generated content from 2024-09-29

mapping.csv

@@ -250443,3 +250443,33 @@ vulnerability,CVE-2024-47077,vulnerability--6e7faa8b-020d-4a5b-8ae1-a18b2cb135b2
 vulnerability,CVE-2024-47186,vulnerability--bf62d72f-aadb-497c-a18e-094b5ebfaa54
 vulnerability,CVE-2024-47070,vulnerability--2c87e502-c8ab-42b1-b035-5fb16a0a19d0
 vulnerability,CVE-2024-47182,vulnerability--d8507f99-d3e4-469e-883e-4fb0e9c40bdc
+vulnerability,CVE-2024-9316,vulnerability--834de480-7a2c-4ed9-9ee6-4e1ee65d882c
+vulnerability,CVE-2024-9317,vulnerability--ecf2ff50-0afb-43de-b41c-c0fd1520361c
+vulnerability,CVE-2024-9295,vulnerability--e3e24298-f846-4d10-a52a-c3ed11db19b0
+vulnerability,CVE-2024-9299,vulnerability--11b0e8f6-f728-4aae-b1cb-9b21978987aa
+vulnerability,CVE-2024-9319,vulnerability--4e7b6c97-901f-41e9-9974-81e01892349a
+vulnerability,CVE-2024-9300,vulnerability--edd64d56-8f06-4f8a-b0f0-e6c6d2a42784
+vulnerability,CVE-2024-9318,vulnerability--33444de0-280b-48ea-95e9-05674f0ac688
+vulnerability,CVE-2024-9297,vulnerability--313ad78b-8a01-4f58-8375-465debe85838
+vulnerability,CVE-2024-9315,vulnerability--4e2fb5b9-d2cf-4077-918a-63e57260f629
+vulnerability,CVE-2024-9296,vulnerability--ef031c79-6ebb-45a1-a038-fab243b55c06
+vulnerability,CVE-2024-9298,vulnerability--49e2bbe6-efce-44fc-8f5f-67062c053789
+vulnerability,CVE-2024-9023,vulnerability--6899b06d-23c1-4dc3-ae23-ffc6451bee2f
+vulnerability,CVE-2024-9320,vulnerability--b43b8e89-ace3-4ba3-95ef-cd52a80836c3
+vulnerability,CVE-2024-9189,vulnerability--f9ed7de6-66a6-428d-bdda-19c620300175
+vulnerability,CVE-2024-8353,vulnerability--8c140e08-5039-4ccc-ae3d-d24e041ea27f
+vulnerability,CVE-2024-8189,vulnerability--63597722-3daa-4ba7-b585-ff27f4ea9f5a
+vulnerability,CVE-2024-8788,vulnerability--3c92ac67-9de8-4ae3-9fe9-b3a9f50bcf3f
+vulnerability,CVE-2024-8547,vulnerability--69517506-21ca-43de-807f-64a726189f57
+vulnerability,CVE-2024-8715,vulnerability--24e63025-2fd5-40cb-80b0-e7e72e88f25e
+vulnerability,CVE-2024-8712,vulnerability--101c9c44-deea-423a-9a2a-059b332484fa
+vulnerability,CVE-2024-23961,vulnerability--3a7ab6d5-5e26-4754-94d2-6adb955f3dae
+vulnerability,CVE-2024-23957,vulnerability--e366e75a-26a1-49c9-a700-96f197062d09
+vulnerability,CVE-2024-23959,vulnerability--5f4061f8-1121-4b74-bc1d-c2c616c1ea03
+vulnerability,CVE-2024-23938,vulnerability--f5834857-d14c-4313-8d26-6a1477b2f342
+vulnerability,CVE-2024-23967,vulnerability--196f5dda-ed2f-4afa-8379-0118f45e2627
+vulnerability,CVE-2024-23960,vulnerability--7614ba8c-87a8-4053-b8c9-85acca5a8262
+vulnerability,CVE-2024-23923,vulnerability--f261d37f-c7c2-42d3-a75b-cff05942f18d
+vulnerability,CVE-2024-23958,vulnerability--0e31a059-2540-402d-b710-3ce656708401
+vulnerability,CVE-2024-23924,vulnerability--637585fc-6a9e-418d-9aba-63152599585c
+vulnerability,CVE-2024-23935,vulnerability--09f23506-9328-41ea-a308-f3e2565a2c73

objects/vulnerability/vulnerability--09f23506-9328-41ea-a308-f3e2565a2c73.json

@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--3e13e0be-713b-48b1-97d0-11f0c13618ba",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--09f23506-9328-41ea-a308-f3e2565a2c73",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2024-09-29T00:22:41.317867Z",
+            "modified": "2024-09-29T00:22:41.317867Z",
+            "name": "CVE-2024-23935",
+            "description": "Alpine Halo9 DecodeUTF7 Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Alpine Halo9 devices. An attacker must first obtain the ability to pair a malicious Bluetooth device with the target system in order to exploit this vulnerability.\n\nThe specific flaw exists within the DecodeUTF7 function. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root.\n\nWas ZDI-CAN-23249",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2024-23935"
+                }
+            ]
+        }
+    ]
+}

objects/vulnerability/vulnerability--0e31a059-2540-402d-b710-3ce656708401.json

@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--ff6a25e3-c46b-437c-8c3d-5aa8e769adce",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--0e31a059-2540-402d-b710-3ce656708401",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2024-09-29T00:22:41.314337Z",
+            "modified": "2024-09-29T00:22:41.314337Z",
+            "name": "CVE-2024-23958",
+            "description": "Autel MaxiCharger AC Elite Business C50 BLE Hardcoded Credentials Authentication Bypass Vulnerability. This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of Autel MaxiCharger AC Elite Business C50 charging stations. Authentication is not required to exploit this vulnerability.\n\nThe specific flaw exists within the BLE AppAuthenRequest command handler. The handler uses hardcoded credentials as a fallback in case of an authentication request failure. An attacker can leverage this vulnerability to bypass authentication on the system.\n\nWas ZDI-CAN-23196",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2024-23958"
+                }
+            ]
+        }
+    ]
+}

objects/vulnerability/vulnerability--101c9c44-deea-423a-9a2a-059b332484fa.json

@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--164a4942-fcb3-4b00-9a64-b47dafe5dce6",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--101c9c44-deea-423a-9a2a-059b332484fa",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2024-09-29T00:22:41.111339Z",
+            "modified": "2024-09-29T00:22:41.111339Z",
+            "name": "CVE-2024-8712",
+            "description": "The GTM Server Side plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 2.1.19. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2024-8712"
+                }
+            ]
+        }
+    ]
+}

objects/vulnerability/vulnerability--11b0e8f6-f728-4aae-b1cb-9b21978987aa.json

@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--72e42a08-5e01-44ae-ad31-4089ebf9b60a",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--11b0e8f6-f728-4aae-b1cb-9b21978987aa",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2024-09-29T00:22:41.04425Z",
+            "modified": "2024-09-29T00:22:41.04425Z",
+            "name": "CVE-2024-9299",
+            "description": "A vulnerability classified as problematic has been found in SourceCodester Online Railway Reservation System 1.0. This affects an unknown part of the file /?page=reserve. The manipulation of the argument First Name/Middle Name/Last Name leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2024-9299"
+                }
+            ]
+        }
+    ]
+}

objects/vulnerability/vulnerability--196f5dda-ed2f-4afa-8379-0118f45e2627.json

@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--deb63695-09ab-454a-a577-24abc68c811d",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--196f5dda-ed2f-4afa-8379-0118f45e2627",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2024-09-29T00:22:41.292113Z",
+            "modified": "2024-09-29T00:22:41.292113Z",
+            "name": "CVE-2024-23967",
+            "description": "Autel MaxiCharger AC Elite Business C50 WebSocket Base64 Decoding Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Autel MaxiCharger AC Elite Business C50 chargers. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed.\n\nThe specific flaw exists within the handling of base64-encoded data within WebSocket messages. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the device.\n\nWas ZDI-CAN-23230",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2024-23967"
+                }
+            ]
+        }
+    ]
+}

objects/vulnerability/vulnerability--24e63025-2fd5-40cb-80b0-e7e72e88f25e.json

@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--047c6ead-323f-41bd-91cd-8296bb9c74e7",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--24e63025-2fd5-40cb-80b0-e7e72e88f25e",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2024-09-29T00:22:41.109905Z",
+            "modified": "2024-09-29T00:22:41.109905Z",
+            "name": "CVE-2024-8715",
+            "description": "The Simple LDAP Login plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 1.6.0. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2024-8715"
+                }
+            ]
+        }
+    ]
+}

objects/vulnerability/vulnerability--313ad78b-8a01-4f58-8375-465debe85838.json

@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--0f2a5eb6-8c29-4ebb-a4a9-157e1822dfcd",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--313ad78b-8a01-4f58-8375-465debe85838",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2024-09-29T00:22:41.052985Z",
+            "modified": "2024-09-29T00:22:41.052985Z",
+            "name": "CVE-2024-9297",
+            "description": "A vulnerability was found in SourceCodester Online Railway Reservation System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /admin/. The manipulation of the argument page with the input trains/schedules/system_info leads to improper authorization. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2024-9297"
+                }
+            ]
+        }
+    ]
+}

objects/vulnerability/vulnerability--33444de0-280b-48ea-95e9-05674f0ac688.json

@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--a9739828-2a87-4467-8646-e25a1945250f",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--33444de0-280b-48ea-95e9-05674f0ac688",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2024-09-29T00:22:41.050318Z",
+            "modified": "2024-09-29T00:22:41.050318Z",
+            "name": "CVE-2024-9318",
+            "description": "A vulnerability, which was classified as critical, has been found in SourceCodester Advocate Office Management System 1.0. Affected by this issue is some unknown functionality of the file /control/activate.php. The manipulation of the argument id leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2024-9318"
+                }
+            ]
+        }
+    ]
+}

objects/vulnerability/vulnerability--3a7ab6d5-5e26-4754-94d2-6adb955f3dae.json

@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--fd49ea2e-b69d-4763-84a4-3492e3ee9b5a",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--3a7ab6d5-5e26-4754-94d2-6adb955f3dae",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2024-09-29T00:22:41.27322Z",
+            "modified": "2024-09-29T00:22:41.27322Z",
+            "name": "CVE-2024-23961",
+            "description": "Alpine Halo9 UPDM_wemCmdUpdFSpeDecomp Command Injection Remote Code Execution Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Alpine Halo9 devices. Authentication is not required to exploit this vulnerability.\n\nThe specific flaw exists within the UPDM_wemCmdUpdFSpeDecomp function. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root.\n\nWas ZDI-CAN-23306",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2024-23961"
+                }
+            ]
+        }
+    ]
+}

objects/vulnerability/vulnerability--3c92ac67-9de8-4ae3-9fe9-b3a9f50bcf3f.json

@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--79e0414f-dbea-4dd3-8f41-dd00a46e0f76",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--3c92ac67-9de8-4ae3-9fe9-b3a9f50bcf3f",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2024-09-29T00:22:41.085638Z",
+            "modified": "2024-09-29T00:22:41.085638Z",
+            "name": "CVE-2024-8788",
+            "description": "The EU/UK VAT Manager for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 2.12.11. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2024-8788"
+                }
+            ]
+        }
+    ]
+}

objects/vulnerability/vulnerability--49e2bbe6-efce-44fc-8f5f-67062c053789.json

@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--699a0206-4721-4615-a785-dbb74d0922f5",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--49e2bbe6-efce-44fc-8f5f-67062c053789",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2024-09-29T00:22:41.06115Z",
+            "modified": "2024-09-29T00:22:41.06115Z",
+            "name": "CVE-2024-9298",
+            "description": "A vulnerability was found in SourceCodester Online Railway Reservation System 1.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /?page=tickets of the component Ticket Handler. The manipulation of the argument id leads to improper access controls. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2024-9298"
+                }
+            ]
+        }
+    ]
+}

objects/vulnerability/vulnerability--4e2fb5b9-d2cf-4077-918a-63e57260f629.json

@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--2455b882-df3e-4d4c-b010-341030f3fb40",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--4e2fb5b9-d2cf-4077-918a-63e57260f629",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2024-09-29T00:22:41.055322Z",
+            "modified": "2024-09-29T00:22:41.055322Z",
+            "name": "CVE-2024-9315",
+            "description": "A vulnerability was found in SourceCodester Employee and Visitor Gate Pass Logging System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /admin/maintenance/manage_department.php. The manipulation of the argument id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2024-9315"
+                }
+            ]
+        }
+    ]
+}

objects/vulnerability/vulnerability--4e7b6c97-901f-41e9-9974-81e01892349a.json

@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--98dccea7-1ff4-4553-8a7f-8fd664deecdf",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--4e7b6c97-901f-41e9-9974-81e01892349a",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2024-09-29T00:22:41.046019Z",
+            "modified": "2024-09-29T00:22:41.046019Z",
+            "name": "CVE-2024-9319",
+            "description": "A vulnerability, which was classified as critical, was found in SourceCodester Online Timesheet App 1.0. This affects an unknown part of the file /endpoint/delete-timesheet.php. The manipulation of the argument timesheet leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2024-9319"
+                }
+            ]
+        }
+    ]
+}