generated content from 2024-12-24

mapping.csv

@@ -260926,3 +260926,31 @@ vulnerability,CVE-2024-56313,vulnerability--f638b2a1-a738-4695-addf-3d9184457c55
 vulnerability,CVE-2024-56311,vulnerability--ca2773fb-7832-4dbd-a4ae-5ca23ab19cce
 vulnerability,CVE-2024-56378,vulnerability--304cc589-e312-4adf-960b-e122cf4bca04
 vulnerability,CVE-2024-56375,vulnerability--d95922d4-4e89-425c-86f8-ea6f8515151c
+vulnerability,CVE-2024-52321,vulnerability--09049a5e-2cb8-4b5f-a1a7-53bd9d0dc553
+vulnerability,CVE-2024-45387,vulnerability--feeb8dc3-5924-4838-9f0b-ebd362730702
+vulnerability,CVE-2024-45721,vulnerability--b6aca571-f7a7-4df7-8b03-e0bbd17fc014
+vulnerability,CVE-2024-12898,vulnerability--03e10ef3-9b3c-4c70-ad1a-cfd1a84609aa
+vulnerability,CVE-2024-12900,vulnerability--b621b70d-8cdb-435e-be9c-685bf3028be8
+vulnerability,CVE-2024-12899,vulnerability--6aab1982-9132-4608-93f1-a82d01692473
+vulnerability,CVE-2024-12903,vulnerability--a2ea7001-0b25-4bfa-9e95-3cac34466690
+vulnerability,CVE-2024-12901,vulnerability--5dd4825c-3b87-478d-9e56-e827cc0d2c9b
+vulnerability,CVE-2024-12902,vulnerability--8c8d6b20-61b8-4dcd-b954-987074a454d5
+vulnerability,CVE-2024-47864,vulnerability--2b6e8576-58e8-4297-b099-3b71179fd7a1
+vulnerability,CVE-2024-11230,vulnerability--1fa8099e-7f57-44ce-9b6d-7f3d97318d63
+vulnerability,CVE-2024-53961,vulnerability--17a14fc9-53e4-4b47-a7bc-8aa592ad695d
+vulnerability,CVE-2024-53276,vulnerability--a4538cc2-53ea-44be-936c-050b5ea2b956
+vulnerability,CVE-2024-53256,vulnerability--4f896d85-1447-4465-bd0f-958375f61f8e
+vulnerability,CVE-2024-53275,vulnerability--a6227b4c-6520-45e7-b810-0c0c2c3db4e9
+vulnerability,CVE-2024-40896,vulnerability--982221d7-1ea0-4ecf-815b-0bda3a400c02
+vulnerability,CVE-2024-54082,vulnerability--559f1c4d-23d0-4d70-a70e-de47e5aa4a58
+vulnerability,CVE-2024-54148,vulnerability--8b4af162-f996-47fe-afa0-d0a971920bf6
+vulnerability,CVE-2024-55539,vulnerability--5df6c9ae-3635-4582-8e75-5b24e1ff6faf
+vulnerability,CVE-2024-55947,vulnerability--1e6483a2-3e7c-4e17-9f5f-081ae4758ee8
+vulnerability,CVE-2024-23945,vulnerability--4670009f-67fe-4498-aa24-9608b7ebaccf
+vulnerability,CVE-2024-56326,vulnerability--5bed671b-3e09-401e-b06c-fe87b1fcdb7d
+vulnerability,CVE-2024-56362,vulnerability--5236a9f0-6203-403c-8ad3-20519cb04bb7
+vulnerability,CVE-2024-56364,vulnerability--bddf2341-4a79-480f-9951-532fed62d905
+vulnerability,CVE-2024-56363,vulnerability--79c9e86d-1104-40a1-8afd-35df6868f58d
+vulnerability,CVE-2024-56201,vulnerability--e4229411-5e1b-4a32-9dc2-9d35b92993d0
+vulnerability,CVE-2024-46873,vulnerability--4f4cf7ce-c6c5-4ada-9572-57cd9b6840af
+vulnerability,CVE-2018-25106,vulnerability--d3404f8d-fe10-4797-99ef-f1c2748c62fd

objects/vulnerability/vulnerability--03e10ef3-9b3c-4c70-ad1a-cfd1a84609aa.json

@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--05d73ca6-0850-4bc0-9fd7-854aec654c4d",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--03e10ef3-9b3c-4c70-ad1a-cfd1a84609aa",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2024-12-24T00:20:56.728514Z",
+            "modified": "2024-12-24T00:20:56.728514Z",
+            "name": "CVE-2024-12898",
+            "description": "A vulnerability was found in 1000 Projects Attendance Tracking Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /admin/faculty_action.php. The manipulation of the argument faculty_course_id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well.",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2024-12898"
+                }
+            ]
+        }
+    ]
+}

objects/vulnerability/vulnerability--09049a5e-2cb8-4b5f-a1a7-53bd9d0dc553.json

@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--99aee4b7-561f-444a-b1e0-7d475c74f6b7",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--09049a5e-2cb8-4b5f-a1a7-53bd9d0dc553",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2024-12-24T00:20:56.629254Z",
+            "modified": "2024-12-24T00:20:56.629254Z",
+            "name": "CVE-2024-52321",
+            "description": "Multiple SHARP routers contain an improper authentication vulnerability in the configuration backup function. The product's backup files containing sensitive information may be retrieved by a remote unauthenticated attacker.",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2024-52321"
+                }
+            ]
+        }
+    ]
+}

objects/vulnerability/vulnerability--17a14fc9-53e4-4b47-a7bc-8aa592ad695d.json

@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--4bb6cc41-c973-4e46-80b9-b6b54cb4e4a7",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--17a14fc9-53e4-4b47-a7bc-8aa592ad695d",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2024-12-24T00:20:57.512796Z",
+            "modified": "2024-12-24T00:20:57.512796Z",
+            "name": "CVE-2024-53961",
+            "description": "ColdFusion versions 2023.11, 2021.17 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary file system read. An attacker could exploit this vulnerability to access files or directories that are outside of the restricted directory set by the application. This could lead to the disclosure of sensitive information or the manipulation of system data.",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2024-53961"
+                }
+            ]
+        }
+    ]
+}

objects/vulnerability/vulnerability--1e6483a2-3e7c-4e17-9f5f-081ae4758ee8.json

@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--413add19-bfe9-4993-8d76-8ba40474f3e0",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--1e6483a2-3e7c-4e17-9f5f-081ae4758ee8",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2024-12-24T00:20:58.237428Z",
+            "modified": "2024-12-24T00:20:58.237428Z",
+            "name": "CVE-2024-55947",
+            "description": "Gogs is an open source self-hosted Git service. A malicious user is able to write a file to an arbitrary path on the server to gain SSH access to the server. The vulnerability is fixed in 0.13.1.",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2024-55947"
+                }
+            ]
+        }
+    ]
+}

objects/vulnerability/vulnerability--1fa8099e-7f57-44ce-9b6d-7f3d97318d63.json

@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--e6fba7df-b805-48cb-899c-cefaaaa107f1",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--1fa8099e-7f57-44ce-9b6d-7f3d97318d63",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2024-12-24T00:20:57.250915Z",
+            "modified": "2024-12-24T00:20:57.250915Z",
+            "name": "CVE-2024-11230",
+            "description": "The Elementor Header & Footer Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘size’ parameter in all versions up to, and including, 1.6.46 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2024-11230"
+                }
+            ]
+        }
+    ]
+}

objects/vulnerability/vulnerability--2b6e8576-58e8-4297-b099-3b71179fd7a1.json

@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--5f2d06e0-9fcb-41fd-8809-ef897855bd99",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--2b6e8576-58e8-4297-b099-3b71179fd7a1",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2024-12-24T00:20:56.981994Z",
+            "modified": "2024-12-24T00:20:56.981994Z",
+            "name": "CVE-2024-47864",
+            "description": "home 5G HR02, Wi-Fi STATION SH-52B, and Wi-Fi STATION SH-54C contain a buffer overflow vulnerability in the hidden debug function. A remote unauthenticated attacker may get the web console of the product down.",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2024-47864"
+                }
+            ]
+        }
+    ]
+}

objects/vulnerability/vulnerability--4670009f-67fe-4498-aa24-9608b7ebaccf.json

@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--f015a5fe-4c7f-4bdd-a59a-ad02a1cbfc27",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--4670009f-67fe-4498-aa24-9608b7ebaccf",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2024-12-24T00:20:58.322653Z",
+            "modified": "2024-12-24T00:20:58.322653Z",
+            "name": "CVE-2024-23945",
+            "description": "Signing cookies is an application security feature that adds a digital signature to cookie data to verify its authenticity and integrity. The signature helps prevent malicious actors from modifying the cookie value, which can lead to security vulnerabilities and exploitation. Apache Hive’s service component accidentally exposes the signed cookie to the end user when there is a mismatch in signature between the current and expected cookie. Exposing the correct cookie signature can lead to further exploitation.\n\nThe vulnerable CookieSigner logic was introduced in Apache Hive by HIVE-9710 (1.2.0) and in Apache Spark by SPARK-14987 (2.0.0). The affected components are the following:\n* org.apache.hive:hive-service\n* org.apache.spark:spark-hive-thriftserver_2.11\n* org.apache.spark:spark-hive-thriftserver_2.12",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2024-23945"
+                }
+            ]
+        }
+    ]
+}

objects/vulnerability/vulnerability--4f4cf7ce-c6c5-4ada-9572-57cd9b6840af.json

@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--b2efecdd-5234-4122-9ea3-ff9ba058e2c1",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--4f4cf7ce-c6c5-4ada-9572-57cd9b6840af",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2024-12-24T00:20:58.607768Z",
+            "modified": "2024-12-24T00:20:58.607768Z",
+            "name": "CVE-2024-46873",
+            "description": "Multiple SHARP routers leave the hidden debug function enabled. An arbitrary OS command may be executed with the root privilege by a remote unauthenticated attacker.",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2024-46873"
+                }
+            ]
+        }
+    ]
+}

objects/vulnerability/vulnerability--4f896d85-1447-4465-bd0f-958375f61f8e.json

@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--b5519e25-45ee-453a-ad37-3c2aabace8c1",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--4f896d85-1447-4465-bd0f-958375f61f8e",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2024-12-24T00:20:57.536198Z",
+            "modified": "2024-12-24T00:20:57.536198Z",
+            "name": "CVE-2024-53256",
+            "description": "Rizin is a UNIX-like reverse engineering framework and command-line toolset. `rizin.c` still had an old snippet of code which suffered a command injection due the usage of `rz_core_cmdf` to invoke the command `m` which was removed in v0.1.x. A malicious binary defining `bclass` (part of RzBinInfo) is executed if `rclass` (part of RzBinInfo) is set to `fs`; the vulnerability can be exploited by any bin format where `bclass` and `rclass` are user defined. This vulnerability is fixed in 0.7.4.",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2024-53256"
+                }
+            ]
+        }
+    ]
+}

objects/vulnerability/vulnerability--5236a9f0-6203-403c-8ad3-20519cb04bb7.json

@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--b3342f47-8424-435a-9d67-0cb6a88d5fe0",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--5236a9f0-6203-403c-8ad3-20519cb04bb7",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2024-12-24T00:20:58.362126Z",
+            "modified": "2024-12-24T00:20:58.362126Z",
+            "name": "CVE-2024-56362",
+            "description": "Navidrome is an open source web-based music collection server and streamer. Navidrome stores the JWT secret in plaintext in the navidrome.db database file under the property table. This practice introduces a security risk because anyone with access to the database file can retrieve the secret. This vulnerability is fixed in 0.54.1.",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2024-56362"
+                }
+            ]
+        }
+    ]
+}

objects/vulnerability/vulnerability--559f1c4d-23d0-4d70-a70e-de47e5aa4a58.json

@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--f8d3f79e-ed25-4bd1-85fa-bccdeef69b03",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--559f1c4d-23d0-4d70-a70e-de47e5aa4a58",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2024-12-24T00:20:58.158432Z",
+            "modified": "2024-12-24T00:20:58.158432Z",
+            "name": "CVE-2024-54082",
+            "description": "home 5G HR02 and Wi-Fi STATION SH-54C contain an OS command injection vulnerability in the configuration restore function. An arbitrary OS command may be executed with the root privilege by an administrative user.",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2024-54082"
+                }
+            ]
+        }
+    ]
+}

objects/vulnerability/vulnerability--5bed671b-3e09-401e-b06c-fe87b1fcdb7d.json

@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--de034797-f099-44f3-b999-d725e9d63c45",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--5bed671b-3e09-401e-b06c-fe87b1fcdb7d",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2024-12-24T00:20:58.357904Z",
+            "modified": "2024-12-24T00:20:58.357904Z",
+            "name": "CVE-2024-56326",
+            "description": "Jinja is an extensible templating engine. Prior to 3.1.5, An oversight in how the Jinja sandboxed environment detects calls to str.format allows an attacker that controls the content of a template to execute arbitrary Python code. To exploit the vulnerability, an attacker needs to control the content of a template. Whether that is the case depends on the type of application using Jinja. This vulnerability impacts users of applications which execute untrusted templates. Jinja's sandbox does catch calls to str.format and ensures they don't escape the sandbox. However, it's possible to store a reference to a malicious string's format method, then pass that to a filter that calls it. No such filters are built-in to Jinja, but could be present through custom filters in an application. After the fix, such indirect calls are also handled by the sandbox. This vulnerability is fixed in 3.1.5.",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2024-56326"
+                }
+            ]
+        }
+    ]
+}

objects/vulnerability/vulnerability--5dd4825c-3b87-478d-9e56-e827cc0d2c9b.json

@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--b9005233-a726-4691-aef8-9300e74694ba",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--5dd4825c-3b87-478d-9e56-e827cc0d2c9b",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2024-12-24T00:20:56.762275Z",
+            "modified": "2024-12-24T00:20:56.762275Z",
+            "name": "CVE-2024-12901",
+            "description": "A vulnerability classified as critical was found in FoxCMS up to 1.2. Affected by this vulnerability is an unknown functionality of the file /app/api/controller/Site.php of the component API Endpoint. The manipulation of the argument password leads to improper authorization. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2024-12901"
+                }
+            ]
+        }
+    ]
+}

objects/vulnerability/vulnerability--5df6c9ae-3635-4582-8e75-5b24e1ff6faf.json

@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--207ba622-b8be-46fc-affc-da95d6681d90",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--5df6c9ae-3635-4582-8e75-5b24e1ff6faf",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2024-12-24T00:20:58.23412Z",
+            "modified": "2024-12-24T00:20:58.23412Z",
+            "name": "CVE-2024-55539",
+            "description": "Weak algorithm used to sign RPM package. The following products are affected: Acronis Cyber Protect Cloud Agent (Linux) before build 39185.",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2024-55539"
+                }
+            ]
+        }
+    ]
+}

objects/vulnerability/vulnerability--6aab1982-9132-4608-93f1-a82d01692473.json

@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--b6fcd6cb-ac43-4934-b398-7af86fb20b07",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--6aab1982-9132-4608-93f1-a82d01692473",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2024-12-24T00:20:56.756867Z",
+            "modified": "2024-12-24T00:20:56.756867Z",
+            "name": "CVE-2024-12899",
+            "description": "A vulnerability was found in 1000 Projects Attendance Tracking Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /admin/course_action.php. The manipulation of the argument course_code leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2024-12899"
+                }
+            ]
+        }
+    ]
+}