Logo
-

Byte Open Security

(ByteOS Network)

Log In

Sign Up

ByteOS

Security
Vulnerability Details
Registries
Custom Views
Weaknesses
Attack Patterns
Filters & Tools
Vulnerability Details :

CVE-2024-33335

Summary
Assigner-mitre
Assigner Org ID-8254265b-2729-46b6-b9e3-3dfca2d5bfca
Published At-20 Jun, 2024 | 00:00
Updated At-02 Aug, 2024 | 02:27
Rejected At-
Credits

SQL Injection vulnerability in H3C technology company SeaSQL DWS V2.0 allows a remote attacker to execute arbitrary code via a crafted file.

Vendors
-
Not available
Products
-
Metrics (CVSS)
VersionBase scoreBase severityVector
Weaknesses
Attack Patterns
Solution/Workaround
References
HyperlinkResource Type
EPSS History
Score
Latest Score
-
N/A
No data available for selected date range
Percentile
Latest Percentile
-
N/A
No data available for selected date range
Stakeholder-Specific Vulnerability Categorization (SSVC)
▼Common Vulnerabilities and Exposures (CVE)
cve.org
Assigner:mitre
Assigner Org ID:8254265b-2729-46b6-b9e3-3dfca2d5bfca
Published At:20 Jun, 2024 | 00:00
Updated At:02 Aug, 2024 | 02:27
Rejected At:
▼CVE Numbering Authority (CNA)

SQL Injection vulnerability in H3C technology company SeaSQL DWS V2.0 allows a remote attacker to execute arbitrary code via a crafted file.

Affected Products
Vendor
n/a
Product
n/a
Versions
Affected
  • n/a
Problem Types
TypeCWE IDDescription
textN/An/a
Type: text
CWE ID: N/A
Description: n/a
Metrics
VersionBase scoreBase severityVector
Metrics Other Info
Impacts
CAPEC IDDescription
Solutions
Configurations
Workarounds
Exploits
Credits
Timeline
EventDate
Replaced By
Rejected Reason
References
HyperlinkResource
https://www.h3c.com/cn/
N/A
https://gist.github.com/vrhappy/08cb4c8721eed8a74fe786ecdff1ec1e
N/A
https://www.h3c.com/cn/Service/Online_Help/psirt/
N/A
Hyperlink: https://www.h3c.com/cn/
Resource: N/A
Hyperlink: https://gist.github.com/vrhappy/08cb4c8721eed8a74fe786ecdff1ec1e
Resource: N/A
Hyperlink: https://www.h3c.com/cn/Service/Online_Help/psirt/
Resource: N/A
▼Authorized Data Publishers (ADP)
1. CISA ADP Vulnrichment
Affected Products
Vendor
New H3C Technologies Co., Ltd.h3c
Product
seasql_dws
CPEs
  • cpe:2.3:a:h3c:seasql_dws:*:*:*:*:*:*:*:*
Default Status
unknown
Versions
Affected
  • 2.0
Problem Types
TypeCWE IDDescription
CWECWE-94CWE-94 Improper Control of Generation of Code ('Code Injection')
Type: CWE
CWE ID: CWE-94
Description: CWE-94 Improper Control of Generation of Code ('Code Injection')
Metrics
VersionBase scoreBase severityVector
3.16.3MEDIUM
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Version: 3.1
Base score: 6.3
Base severity: MEDIUM
Vector:
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Metrics Other Info
Impacts
CAPEC IDDescription
Solutions
Configurations
Workarounds
Exploits
Credits
Timeline
EventDate
Replaced By
Rejected Reason
References
HyperlinkResource
2. CVE Program Container
Affected Products
Metrics
VersionBase scoreBase severityVector
Metrics Other Info
Impacts
CAPEC IDDescription
Solutions
Configurations
Workarounds
Exploits
Credits
Timeline
EventDate
Replaced By
Rejected Reason
References
HyperlinkResource
https://www.h3c.com/cn/
x_transferred
https://gist.github.com/vrhappy/08cb4c8721eed8a74fe786ecdff1ec1e
x_transferred
https://www.h3c.com/cn/Service/Online_Help/psirt/
x_transferred
Hyperlink: https://www.h3c.com/cn/
Resource:
x_transferred
Hyperlink: https://gist.github.com/vrhappy/08cb4c8721eed8a74fe786ecdff1ec1e
Resource:
x_transferred
Hyperlink: https://www.h3c.com/cn/Service/Online_Help/psirt/
Resource:
x_transferred
Information is not available yet
▼National Vulnerability Database (NVD)
nvd.nist.gov
Source:cve@mitre.org
Published At:20 Jun, 2024 | 17:15
Updated At:24 Jun, 2024 | 15:15

SQL Injection vulnerability in H3C technology company SeaSQL DWS V2.0 allows a remote attacker to execute arbitrary code via a crafted file.

CISA Catalog
Date AddedDue DateVulnerability NameRequired Action
N/A
Date Added: N/A
Due Date: N/A
Vulnerability Name: N/A
Required Action: N/A
Metrics
TypeVersionBase scoreBase severityVector
CPE Matches
Evaluator Description
Evaluator Impact

Evaluator Solution

Vendor Statements
References
HyperlinkSourceResource
https://gist.github.com/vrhappy/08cb4c8721eed8a74fe786ecdff1ec1ecve@mitre.org
N/A
https://www.h3c.com/cn/cve@mitre.org
N/A
https://www.h3c.com/cn/Service/Online_Help/psirt/cve@mitre.org
N/A
Hyperlink: https://gist.github.com/vrhappy/08cb4c8721eed8a74fe786ecdff1ec1e
Source: cve@mitre.org
Resource: N/A
Hyperlink: https://www.h3c.com/cn/
Source: cve@mitre.org
Resource: N/A
Hyperlink: https://www.h3c.com/cn/Service/Online_Help/psirt/
Source: cve@mitre.org
Resource: N/A

Change History

0
Information is not available yet

Similar CVEs

55Records found
CVE-2024-6950
Matching Score-4
Assigner-VulDB
ShareView Details
Matching Score-4
Assigner-VulDB
CVSS Score-5.3||MEDIUM
EPSS-0.18% / 39.92%
||
7 Day CHG~0.00%
Published-21 Jul, 2024 | 10:31
Updated-01 Aug, 2024 | 21:45
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Prain HTTP POST Request ?import code injection

A vulnerability, which was classified as critical, has been found in Prain up to 1.3.0. Affected by this issue is some unknown functionality of the file /?import of the component HTTP POST Request Handler. The manipulation of the argument file leads to code injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-272072.

Action-Not Available
Vendor-n/a
Product-Prain
CWE ID-CWE-94
Improper Control of Generation of Code ('Code Injection')
CVE-2023-1947
Matching Score-4
Assigner-VulDB
ShareView Details
Matching Score-4
Assigner-VulDB
CVSS Score-6.3||MEDIUM
EPSS-0.12% / 31.16%
||
7 Day CHG~0.00%
Published-07 Apr, 2023 | 22:00
Updated-02 Aug, 2024 | 06:05
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
taoCMS admin.php code injection

A vulnerability was found in taoCMS 3.0.2. It has been classified as critical. Affected is an unknown function of the file /admin/admin.php. The manipulation leads to code injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-225330 is the identifier assigned to this vulnerability.

Action-Not Available
Vendor-taogogon/a
Product-taocmstaoCMS
CWE ID-CWE-94
Improper Control of Generation of Code ('Code Injection')
CVE-2023-1773
Matching Score-4
Assigner-VulDB
ShareView Details
Matching Score-4
Assigner-VulDB
CVSS Score-6.3||MEDIUM
EPSS-0.99% / 76.00%
||
7 Day CHG~0.00%
Published-31 Mar, 2023 | 12:00
Updated-11 Feb, 2025 | 18:41
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Rockoa Configuration File webmainConfig.php code injection

A vulnerability was found in Rockoa 2.3.2. It has been declared as critical. This vulnerability affects unknown code of the file webmainConfig.php of the component Configuration File Handler. The manipulation leads to code injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-224674 is the identifier assigned to this vulnerability.

Action-Not Available
Vendor-rockoan/a
Product-rockoaRockoa
CWE ID-CWE-94
Improper Control of Generation of Code ('Code Injection')
CVE-2024-8254
Matching Score-4
Assigner-Wordfence
ShareView Details
Matching Score-4
Assigner-Wordfence
CVSS Score-5.4||MEDIUM
EPSS-0.29% / 51.88%
||
7 Day CHG~0.00%
Published-02 Oct, 2024 | 06:46
Updated-08 Oct, 2024 | 19:08
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce <= 5.7.34 - Authenticated (Subscriber+) Arbitrary Shortcode Execution

The Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 5.7.34. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for authenticated attackers, with Subscriber-level access and above, to execute arbitrary shortcodes.

Action-Not Available
Vendor-icegramicegram
Product-email_subscribers_\&_newslettersEmail Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce
CWE ID-CWE-94
Improper Control of Generation of Code ('Code Injection')
CVE-2021-1518
Matching Score-4
Assigner-Cisco Systems, Inc.
ShareView Details
Matching Score-4
Assigner-Cisco Systems, Inc.
CVSS Score-6.3||MEDIUM
EPSS-0.69% / 70.82%
||
7 Day CHG~0.00%
Published-22 Jul, 2021 | 15:20
Updated-07 Nov, 2024 | 22:05
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Cisco Firepower Device Manager On-Box Software Remote Code Execution Vulnerability

A vulnerability in the REST API of Cisco Firepower Device Manager (FDM) On-Box Software could allow an authenticated, remote attacker to execute arbitrary code on the underlying operating system of an affected device. This vulnerability is due to insufficient sanitization of user input on specific REST API commands. An attacker could exploit this vulnerability by sending a crafted HTTP request to the API subsystem of an affected device. A successful exploit could allow the attacker to execute arbitrary code on the underlying operating system. To exploit this vulnerability, an attacker would need valid low-privileged user credentials.

Action-Not Available
Vendor-Cisco Systems, Inc.
Product-firepower_device_manager_on-boxCisco Firepower Threat Defense Software
CWE ID-CWE-94
Improper Control of Generation of Code ('Code Injection')
  • Previous
  • 1
  • 2
  • Next
Details not found