generated content from 2024-10-30

objects/vulnerability/vulnerability--007dfe92-857e-4acd-97da-aa91e491a028.json

@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--9597d3fe-6b36-4f09-b67b-2e3225568c59",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--007dfe92-857e-4acd-97da-aa91e491a028",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2024-10-30T00:20:57.513314Z",
+            "modified": "2024-10-30T00:20:57.513314Z",
+            "name": "CVE-2024-22065",
+            "description": "There is a command injection vulnerability in ZTE MF258 Pro product. Due to insufficient validation of Ping Diagnosis interface parameter, an authenticated attacker could use the vulnerability to execute arbitrary commands.",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2024-22065"
+                }
+            ]
+        }
+    ]
+}

objects/vulnerability/vulnerability--036d7a7c-59bd-4e57-a493-98df778a4b24.json

@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--9d8c1a27-54af-4398-a68c-1c69dceb62b6",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--036d7a7c-59bd-4e57-a493-98df778a4b24",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2024-10-30T00:20:58.937136Z",
+            "modified": "2024-10-30T00:20:58.937136Z",
+            "name": "CVE-2024-6673",
+            "description": "A Cross-Site Request Forgery (CSRF) vulnerability exists in the `install_comfyui` endpoint of the `lollms_comfyui.py` file in the parisneo/lollms-webui repository, versions v9.9 to the latest. The endpoint uses the GET method without requiring a client ID, allowing an attacker to trick a victim into installing ComfyUI. If the victim's device does not have sufficient capacity, this can result in a crash.",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2024-6673"
+                }
+            ]
+        }
+    ]
+}

objects/vulnerability/vulnerability--03ad0c17-1399-48f7-9844-26b4026abe0e.json

@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--2ba731e4-dc27-40ff-85ec-404635495061",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--03ad0c17-1399-48f7-9844-26b4026abe0e",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2024-10-30T00:20:56.80555Z",
+            "modified": "2024-10-30T00:20:56.80555Z",
+            "name": "CVE-2024-47640",
+            "description": "Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in weDevs WP ERP allows Reflected XSS.This issue affects WP ERP: from n/a through 1.13.2.",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2024-47640"
+                }
+            ]
+        }
+    ]
+}

objects/vulnerability/vulnerability--0400551b-ea82-4fdb-a49f-b7efbdb5bb81.json

@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--5ac943df-ee8b-41df-a4e7-7a8d078c46bd",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--0400551b-ea82-4fdb-a49f-b7efbdb5bb81",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2024-10-30T00:20:57.96485Z",
+            "modified": "2024-10-30T00:20:57.96485Z",
+            "name": "CVE-2024-49632",
+            "description": "Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Coral Web Design CWD 3D Image Gallery allows Reflected XSS.This issue affects CWD 3D Image Gallery: from n/a through 1.0.",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2024-49632"
+                }
+            ]
+        }
+    ]
+}

objects/vulnerability/vulnerability--05671312-9d9e-4069-9b38-4edda3f03468.json

@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--0b19952d-4cd0-45ae-9eb6-f3ef1cece099",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--05671312-9d9e-4069-9b38-4edda3f03468",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2024-10-30T00:20:56.640838Z",
+            "modified": "2024-10-30T00:20:56.640838Z",
+            "name": "CVE-2024-10226",
+            "description": "The Arconix Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'box' shortcode in all versions up to, and including, 2.1.13 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2024-10226"
+                }
+            ]
+        }
+    ]
+}

objects/vulnerability/vulnerability--0a374020-b150-45e5-bfbc-c033873849c7.json

@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--0dc1905c-8f66-421f-8ac8-cc725c36b8ef",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--0a374020-b150-45e5-bfbc-c033873849c7",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2024-10-30T00:20:56.703849Z",
+            "modified": "2024-10-30T00:20:56.703849Z",
+            "name": "CVE-2024-9827",
+            "description": "A maliciously crafted CATPART file when parsed in CC5Dll.dll through Autodesk AutoCAD can force an Out-of-Bounds Read vulnerability.  A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process.",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2024-9827"
+                }
+            ]
+        }
+    ]
+}

objects/vulnerability/vulnerability--0a71ac7d-d384-41f4-a811-a506ad86792e.json

@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--3593621f-7427-4cd1-8a38-3e98c89b2650",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--0a71ac7d-d384-41f4-a811-a506ad86792e",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2024-10-30T00:20:57.014827Z",
+            "modified": "2024-10-30T00:20:57.014827Z",
+            "name": "CVE-2024-7010",
+            "description": "mudler/localai version 2.17.1 is vulnerable to a Timing Attack. This type of side-channel attack allows an attacker to compromise the cryptosystem by analyzing the time taken to execute cryptographic algorithms. Specifically, in the context of password handling, an attacker can determine valid login credentials based on the server's response time, potentially leading to unauthorized access.",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2024-7010"
+                }
+            ]
+        }
+    ]
+}

objects/vulnerability/vulnerability--0baaaab8-81ec-4ecf-bcad-371567dffecf.json

@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--2b29b370-e142-416b-b995-6d859bad3a73",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--0baaaab8-81ec-4ecf-bcad-371567dffecf",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2024-10-30T00:20:56.453465Z",
+            "modified": "2024-10-30T00:20:56.453465Z",
+            "name": "CVE-2024-48138",
+            "description": "A remote code execution (RCE) vulnerability in the component /PluXml/core/admin/parametres_edittpl.php of PluXml v5.8.16 and lower allows attackers to execute arbitrary code via injecting a crafted payload into a template.",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2024-48138"
+                }
+            ]
+        }
+    ]
+}

objects/vulnerability/vulnerability--0bb31f84-16f6-487a-a227-0319bfbb2d8f.json

@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--bc206c6c-734b-41d2-82d7-b37a6549528e",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--0bb31f84-16f6-487a-a227-0319bfbb2d8f",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2024-10-30T00:20:56.714486Z",
+            "modified": "2024-10-30T00:20:56.714486Z",
+            "name": "CVE-2024-9489",
+            "description": "A maliciously crafted DWG file when parsed in ACAD.exe through Autodesk AutoCAD can force a Memory Corruption vulnerability. A malicious actor can leverage this vulnerability to cause a crash, write sensitive data, or execute arbitrary code in the context of the current process.",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2024-9489"
+                }
+            ]
+        }
+    ]
+}

objects/vulnerability/vulnerability--0bc5726c-0abe-45c5-8983-5900bc5e46b1.json

@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--efc09dbd-8f32-497b-b9e7-0311418ca943",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--0bc5726c-0abe-45c5-8983-5900bc5e46b1",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2024-10-30T00:20:57.417405Z",
+            "modified": "2024-10-30T00:20:57.417405Z",
+            "name": "CVE-2024-8596",
+            "description": "A maliciously crafted MODEL file when parsed in libodxdll.dll through Autodesk AutoCAD can force an Out-of-Bound Write vulnerability. A malicious actor can leverage this vulnerability to cause a crash, write sensitive data, or execute arbitrary code in the context of the current process.",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2024-8596"
+                }
+            ]
+        }
+    ]
+}

objects/vulnerability/vulnerability--0d2c81a4-960f-49bd-9950-1134eee37528.json

@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--6c235857-5d77-428e-9324-921cde36cf99",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--0d2c81a4-960f-49bd-9950-1134eee37528",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2024-10-30T00:20:56.911279Z",
+            "modified": "2024-10-30T00:20:56.911279Z",
+            "name": "CVE-2024-50414",
+            "description": "Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in VirusTran Button contact VR allows Stored XSS.This issue affects Button contact VR: from n/a through 4.7.9.1.",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2024-50414"
+                }
+            ]
+        }
+    ]
+}

objects/vulnerability/vulnerability--0fc896c6-2460-493a-98bb-20de3d018ee9.json

@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--21aa6d06-ccc4-445a-bff0-979436bfe85b",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--0fc896c6-2460-493a-98bb-20de3d018ee9",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2024-10-30T00:20:58.004505Z",
+            "modified": "2024-10-30T00:20:58.004505Z",
+            "name": "CVE-2024-49642",
+            "description": "Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Rafasashi Todo Custom Field allows Reflected XSS.This issue affects Todo Custom Field: from n/a through 3.0.4.",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2024-49642"
+                }
+            ]
+        }
+    ]
+}

objects/vulnerability/vulnerability--10ab22a3-8a3a-4cdb-82e4-48d140c6e9af.json

@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--7c7b3ab6-2df8-4da4-83f9-e98c54e67348",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--10ab22a3-8a3a-4cdb-82e4-48d140c6e9af",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2024-10-30T00:20:56.60199Z",
+            "modified": "2024-10-30T00:20:56.60199Z",
+            "name": "CVE-2024-45656",
+            "description": "IBM Flexible Service Processor (FSP) FW860.00 through FW860.B3, FW950.00 through FW950.C0, FW1030.00 through FW1030.61, FW1050.00 through FW1050.21, and FW1060.00 through FW1060.10 has static credentials which may allow network users to gain service privileges to the FSP.",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2024-45656"
+                }
+            ]
+        }
+    ]
+}

objects/vulnerability/vulnerability--12128078-1049-43a1-9a49-fd4903d32fc9.json

@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--eb6e5952-6827-4af6-9fbe-c577f1b50ff4",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--12128078-1049-43a1-9a49-fd4903d32fc9",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2024-10-30T00:20:56.661268Z",
+            "modified": "2024-10-30T00:20:56.661268Z",
+            "name": "CVE-2024-10459",
+            "description": "An attacker could have caused a use-after-free when accessibility was enabled, leading to a potentially exploitable crash. This vulnerability affects Firefox < 132, Firefox ESR < 128.4, Firefox ESR < 115.17, Thunderbird < 128.4, and Thunderbird < 132.",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2024-10459"
+                }
+            ]
+        }
+    ]
+}

objects/vulnerability/vulnerability--134e04d3-ab81-4640-81cd-00bc5640afe5.json

@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--f85fc5c9-a0fb-4692-b073-9eec9df4378c",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--134e04d3-ab81-4640-81cd-00bc5640afe5",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2024-10-30T00:20:57.011451Z",
+            "modified": "2024-10-30T00:20:57.011451Z",
+            "name": "CVE-2024-7991",
+            "description": "A maliciously crafted DWG file, when parsed through Autodesk AutoCAD and certain AutoCAD-based products, can force an Out-of-Bounds Write. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process.",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2024-7991"
+                }
+            ]
+        }
+    ]
+}

objects/vulnerability/vulnerability--15d9f944-a589-49a3-bf0d-381130baf78b.json

@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--c2784cb4-9f6a-4586-ae90-20d293e50d39",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--15d9f944-a589-49a3-bf0d-381130baf78b",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2024-10-30T00:20:56.794015Z",
+            "modified": "2024-10-30T00:20:56.794015Z",
+            "name": "CVE-2024-47401",
+            "description": "Mattermost versions 9.10.x <= 9.10.2, 9.11.x <= 9.11.1 and 9.5.x <= 9.5.9 fail to prevent detailed error messages from being displayed in Playbooks which allows an attacker to generate a large response and cause an amplified GraphQL response which in turn could cause the application to crash by sending a specially crafted request to Playbooks.",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2024-47401"
+                }
+            ]
+        }
+    ]
+}