generated content from 2024-11-16

objects/vulnerability/vulnerability--01777284-05ec-42a9-a7f3-a6c51b1cfd0e.json

@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--8ea9a3c3-dd09-416a-a8d8-f66751c7f053",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--01777284-05ec-42a9-a7f3-a6c51b1cfd0e",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2024-11-16T00:21:38.453662Z",
+            "modified": "2024-11-16T00:21:38.453662Z",
+            "name": "CVE-2022-20793",
+            "description": "A vulnerability in pairing process of Cisco TelePresence CE Software and RoomOS Software for Cisco Touch 10 Devices could allow an unauthenticated, remote attacker to impersonate a legitimate device and pair with an affected device.\r\nThis vulnerability is due to insufficient identity verification. An attacker could exploit this vulnerability by impersonating a legitimate device and responding to the pairing broadcast from an affected device. A successful exploit could allow the attacker to access the affected device while impersonating a legitimate device.There are no workarounds that address this vulnerability.",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2022-20793"
+                }
+            ]
+        }
+    ]
+}

objects/vulnerability/vulnerability--01858e5e-a647-4a36-a193-b46ff41971a5.json

@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--3011da0e-17d3-46e2-a774-00100e198c88",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--01858e5e-a647-4a36-a193-b46ff41971a5",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2024-11-16T00:21:38.523549Z",
+            "modified": "2024-11-16T00:21:38.523549Z",
+            "name": "CVE-2022-20632",
+            "description": "A vulnerability in the web-based management interface of Cisco ECE could allow an unauthenticated, remote attacker to conduct an XSS attack against a user of the interface of an affected device.\r\nThe vulnerability exists because the web-based management interface does not properly validate user-supplied input. An attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or allow the attacker to access sensitive browser-based information.Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2022-20632"
+                }
+            ]
+        }
+    ]
+}

objects/vulnerability/vulnerability--029241df-0d68-4175-b29d-e13574af7dc2.json

@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--4ed04d18-1aa8-4c7f-92d2-e5b3df1020bc",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--029241df-0d68-4175-b29d-e13574af7dc2",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2024-11-16T00:21:32.247329Z",
+            "modified": "2024-11-16T00:21:32.247329Z",
+            "name": "CVE-2024-11259",
+            "description": "A vulnerability, which was classified as problematic, has been found in code-projects Farmacia 1.0. This issue affects some unknown processing of the file /fornecedores.php. The manipulation leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2024-11259"
+                }
+            ]
+        }
+    ]
+}

objects/vulnerability/vulnerability--02a6c5a8-3b8d-401b-bcd6-2dd5c70262c6.json

@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--e2a4741e-10aa-464e-91f5-90fb709dd1c8",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--02a6c5a8-3b8d-401b-bcd6-2dd5c70262c6",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2024-11-16T00:21:38.435509Z",
+            "modified": "2024-11-16T00:21:38.435509Z",
+            "name": "CVE-2022-20652",
+            "description": "A vulnerability in the web-based management interface and in the API subsystem of Cisco Tetration could allow an authenticated, remote attacker to inject arbitrary commands to be executed with root-level privileges on the underlying operating system.\r\nThis vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by submitting a crafted HTTP message to the affected system. A successful exploit could allow the attacker to execute commands with root-level privileges. To exploit this vulnerability, an attacker would need valid administrator-level credentials.Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2022-20652"
+                }
+            ]
+        }
+    ]
+}

objects/vulnerability/vulnerability--02ca8905-b3a1-415e-bd7c-7cb8d483c8ec.json

@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--96c538c7-bbb4-4e51-a14e-09072e2a47ec",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--02ca8905-b3a1-415e-bd7c-7cb8d483c8ec",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2024-11-16T00:21:33.08257Z",
+            "modified": "2024-11-16T00:21:33.08257Z",
+            "name": "CVE-2024-49759",
+            "description": "LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. A Stored Cross-Site Scripting (XSS) vulnerability in the \"Manage User Access\" page allows authenticated users to inject arbitrary JavaScript through the \"bill_name\" parameter when creating a new bill. This vulnerability can lead to the execution of malicious code when visiting the \"Bill Access\" dropdown in the user's \"Manage Access\" page, potentially compromising user sessions and allowing unauthorized actions. This vulnerability is fixed in 24.10.0.",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2024-49759"
+                }
+            ]
+        }
+    ]
+}

objects/vulnerability/vulnerability--04f63f1f-b96f-49fc-8e42-dcd2d3202fd1.json

@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--3cabf88e-8f99-44cd-b752-a7051201ba0b",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--04f63f1f-b96f-49fc-8e42-dcd2d3202fd1",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2024-11-16T00:21:38.516862Z",
+            "modified": "2024-11-16T00:21:38.516862Z",
+            "name": "CVE-2022-20685",
+            "description": "A vulnerability in the Modbus preprocessor of the Snort detection engine could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device.\r\nThis vulnerability is due to an integer overflow while processing Modbus traffic. An attacker could exploit this vulnerability by sending crafted Modbus traffic through an affected device. A successful exploit could allow the attacker to cause the Snort process to hang, causing traffic inspection to stop.Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2022-20685"
+                }
+            ]
+        }
+    ]
+}

objects/vulnerability/vulnerability--06a49f2b-6b3b-40ac-865a-1b5b65ad06ca.json

@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--3d41b81f-8cce-4314-bfed-2db839fb3ec4",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--06a49f2b-6b3b-40ac-865a-1b5b65ad06ca",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2024-11-16T00:21:32.832391Z",
+            "modified": "2024-11-16T00:21:32.832391Z",
+            "name": "CVE-2024-41784",
+            "description": "IBM Sterling Secure Proxy 6.0.0.0, 6.0.0.1, 6.0.0.2, 6.0.0.3, and 6.1.0.0 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing \"dot dot dot\" sequences (/.../) to view arbitrary files on the system.",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2024-41784"
+                }
+            ]
+        }
+    ]
+}

objects/vulnerability/vulnerability--070056f0-961c-48f9-bed2-7eff371986ae.json

@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--bd2c873d-e87b-4534-aa4a-ecbde2a7bc20",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--070056f0-961c-48f9-bed2-7eff371986ae",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2024-11-16T00:21:33.10634Z",
+            "modified": "2024-11-16T00:21:33.10634Z",
+            "name": "CVE-2024-49536",
+            "description": "Audition versions 23.6.9, 24.4.6 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2024-49536"
+                }
+            ]
+        }
+    ]
+}

objects/vulnerability/vulnerability--0829aa61-3e33-433d-a022-217eb239a5cd.json

@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--93225f13-e4d6-403f-8707-c4c46314e4db",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--0829aa61-3e33-433d-a022-217eb239a5cd",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2024-11-16T00:21:42.404253Z",
+            "modified": "2024-11-16T00:21:42.404253Z",
+            "name": "CVE-2023-20036",
+            "description": "A vulnerability in the web UI of Cisco IND could allow an authenticated, remote attacker to execute arbitrary commands with administrative privileges on the underlying operating system of an affected device.\r\n\r\nThis vulnerability is due to improper input validation when uploading a Device Pack. An attacker could exploit this vulnerability by altering the request that is sent when uploading a Device Pack. A successful exploit could allow the attacker to execute arbitrary commands as NT AUTHORITY\\SYSTEM on the underlying operating system of an affected device.\r\nCisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2023-20036"
+                }
+            ]
+        }
+    ]
+}

objects/vulnerability/vulnerability--08ad8d08-27cd-4aa7-8112-10c62cdb2a8a.json

@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--123403fa-1a27-4fef-a383-3c05ebbc35e8",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--08ad8d08-27cd-4aa7-8112-10c62cdb2a8a",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2024-11-16T00:21:36.882029Z",
+            "modified": "2024-11-16T00:21:36.882029Z",
+            "name": "CVE-2021-1484",
+            "description": "A vulnerability in the web UI of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to inject arbitrary commands on an affected system and cause a denial of service (DoS) condition.\r\nThis vulnerability is due to improper input validation of user-supplied input to the device template configuration. An attacker could exploit this vulnerability by submitting crafted input to the device template configuration. A successful exploit could allow the attacker to cause a DoS condition on the affected system.Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2021-1484"
+                }
+            ]
+        }
+    ]
+}

objects/vulnerability/vulnerability--08f071f7-acec-4cb6-b8eb-573c37bc1e48.json

@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--9ec1f690-f098-41b7-af0d-aa747881a60b",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--08f071f7-acec-4cb6-b8eb-573c37bc1e48",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2024-11-16T00:21:31.798321Z",
+            "modified": "2024-11-16T00:21:31.798321Z",
+            "name": "CVE-2024-10825",
+            "description": "The Hide My WP Ghost – Security & Firewall plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the URL in all versions up to, and including, 5.3.01 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick an administrative user into performing an action such as clicking on a link.",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2024-10825"
+                }
+            ]
+        }
+    ]
+}

objects/vulnerability/vulnerability--0984127c-42fa-4026-b783-c448e3baf14a.json

@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--7774ec2e-1c22-4ddc-bf51-11b1a21cc3fa",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--0984127c-42fa-4026-b783-c448e3baf14a",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2024-11-16T00:21:35.941085Z",
+            "modified": "2024-11-16T00:21:35.941085Z",
+            "name": "CVE-2021-3902",
+            "description": "An improper restriction of external entities (XXE) vulnerability in dompdf/dompdf's SVG parser allows for Server-Side Request Forgery (SSRF) and deserialization attacks. This issue affects all versions prior to 2.0.0. The vulnerability can be exploited even if the isRemoteEnabled option is set to false. It allows attackers to perform SSRF, disclose internal image files, and cause PHAR deserialization attacks.",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2021-3902"
+                }
+            ]
+        }
+    ]
+}

objects/vulnerability/vulnerability--0a9f3067-375b-48d4-b258-afb9b28dfa5e.json

@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--a2840c59-1ac0-4f82-8569-6511fe67b5e5",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--0a9f3067-375b-48d4-b258-afb9b28dfa5e",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2024-11-16T00:21:31.474451Z",
+            "modified": "2024-11-16T00:21:31.474451Z",
+            "name": "CVE-2024-51037",
+            "description": "An issue in kodbox v.1.52.04 and before allows a remote attacker to obtain sensitive information via the captcha feature in the password reset function.",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2024-51037"
+                }
+            ]
+        }
+    ]
+}

objects/vulnerability/vulnerability--0b8d8c34-be56-4867-8f5e-3a6d003a31e9.json

@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--a6cf9996-7789-4abc-b7e2-a7da6e8d843c",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--0b8d8c34-be56-4867-8f5e-3a6d003a31e9",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2024-11-16T00:21:32.270239Z",
+            "modified": "2024-11-16T00:21:32.270239Z",
+            "name": "CVE-2024-11261",
+            "description": "A vulnerability, which was classified as critical, was found in SourceCodester Student Record Management System 1.0. Affected is an unknown function of the file StudentRecordManagementSystem.cpp of the component Number of Students Menu. The manipulation leads to memory corruption. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used.",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2024-11261"
+                }
+            ]
+        }
+    ]
+}

objects/vulnerability/vulnerability--0d6b4324-b6ae-4ccd-8c2b-31620b29067b.json

@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--470be92e-93db-4b33-87c2-58c1427c1486",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--0d6b4324-b6ae-4ccd-8c2b-31620b29067b",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2024-11-16T00:21:31.433085Z",
+            "modified": "2024-11-16T00:21:31.433085Z",
+            "name": "CVE-2024-24455",
+            "description": "An invalid memory access when handling a UE Context Release message containing an invalid UE identifier in Athonet vEPC MME v11.4.0 allows attackers to cause a Denial of Service (DoS) to the cellular network by repeatedly initiating connections and sending a crafted payload.",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2024-24455"
+                }
+            ]
+        }
+    ]
+}

objects/vulnerability/vulnerability--0df144ba-e6c1-4dbf-941a-b414a9382c79.json

@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--62ead2e7-9af2-4f8e-b992-34d2eeb64090",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--0df144ba-e6c1-4dbf-941a-b414a9382c79",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2024-11-16T00:21:32.248598Z",
+            "modified": "2024-11-16T00:21:32.248598Z",
+            "name": "CVE-2024-11250",
+            "description": "A vulnerability was found in code-projects Inventory Management up to 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /model/editProduct.php. The manipulation of the argument id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2024-11250"
+                }
+            ]
+        }
+    ]
+}