of the file /update-image1.php. The manipulation of the argument productimage1 leads to unrestricted upload. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-434
References: https://github.com/ppp-src/CVE/issues/7; https://vuldb.com/?ctiid.279947; https://vuldb.com/?id.279947
CVE: CVE-2024-9797
Published: 2024-10-10
Description: A vulnerability, which was classified as critical, was found in code-projects Blood Bank System 1.0. Affected is an unknown function of the file register.php. The manipulation of the argument user leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-89
References: https://code-projects.org/; https://github.com/siyuancn-hub/cve/blob/main/sql4-user.md; https://vuldb.com/?ctiid.279948
CVE: CVE-2024-9799
Published: 2024-10-10
Description: A vulnerability has been found in SourceCodester Profile Registration without Reload Refresh 1.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file add.php. The manipulation of the argument email_address/address/company_name/job_title/jobDescriptionparameter leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://gist.github.com/sechurity/07c5a3a15f21313ee657d05baadbee19; https://vuldb.com/?ctiid.279949; https://vuldb.com/?id.279949
CVE: CVE-2024-9803
Published: 2024-10-10
Description: A vulnerability was found in code-projects Blood Bank Management System 1.0. It has been classified as problematic. This affects an unknown part of the file blooddetails.php. The manipulation of the argument Availibility leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://code-projects.org/; https://github.com/cookie5201314/CVE/blob/main/xss4-w.md; https://vuldb.com/?ctiid.279951
CVE: CVE-2024-47636
Published: 2024-10-10
Description: Deserialization of Untrusted Data vulnerability in eyecix JobSearch wp-jobsearch allows Object Injection.This issue affects JobSearch: from n/a through <= 2.5.9.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502
References: https://patchstack.com/database/Wordpress/Plugin/wp-jobsearch/vulnerability/wordpress-wp-jobsearch-plugin-2-5-9-php-object-injection-vulnerability?_s_id=cve
CVE: CVE-2024-47962
Published: 2024-10-10
Description: Delta Electronics CNCSoft-G2 lacks proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can manipulate an insider to visit a malicious page or file to leverage this vulnerability to execute code in the context of the current process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-121, CWE-787
References: https://www.cisa.gov/news-events/ics-advisories/icsa-24-284-21
CVE: CVE-2024-47963
Published: 2024-10-10
Description: Delta Electronics CNCSoft-G2 lacks proper validation of user-supplied data, which can result in a write past the end of an allocated object. An attacker can manipulate users to visit a malicious page or file to leverage this vulnerability to execute code in the context of the current process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://www.cisa.gov/news-events/ics-advisories/icsa-24-284-21
CVE: CVE-2024-47964
Published: 2024-10-10
Description: Delta Electronics CNCSoft-G2 lacks proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. An attacker can manipulate users to visit a malicious page or file to leverage this vulnerability to execute code in the context of the current process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-122, CWE-787
References: https://www.cisa.gov/news-events/ics-advisories/icsa-24-284-21
CVE: CVE-2024-47965
Published: 2024-10-10
Description: Delta Electronics CNCSoft-G2 lacks proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can manipulate users to visit a malicious page or file to leverage this vulnerability to execute code in the context of the current process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125, CWE-125
References: https://www.cisa.gov/news-events/ics-advisories/icsa-24-284-21
CVE: CVE-2024-47966
Published: 2024-10-10
Description: Delta Electronics CNCSoft-G2 lacks proper initialization of memory prior to accessing it. An attacker can manipulate users to visit a malicious page or file to leverage this vulnerability to execute code in the context of the current process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-457, CWE-908
References: https://www.cisa.gov/news-events/ics-advisories/icsa-24-284-21
CVE: CVE-2024-9804
Published: 2024-10-10
Description: A vulnerability was found in code-projects Blood Bank System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /admin/campsdetails.php. The manipulation of the argument hospital leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-89
References: https://code-projects.org/; https://github.com/sternstundes/cve/blob/main/sql5-campdetails.md; https://vuldb.com/?ctiid.279952
CVE: CVE-2024-9805
Published: 2024-10-10
Description: A vulnerability was found in code-projects Blood Bank System 1.0. It has been rated as problematic. This issue affects some unknown processing of the file /admin/campsdetails.php. The manipulation of the argument hospital/address/city/contact leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The initial researcher advisory only mentions the parameter "hospital".
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://code-projects.org/; https://github.com/sternstundes/cve/blob/main/xss5.md; https://vuldb.com/?ctiid.279953
CVE: CVE-2024-47354
Published: 2024-10-10
Description: URL Redirection to Untrusted Site ('Open Redirect') vulnerability in wp.insider Simple Membership After Login Redirection simple-membership-after-login-redirection.This issue affects Simple Membership After Login Redirection: from n/a through <= 1.6.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-601
References: https://patchstack.com/database/Wordpress/Plugin/simple-membership-after-login-redirection/vulnerability/wordpress-simple-membership-after-login-redirection-plugin-1-6-open-redirection-vulnerability?_s_id=cve
CVE: CVE-2024-47648
Published: 2024-10-10
Description: URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Metagauss EventPrime eventprime-event-calendar-management.This issue affects EventPrime: from n/a through <= 4.0.4.5.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-601
References: https://patchstack.com/database/Wordpress/Plugin/eventprime-event-calendar-management/vulnerability/wordpress-eventprime-plugin-4-0-4-5-open-redirection-vulnerability?_s_id=cve
CVE: CVE-2024-9806
Published: 2024-10-10
Description: A vulnerability has been found in Craig Rodway Classroombookings up to 2.8.6 and classified as problematic. This vulnerability affects unknown code of the file /rooms/fields of the component Room Page. The manipulation of the argument Name leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 2.8.7 is able to address this issue. It is recommended to upgrade the affected component. The project maintainer was contacted early about the disclosure. He responded very quickly, friendly, and professional.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://github.com/JunMing27/CVE/blob/main/CVE%20-%20classroombookings%20Cross%20Site%20Scripting%20(XSS)%20at%20custom%20field.md; https://vuldb.com/?ctiid.279958; https://vuldb.com/?id.279958
CVE: CVE-2024-9807
Published: 2024-10-10
Description: A vulnerability was found in Craig Rodway Classroombookings 2.8.7 and classified as problematic. This issue affects some unknown processing of the file /sessions of the component Session Page. The manipulation of the argument Name leads to cross site scripting. The attack may be initiated remotely. Upgrading to version 2.8.8 is able to address this issue. It is recommended to upgrade the affected component. The project maintainer was contacted early about the disclosure. He responded very quickly, friendly, and professional.
CVSS Score: 2.4 (LOW)
CWE: CWE-79, CWE-79
References: https://github.com/JunMing27/CVE/blob/main/CVE%20-%20classroombookings%20Cross%20Site%20Scripting%20(XSS)%20at%20create%20and%20edit%20session%20page%20via%20Administrator%20Dashboard.md; https://vuldb.com/?ctiid.279959; https://vuldb.com/?id.279959
CVE: CVE-2024-9808
Published: 2024-10-10
Description: A vulnerability was found in SourceCodester Online Eyewear Shop 1.0. It has been classified as critical. Affected is an unknown function of the file /admin/?page=products/view_product. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/r1ckyL/cve/blob/main/sql.md; https://vuldb.com/?ctiid.279960; https://vuldb.com/?id.279960
CVE: CVE-2024-9809
Published: 2024-10-10
Description: A vulnerability was found in SourceCodester Online Eyewear Shop 1.0. It has been declared as critical. Affected by this vulnerability is the function delete_product of the file /classes/Master.php?f=delete_product. The manipulation of the argument id leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/wuyanzu-lab/cve/blob/main/sql.md; https://vuldb.com/?ctiid.279961; https://vuldb.com/?id.279961
CVE: CVE-2024-9810
Published: 2024-10-10
Description: A vulnerability was found in SourceCodester Record Management System 1.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the file sort2_user.php. The manipulation of the argument qualification leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://github.com/GangZhou1/VUL/blob/main/Record-Management-System-1.md; https://vuldb.com/?ctiid.279962; https://vuldb.com/?id.279962
CVE: CVE-2024-9180
Published: 2024-10-10
Description: A privileged Vault operator with write permissions to the root namespace’s identity endpoint could escalate their own or another user’s privileges to Vault’s root policy. Fixed in Vault Community Edition 1.18.0 and Vault Enterprise 1.18.0, 1.17.7, 1.16.11, and 1.15.16.
CVSS Score: 7.2 (HIGH)
CWE: CWE-266
References: https://discuss.hashicorp.com/t/hcsec-2024-21-vault-operators-in-root-namespace-may-elevate-their-privileges/70565
CVE: CVE-2024-9811
Published: 2024-10-10
Description: A vulnerability classified as critical has been found in code-projects Restaurant Reservation System 1.0. This affects an unknown part of the file filter3.php. The manipulation of the argument company leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-89
References: https://code-projects.org/; https://github.com/ppp-src/a/issues/24; https://vuldb.com/?ctiid.279963
CVE: CVE-2024-9812
Published: 2024-10-10
Description: A vulnerability classified as critical was found in code-projects Crud Operation System 1.0. This vulnerability affects unknown code of the file delete.php. The manipulation of the argument sid leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-89
References: https://code-projects.org/; https://github.com/ppp-src/a/issues/25; https://vuldb.com/?ctiid.279964
CVE: CVE-2024-9813
Published: 2024-10-10
Description: A vulnerability, which was classified as critical, has been found in Codezips Pharmacy Management System 1.0. This issue affects some unknown processing of the file product/register.php. The manipulation of the argument category leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-89
References: https://github.com/ppp-src/CVE/issues/10; https://vuldb.com/?ctiid.279965; https://vuldb.com/?id.279965