generated content from 2024-12-23

mapping.csv

@@ -260910,3 +260910,19 @@ vulnerability,CVE-2024-11196,vulnerability--25cb9b92-26ec-4ed1-a9a7-9efdc1ddf142
 vulnerability,CVE-2024-11977,vulnerability--74d96956-7cf7-4604-af75-13bfb1ae2a48
 vulnerability,CVE-2024-11607,vulnerability--797941ab-8e17-4180-a0c1-d73677b697e9
 vulnerability,CVE-2024-11808,vulnerability--62b66969-a2e2-4a29-9b8e-dac8177f338b
+vulnerability,CVE-2024-12895,vulnerability--61da7e9a-459c-4113-9bcb-ed4b255964cd
+vulnerability,CVE-2024-12891,vulnerability--e1e61f63-0920-41ab-9947-ea11916ba61e
+vulnerability,CVE-2024-12896,vulnerability--9ca9c56a-20c2-4e79-9e0c-b14254f12023
+vulnerability,CVE-2024-12892,vulnerability--b6d99ca8-d29e-4a22-bd38-723f69369843
+vulnerability,CVE-2024-12897,vulnerability--8be02bbb-f9d2-43a4-81f5-cf7105b47dea
+vulnerability,CVE-2024-12890,vulnerability--17b36869-fc66-4ba7-a938-24e8fa1ca682
+vulnerability,CVE-2024-12894,vulnerability--ccb08721-d7ed-4f6e-b506-39fb795b250f
+vulnerability,CVE-2024-12893,vulnerability--8334b581-61c5-46ac-87be-92d520bf09fb
+vulnerability,CVE-2024-11852,vulnerability--1273dac5-52e1-4097-803c-8541bdecf1ef
+vulnerability,CVE-2024-56312,vulnerability--e9f4f5cf-2edc-4b5e-b347-67545eae1fb0
+vulnerability,CVE-2024-56310,vulnerability--c60b38d5-fdbc-4281-b4eb-05a5dd2c0d96
+vulnerability,CVE-2024-56314,vulnerability--6557586a-5847-46b2-9187-0723cac96edd
+vulnerability,CVE-2024-56313,vulnerability--f638b2a1-a738-4695-addf-3d9184457c55
+vulnerability,CVE-2024-56311,vulnerability--ca2773fb-7832-4dbd-a4ae-5ca23ab19cce
+vulnerability,CVE-2024-56378,vulnerability--304cc589-e312-4adf-960b-e122cf4bca04
+vulnerability,CVE-2024-56375,vulnerability--d95922d4-4e89-425c-86f8-ea6f8515151c

objects/vulnerability/vulnerability--1273dac5-52e1-4097-803c-8541bdecf1ef.json

@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--5c0652b6-9f96-40ba-8c7c-5ce18a0bcedb",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--1273dac5-52e1-4097-803c-8541bdecf1ef",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2024-12-23T00:21:51.116832Z",
+            "modified": "2024-12-23T00:21:51.116832Z",
+            "name": "CVE-2024-11852",
+            "description": "The Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid, Carousel and Remote Arrows) plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the get_layouts() function in all versions up to, and including, 5.10.12. This makes it possible for authenticated attackers, with Subscriber-level access and above, to obtain a detailed listing of layout templates.",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2024-11852"
+                }
+            ]
+        }
+    ]
+}

objects/vulnerability/vulnerability--17b36869-fc66-4ba7-a938-24e8fa1ca682.json

@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--e68769de-fa70-450d-b597-4b1beb77dc0f",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--17b36869-fc66-4ba7-a938-24e8fa1ca682",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2024-12-23T00:21:50.633Z",
+            "modified": "2024-12-23T00:21:50.633Z",
+            "name": "CVE-2024-12890",
+            "description": "A vulnerability was found in code-projects Online Exam Mastering System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /update.php?q=quiz&step=2. The manipulation of the argument eid leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2024-12890"
+                }
+            ]
+        }
+    ]
+}

objects/vulnerability/vulnerability--304cc589-e312-4adf-960b-e122cf4bca04.json

@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--102c3f7c-0ee8-4bea-bd11-024c86e53839",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--304cc589-e312-4adf-960b-e122cf4bca04",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2024-12-23T00:21:52.234497Z",
+            "modified": "2024-12-23T00:21:52.234497Z",
+            "name": "CVE-2024-56378",
+            "description": "libpoppler.so in Poppler through 24.12.0 has an out-of-bounds read vulnerability within the JBIG2Bitmap::combine function in JBIG2Stream.cc.",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2024-56378"
+                }
+            ]
+        }
+    ]
+}

objects/vulnerability/vulnerability--61da7e9a-459c-4113-9bcb-ed4b255964cd.json

@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--9d5d597e-c56b-49b3-82d5-6d70e9f9b458",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--61da7e9a-459c-4113-9bcb-ed4b255964cd",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2024-12-23T00:21:50.599913Z",
+            "modified": "2024-12-23T00:21:50.599913Z",
+            "name": "CVE-2024-12895",
+            "description": "A vulnerability has been found in TreasureHuntGame TreasureHunt up to 963e0e0 and classified as critical. Affected by this vulnerability is the function console_log of the file TreasureHunt/checkflag.php. The manipulation of the argument problema leads to sql injection. The attack can be launched remotely. The identifier of the patch is 8bcc649abc35b7734951be084bb522a532faac4e. It is recommended to apply a patch to fix this issue.",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2024-12895"
+                }
+            ]
+        }
+    ]
+}

objects/vulnerability/vulnerability--6557586a-5847-46b2-9187-0723cac96edd.json

@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--b60ea425-deab-46a9-9430-74a65942ba32",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--6557586a-5847-46b2-9187-0723cac96edd",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2024-12-23T00:21:52.224388Z",
+            "modified": "2024-12-23T00:21:52.224388Z",
+            "name": "CVE-2024-56314",
+            "description": "A stored cross-site scripting (XSS) vulnerability in the Project name of REDCap through 15.0.0 allows authenticated users to inject malicious scripts into the name field of a Project. When a user clicks on the project name to access it, the crafted payload is executed, potentially enabling the execution of arbitrary web scripts.",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2024-56314"
+                }
+            ]
+        }
+    ]
+}

objects/vulnerability/vulnerability--8334b581-61c5-46ac-87be-92d520bf09fb.json

@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--c3793726-e5ba-4027-91f2-4c32d49a79a9",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--8334b581-61c5-46ac-87be-92d520bf09fb",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2024-12-23T00:21:50.648842Z",
+            "modified": "2024-12-23T00:21:50.648842Z",
+            "name": "CVE-2024-12893",
+            "description": "A vulnerability, which was classified as problematic, has been found in Portabilis i-Educar up to 2.9. Affected by this issue is some unknown functionality of the file /usuarios/tipos/2 of the component Tipo de Usuário Page. The manipulation of the argument name leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2024-12893"
+                }
+            ]
+        }
+    ]
+}

objects/vulnerability/vulnerability--8be02bbb-f9d2-43a4-81f5-cf7105b47dea.json

@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--7f6a52fb-848b-4d3c-aec7-29345abccf92",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--8be02bbb-f9d2-43a4-81f5-cf7105b47dea",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2024-12-23T00:21:50.629853Z",
+            "modified": "2024-12-23T00:21:50.629853Z",
+            "name": "CVE-2024-12897",
+            "description": "A vulnerability was found in Intelbras VIP S3020 G2, VIP S4020 G2, VIP S4020 G3 and VIP S4320 G2 up to 20241222. It has been classified as critical. This affects an unknown part of the file ../mtd/Config/Sha1Account1 of the component Web Interface. The manipulation leads to path traversal: '../filedir'. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2024-12897"
+                }
+            ]
+        }
+    ]
+}

objects/vulnerability/vulnerability--9ca9c56a-20c2-4e79-9e0c-b14254f12023.json

@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--2216acae-ba78-4000-ad85-4b019682ea0b",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--9ca9c56a-20c2-4e79-9e0c-b14254f12023",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2024-12-23T00:21:50.618669Z",
+            "modified": "2024-12-23T00:21:50.618669Z",
+            "name": "CVE-2024-12896",
+            "description": "** UNSUPPPORTED WHEN ASSIGNED ** A vulnerability was found in Intelbras VIP S3020 G2, VIP S4020 G2, VIP S4020 G3 and VIP S4320 G2 up to 20241222 and classified as problematic. Affected by this issue is some unknown functionality of the file /web_caps/webCapsConfig of the component Web Interface. The manipulation leads to information disclosure. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor assesses that \"the information disclosed in the URL is not sensitive or poses any risk to the user\".",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2024-12896"
+                }
+            ]
+        }
+    ]
+}

objects/vulnerability/vulnerability--b6d99ca8-d29e-4a22-bd38-723f69369843.json

@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--0be978c5-6be6-4a8b-a63f-8807d686d4aa",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--b6d99ca8-d29e-4a22-bd38-723f69369843",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2024-12-23T00:21:50.628612Z",
+            "modified": "2024-12-23T00:21:50.628612Z",
+            "name": "CVE-2024-12892",
+            "description": "A vulnerability classified as problematic was found in code-projects Online Exam Mastering System 1.0. Affected by this vulnerability is an unknown functionality of the file /sign.php?q=account.php. The manipulation of the argument name/gender/college leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2024-12892"
+                }
+            ]
+        }
+    ]
+}

objects/vulnerability/vulnerability--c60b38d5-fdbc-4281-b4eb-05a5dd2c0d96.json

@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--a6baab1c-a991-41ff-951e-61a52e611c26",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--c60b38d5-fdbc-4281-b4eb-05a5dd2c0d96",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2024-12-23T00:21:52.221868Z",
+            "modified": "2024-12-23T00:21:52.221868Z",
+            "name": "CVE-2024-56310",
+            "description": "REDCap through 15.0.0 has a security flaw in the Project Dashboards name, exposing users to a Cross-Site Request Forgery (CSRF) attack. An attacker can exploit this by luring users into clicking on a Project Dashboards name that contains the malicious payload, which triggers a logout request and terminates their session. This vulnerability stems from the absence of CSRF protections on the logout functionality, allowing malicious actions to be executed without user consent.",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2024-56310"
+                }
+            ]
+        }
+    ]
+}

objects/vulnerability/vulnerability--ca2773fb-7832-4dbd-a4ae-5ca23ab19cce.json

@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--1561edde-9fcf-48ed-a3b0-30d649f73594",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--ca2773fb-7832-4dbd-a4ae-5ca23ab19cce",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2024-12-23T00:21:52.228571Z",
+            "modified": "2024-12-23T00:21:52.228571Z",
+            "name": "CVE-2024-56311",
+            "description": "REDCap through 15.0.0 has a security flaw in the Notes section of calendar events, exposing users to a Cross-Site Request Forgery (CSRF) attack. An attacker can exploit this by luring users into accessing a calendar event's notes, which triggers a logout request and terminates their session. This vulnerability stems from the absence of CSRF protections on the logout functionality, allowing malicious actions to be executed without user consent.",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2024-56311"
+                }
+            ]
+        }
+    ]
+}

objects/vulnerability/vulnerability--ccb08721-d7ed-4f6e-b506-39fb795b250f.json

@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--55c8e8ef-a10b-4a40-9ed8-1891c68a4642",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--ccb08721-d7ed-4f6e-b506-39fb795b250f",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2024-12-23T00:21:50.645009Z",
+            "modified": "2024-12-23T00:21:50.645009Z",
+            "name": "CVE-2024-12894",
+            "description": "A vulnerability, which was classified as critical, was found in TreasureHuntGame TreasureHunt up to 963e0e0. Affected is an unknown function of the file TreasureHunt/acesso.php. The manipulation of the argument usuario leads to sql injection. It is possible to launch the attack remotely. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The name of the patch is 8bcc649abc35b7734951be084bb522a532faac4e. It is recommended to apply a patch to fix this issue.",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2024-12894"
+                }
+            ]
+        }
+    ]
+}

objects/vulnerability/vulnerability--d95922d4-4e89-425c-86f8-ea6f8515151c.json

@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--7820e214-571e-4f62-9618-0f5cb3e57789",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--d95922d4-4e89-425c-86f8-ea6f8515151c",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2024-12-23T00:21:52.240239Z",
+            "modified": "2024-12-23T00:21:52.240239Z",
+            "name": "CVE-2024-56375",
+            "description": "An integer underflow was discovered in Fort 1.6.3 and 1.6.4 before 1.6.5. A malicious RPKI repository that descends from a (trusted) Trust Anchor can serve (via rsync or RRDP) a Manifest RPKI object containing an empty fileList. Fort dereferences (and, shortly afterwards, writes to) this array during a shuffle attempt, before the validation that would normally reject it when empty. This out-of-bounds access is caused by an integer underflow that causes the surrounding loop to iterate infinitely. Because the product is permanently stuck attempting to overshuffle an array that doesn't actually exist, a crash is nearly guaranteed.",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2024-56375"
+                }
+            ]
+        }
+    ]
+}

objects/vulnerability/vulnerability--e1e61f63-0920-41ab-9947-ea11916ba61e.json

@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--030b73ca-2c00-4fc4-89f2-8f2698a650b9",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--e1e61f63-0920-41ab-9947-ea11916ba61e",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2024-12-23T00:21:50.613112Z",
+            "modified": "2024-12-23T00:21:50.613112Z",
+            "name": "CVE-2024-12891",
+            "description": "A vulnerability classified as critical has been found in code-projects Online Exam Mastering System 1.0. Affected is an unknown function of the file /account.php?q=quiz&step=2. The manipulation of the argument eid leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2024-12891"
+                }
+            ]
+        }
+    ]
+}

objects/vulnerability/vulnerability--e9f4f5cf-2edc-4b5e-b347-67545eae1fb0.json

@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--09a18add-3960-44d2-bc4e-190d4cda6d07",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--e9f4f5cf-2edc-4b5e-b347-67545eae1fb0",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2024-12-23T00:21:52.218391Z",
+            "modified": "2024-12-23T00:21:52.218391Z",
+            "name": "CVE-2024-56312",
+            "description": "A stored cross-site scripting (XSS) vulnerability in the Project Dashboard name of REDCap through 15.0.0 allows authenticated users to inject malicious scripts into the name field of a Project Dashboard. When a user clicks on the project Dashboard name, the crafted payload is executed, potentially enabling the execution of arbitrary web scripts.",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2024-56312"
+                }
+            ]
+        }
+    ]
+}