rainbutterfly/cve_corpus huggingface dataset:
CVE-2024-48224 
Funadmin v5.0.2 has an arbitrary file read vulnerability in /curd/index/editfile.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-10-25T00:00:00.000Z
CVE-2024-48225 
Funadmin v5.0.2 has an arbitrary file deletion vulnerability in /curd/index/delfile.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-10-25T00:00:00.000Z
CVE-2024-48226 
Funadmin 5.0.2 is vulnerable to SQL Injection in curd/table/savefield.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-10-25T00:00:00.000Z
CVE-2024-48227 
Funadmin 5.0.2 has a logical flaw in the Curd one click command deletion function, which can result in a Denial of Service (DOS).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-10-25T00:00:00.000Z
CVE-2024-48228 
An issue was found in funadmin 5.0.2. The selectfiles method in \backend\controller\sys\Attachh.php directly stores the passed parameters and values into the param parameter without filtering, resulting in Cross Site Scripting (XSS).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-10-25T00:00:00.000Z
CVE-2024-48229 
funadmin 5.0.2 has a SQL injection vulnerability in the Curd one click command mode plugin.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-10-25T00:00:00.000Z
CVE-2024-48230 
funadmin 5.0.2 is vulnerable to SQL Injection via the parentField parameter in the index method of \backend\controller\auth\Auth.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-10-25T00:00:00.000Z
CVE-2024-48231 
Funadmin 5.0.2 is vulnerable to SQL Injection via the selectFields parameter in the index method of \backend\controller\auth\Auth.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-10-21T00:00:00.000Z
CVE-2024-48232 
An issue was found in mipjz 5.0.5. In the mipPost method of \app\setting\controller\ApiAdminTool.php, the value of the postAddress parameter is not processed and is directly passed into curl_exec execution and output, resulting in a Server-side request forgery (SSRF) vulnerability that can read server files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-10-25T00:00:00.000Z
CVE-2024-48233 
mipjz 5.0.5 is vulnerable to Cross Site Scripting (XSS) in \app\setting\controller\ApiAdminSetting.php via the ICP parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-10-25T00:00:00.000Z
CVE-2024-48234 
An issue was discovered in mipjz 5.0.5. In the push method of app\tag\controller\ApiAdminTag.php the value of the postAddress parameter is not processed and is directly passed into curl_exec execution and output, resulting in Server-side request forgery (SSRF) vulnerability that can read server files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-10-25T00:00:00.000Z
CVE-2024-48235 
An issue in ofcms 1.1.2 allows a remote attacker to execute arbitrary code via the save method of the TemplateController.java file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-10-25T00:00:00.000Z
CVE-2024-48236 
An issue in ofcms 1.1.2 allows a remote attacker to execute arbitrary code via the FileOutputStream function in the write String method of the ofcms-admin\src\main\java\com\ofsoft\cms\core\uitle\FileUtils.java file
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-10-25T00:00:00.000Z
CVE-2024-48237 
WTCMS 1.0 is vulnerable to Incorrect Access Control in \Common\Controller\HomebaseController.class.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-10-25T00:00:00.000Z
CVE-2024-48238 
WTCMS 1.0 is vulnerable to SQL Injection in the edit_post method of /Admin\Controller\NavControl.class.php via the parentid parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-10-25T00:00:00.000Z
CVE-2024-48239 
An issue was discovered in WTCMS 1.0. In the plupload method in \AssetController.class.php, the app parameters aren't processed, resulting in Cross Site Scripting (XSS).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-10-25T00:00:00.000Z
CVE-2024-48241 
An issue in radare2 v5.8.0 through v5.9.4 allows a local attacker to cause a denial of service via the __bf_div function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-10-30T00:00:00.000Z
CVE-2024-48245 
Vehicle Management System 1.0 is vulnerable to SQL Injection. A guest user can exploit vulnerable POST parameters in various administrative actions, such as booking a vehicle or confirming a booking. The affected parameters include "Booking ID", "Action Name", and "Payment Confirmation ID", which are present in /newvehicle.php and /newdriver.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-01-07T00:00:00.000Z
CVE-2024-48246 
Vehicle Management System 1.0 contains a Stored Cross-Site Scripting (XSS) vulnerability in the "Name" parameter of /vehicle-management/booking.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-03-05T00:00:00.000Z
CVE-2024-48248 
NAKIVO Backup & Replication before 11.0.0.88174 allows absolute path traversal for reading files via getImageByPath to /c/router (this may lead to remote code execution across the enterprise because PhysicalDiscovery has cleartext credentials).
Problem types: cwe_id: CWE-36
description: CWE-36 Absolute Path Traversal
Affected products: vendor: NAKIVO
product: Backup & Replication Director
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 8.6
baseSeverity: HIGH
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Published: 2025-03-04T00:00:00.000Z
CVE-2024-48249 
Wavelog 1.8.5 allows Gridmap_model.php get_band_confirmed SQL injection via band, sat, propagation, or mode.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-10-14T00:00:00.000Z
CVE-2024-48251 
Wavelog 1.8.5 allows Activated_gridmap_model.php get_band_confirmed SQL injection via band, sat, propagation, or mode.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-10-14T00:00:00.000Z
CVE-2024-48253 
Cloudlog 2.6.15 allows Oqrs.php delete_oqrs_line id SQL injection.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-10-14T00:00:00.000Z
CVE-2024-48255 
Cloudlog 2.6.15 allows Oqrs.php get_station_info station_id SQL injection.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-10-14T00:00:00.000Z
CVE-2024-48257 
Wavelog 1.8.5 allows Oqrs_model.php get_worked_modes station_id SQL injectioin.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-10-14T00:00:00.000Z
CVE-2024-48259 
Cloudlog 2.6.15 allows Oqrs.php request_form SQL injection via station_id or callsign.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-10-14T00:00:00.000Z
CVE-2024-48270 
An issue in the component /logins of oasys v1.1 allows attackers to access sensitive information via a burst attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-11-01T00:00:00.000Z
CVE-2024-48271 
D-Link DSL6740C v6.TR069.20211230 was discovered to use insecure default credentials for Administrator access, possibly allowing attackers to bypass authentication and escalate privileges on the device via a bruteforce attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-10-30T00:00:00.000Z
CVE-2024-48272 
D-Link DSL6740C v6.TR069.20211230 was discovered to use an insecure default Wifi password, possibly allowing attackers to connect to the device via a bruteforce attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-10-30T00:00:00.000Z
CVE-2024-48278 
Phpgurukul User Registration & Login and User Management System 3.2 is vulnerable to Cross Site Request Forgery (CSRF) via /edit-profile.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-10-15T00:00:00.000Z
CVE-2024-48279 
A HTML Injection vulnerability was found in /search-result.php of PHPGurukul User Registration & Login and User Management System 3.2. This vulnerability allows remote attackers to execute arbitrary HTML code via the searchkey parameter in a POST HTTP request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-10-15T00:00:00.000Z
CVE-2024-48280 
A SQL Injection vulnerability was found in /search-result.php of PHPGurukul User Registration & Login and User Management System 3.2, which allows remote attackers to execute arbitrary SQL command via the fromdate parameter in a POST HTTP request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-10-15T00:00:00.000Z
CVE-2024-48282 
A SQL Injection vulnerability was found in /password-recovery.php of PHPGurukul User Registration & Login and User Management System 3.2, which allows remote attackers to execute arbitrary SQL commands to get unauthorized database access via the femail parameter in a POST HTTP request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-10-15T00:00:00.000Z
CVE-2024-48283 
Phpgurukul User Registration & Login and User Management System 3.2 is vulnerable to SQL Injection in /admin//search-result.php via the searchkey parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-10-15T00:00:00.000Z
CVE-2024-48284 
A Reflected Cross-Site Scripting (XSS) vulnerability was found in the /search-result.php page of the PHPGurukul User Registration & Login and User Management System 3.2. This vulnerability allows remote attackers to execute arbitrary scripts via the searchkey parameter in a POST HTTP request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-11-14T00:00:00.000Z
CVE-2024-48286 
Linksys E3000 1.0.06.002_US is vulnerable to command injection via the diag_ping_start function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-11-21T00:00:00.000Z
CVE-2024-48288 
TP-Link TL-IPC42C V4.0_20211227_1.0.16 is vulnerable to command injection due to the lack of malicious code verification on both the frontend and backend.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-11-21T00:00:00.000Z
CVE-2024-48289 
An issue in the Bluetooth Low Energy implementation of Cypress Bluetooth SDK v3.66 allows attackers to cause a Denial of Service (DoS) via supplying a crafted LL_PAUSE_ENC_REQ packet.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-11-01T00:00:00.000Z
CVE-2024-48290 
An issue in the Bluetooth Low Energy implementation of Realtek RTL8762E BLE SDK v1.4.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted ll_terminate_ind packet.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-11-07T00:00:00.000Z
CVE-2024-48291 
dingfanzu CMS 1.0 was discovered to contain a Cross-Site Request Forgery (CSRF) via /admin/doAdminAction.php?act=editAdmin&id=17
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-10-28T00:00:00.000Z
CVE-2024-48292 
An issue in the wssrvc.exe service of QuickHeal Antivirus Pro Version v24.0 and Quick Heal Total Security v24.0 allows authenticated attackers to escalate privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-11-18T00:00:00.000Z
CVE-2024-48293 
Incorrect access control in QuickHeal Antivirus Pro 24.1.0.182 and earlier allows authenticated attackers with low-level privileges to arbitrarily modify antivirus settings.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-11-18T00:00:00.000Z
CVE-2024-48294 
A NULL pointer dereference in the component libPdfCore.dll of Wondershare PDF Reader v1.0.9.2544 allows attackers to cause a Denial of Service (DoS) via a crafted PDF file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-11-18T00:00:00.000Z
CVE-2024-48307 
JeecgBoot v3.7.1 was discovered to contain a SQL injection vulnerability via the component /onlDragDatasetHead/getTotalData.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-10-31T00:00:00.000Z
CVE-2024-48310 
AutoLib Software Systems OPAC v20.10 was discovered to have multiple API keys exposed within the source code. Attackers may use these keys to access the backend API or other sensitive information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-01-28T00:00:00.000Z
CVE-2024-48311 
Piwigo v14.5.0 was discovered to contain a Cross-Site Request Forgery (CSRF) via the Edit album function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-10-31T00:00:00.000Z
CVE-2024-48312 
WebLaudos v20.8 (118) was discovered to contain a cross-site scripting (XSS) vulnerability via the login page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-11-05T00:00:00.000Z
CVE-2024-48322 
UsersController.php in Run.codes 1.5.2 and older has a reset password race condition vulnerability.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-11-11T00:00:00.000Z
CVE-2024-48325 
Portabilis i-Educar 2.8.0 is vulnerable to SQL Injection in the "getDocuments" function of the "InstituicaoDocumentacaoController" class. The "instituicao_id" parameter in "/module/Api/InstituicaoDocumentacao?oper=get&resource=getDocuments&instituicao_id" is not properly sanitized, allowing an unauthenticated remote attacker to inject malicious SQL commands.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-11-06T00:00:00.000Z
CVE-2024-48336 
The install() function of ProviderInstaller.java in Magisk App before canary version 27007 does not verify the GMS app before loading it, which allows a local untrusted app with no additional privileges to silently execute arbitrary code in the Magisk app and escalate privileges to root via a crafted package, aka Bug #8279. User interaction is not needed for exploitation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-11-04T00:00:00.000Z
CVE-2024-48341 
dingfanzu CMS V1.0 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/doAdminAction.php?act=addShop
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-09-08T00:00:00.000Z
CVE-2024-48343 
A SQL Injection vulnerability in ESAFENET CDG 5 and earlier allows an attacker to execute arbitrary code via the id parameter of the dataSearch.jsp page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-10-25T00:00:00.000Z
CVE-2024-48346 
xtreme1 <= v0.9.1 contains a Server-Side Request Forgery (SSRF) vulnerability in the /api/data/upload path. The vulnerability is triggered through the fileUrl parameter, which allows an attacker to make arbitrary requests to internal or external systems.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-10-30T00:00:00.000Z
CVE-2024-48352 
Yealink Meeting Server before V26.0.0.67 is vulnerable to sensitive data exposure in the server response via sending HTTP request with enterprise ID.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-11-01T00:00:00.000Z
CVE-2024-48353 
Yealink Meeting Server before V26.0.0.67 allows attackers to obtain static key information from a front-end JS file and decrypt the plaintext passwords based on the obtained key information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-11-01T00:00:00.000Z
CVE-2024-48356 
LyLme Spage <=1.6.0 is vulnerable to SQL Injection via /admin/group.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-10-28T00:00:00.000Z
CVE-2024-48357 
LyLme Spage 1.2.0 through 1.6.0 is vulnerable to SQL Injection via /admin/apply.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-10-28T00:00:00.000Z
CVE-2024-48359 
Qualitor v8.24 was discovered to contain a remote code execution (RCE) vulnerability via the gridValoresPopHidden parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-10-31T00:00:00.000Z
CVE-2024-48360 
Qualitor v8.24 was discovered to contain a Server-Side Request Forgery (SSRF) via the component /request/viewValidacao.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-10-31T00:00:00.000Z
CVE-2024-48392 
OrangeScrum v2.0.11 is vulnerable to Cross Site Scripting (XSS). An attacker can inject malicious JavaScript code into user email due to lack of input validation, which could lead to account takeover.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-01-21T00:00:00.000Z
CVE-2024-48394 
A Time-of-Check to Time-of-Use (TOCTOU) vulnerability has been identified in the driver of the NDD Print solution, which could allow an unprivileged user to exploit this flaw and gain SYSTEM-level access on the device. The vulnerability affects version 5.24.3 and before of the software.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-02-05T00:00:00.000Z
CVE-2024-48396 
AIML Chatbot 1.0 (fixed in 2.0) is vulnerable to Cross Site Scripting (XSS). The vulnerability is exploited through the message input field, where attackers can inject malicious HTML or JavaScript code. The chatbot fails to sanitize these inputs, leading to the execution of malicious scripts.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-10-25T00:00:00.000Z
CVE-2024-48406 
Buffer Overflow vulnerability in SunBK201 umicat through v.0.3.2 and fixed in v.0.3.3 allows an attacker to execute arbitrary code via the power(uct_int_t x, uct_int_t n) in src/uct_upstream.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-11-29T00:00:00.000Z
CVE-2024-48410 
Cross Site Scripting vulnerability in Camtrace v.9.16.2.1 allows a remote attacker to execute arbitrary code via the login.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-11-01T00:00:00.000Z
CVE-2024-48411 
itsourcecode Online Tours and Travels Management System v1.0 is vulnerable to SQL Injection (SQLI) via a crafted payload to the val-email parameter in forget_password.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-10-15T00:00:00.000Z
CVE-2024-48415 
itsourcecode Loan Management System v1.0 is vulnerable to Cross Site Scripting (XSS) via a crafted payload to the lastname, firstname, middlename, address, contact_no, email and tax_id parameters in new borrowers functionality on the Borrowers page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-10-22T00:00:00.000Z
CVE-2024-48416 
Edimax AC1200 Wi-Fi 5 Dual-Band Router BR-6476AC 1.06 is vulnerable to Buffer Overflow via /goform/fromSetLanDhcpsClientbinding.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-01-27T00:00:00.000Z
CVE-2024-48417 
Edimax AC1200 Wi-Fi 5 Dual-Band Router BR-6476AC 1.06 is vulnerable to Cross Site Scripting (XSS) in : /bin/goahead via /goform/setStaticRoute, /goform/fromSetFilterUrlFilter, and /goform/fromSetFilterClientFilter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-01-27T00:00:00.000Z
CVE-2024-48418 
In Edimax AC1200 Wi-Fi 5 Dual-Band Router BR-6476AC 1.06, the request /goform/fromSetDDNS does not properly handle special characters in any of user provided parameters, allowing an attacker with access to the web interface to inject and execute arbitrary shell commands.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-01-27T00:00:00.000Z
CVE-2024-48419 
Edimax AC1200 Wi-Fi 5 Dual-Band Router BR-6476AC 1.06 suffers from Command Injection issues in /bin/goahead. Specifically, these issues can be triggered through /goform/tracerouteDiagnosis, /goform/pingDiagnosis, and /goform/fromSysToolPingCmd Each of these issues allows an attacker with access to the web interface to inject and execute arbitrary shell commands, with "root" privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-01-27T00:00:00.000Z
CVE-2024-48420 
Edimax AC1200 Wi-Fi 5 Dual-Band Router BR-6476AC 1.06 is vulnerable to Buffer Overflow via /goform/getWifiBasic.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-01-27T00:00:00.000Z
CVE-2024-48423 
An issue in assimp v.5.4.3 allows a local attacker to execute arbitrary code via the CallbackToLogRedirector function within the Assimp library.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-10-24T00:00:00.000Z
CVE-2024-48424 
A heap-buffer-overflow vulnerability has been identified in the OpenDDLParser::parseStructure function within the Assimp library, specifically during the processing of OpenGEX files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-10-24T00:00:00.000Z
CVE-2024-48425 
A segmentation fault (SEGV) was detected in the Assimp::SplitLargeMeshesProcess_Triangle::UpdateNode function within the Assimp library during fuzz testing using AddressSanitizer. The crash occurs due to a read access violation at address 0x000000000460, which points to the zero page, indicating a null or invalid pointer dereference.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-10-24T00:00:00.000Z
CVE-2024-48426 
A segmentation fault (SEGV) was detected in the SortByPTypeProcess::Execute function in the Assimp library during fuzz testing with AddressSanitizer. The crash occurred due to a read access to an invalid memory address (0x1000c9714971).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-10-24T00:00:00.000Z
CVE-2024-48427 
A SQL injection vulnerability in Sourcecodester Packers and Movers Management System v1.0 allows remote authenticated users to execute arbitrary SQL commands via the id parameter in /mpms/admin/?page=services/manage_service&id
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-10-24T00:00:00.000Z
CVE-2024-48428 
An issue in Olive VLE allows an attacker to obtain sensitive information via the reset password function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-10-25T00:00:00.000Z
CVE-2024-48440 
Shenzhen Tuoshi Network Communications Co.,Ltd 5G CPE Router NR500-EA RG500UEAABxCOMSLICv3.2.2543.12.18 was discovered to contain a command injection vulnerability via the component at_command.asp.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-10-24T00:00:00.000Z
CVE-2024-48441 
Wuhan Tianyu Information Industry Co., Ltd Tianyu CPE Router CommonCPExCPETS_v3.2.468.11.04_P4 was discovered to contain a command injection vulnerability via the component at_command.asp.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-10-24T00:00:00.000Z