Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-5171 State: PUBLISHED Published: 2024-06-05T19:11:12.987Z Last Updated: 2025-02-13T17:53:49.724Z Vendors: libaom Products: libaom Problem Types: CWE-20 Description: Integer overflow in libaom internal function img_alloc_helper can lead to heap buffer overflow. This function can be reached via 3 callers: * Calling aom_img_alloc() with a large value of the d_w, d_h, or align parameter may result in integer overflows in the calculations of buffer sizes and offsets and some fields of the returned aom_image_t struct may be invalid. * Calling aom_img_wrap() with a large value of the d_w, d_h, or align parameter may result in integer overflows in the calculations of buffer sizes an
a large value of the d_w, d_h, or align parameter may result in integer overflows in the calculations of buffer sizes and offsets and some fields of the returned aom_image_t struct may be invalid. * Calling aom_img_alloc_with_border() with a large value of the d_w, d_h, align, size_align, or border parameter may result in integer overflows in the calculations of buffer sizes and offsets and some fields of the returned aom_image_t struct may be invalid. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://issues.chromium.org/issues/332382766 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6HYUEHZ35ZP
s/332382766 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6HYUEHZ35ZPY2EONVZCGO6LPT3AMLZCP/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/U5NRNCEYS246CYGOR32MF7OGKWOWER22/
CVE ID: CVE-2024-5172 State: PUBLISHED Published: 2024-06-18T06:00:02.523Z Last Updated: 2024-08-01T21:03:11.067Z Vendors: Unknown Products: Expert Invoice Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Expert Invoice WordPress plugin through 1.0.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://wpscan.com/vulnerability/65d84e69-0548-4c7d-bcde-5777d72da555/
CVE ID: CVE-2024-5173 State: PUBLISHED Published: 2024-06-26T02:07:56.481Z Last Updated: 2024-08-01T21:03:10.975Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: devitemsllc Products: HT Mega – Absolute Addons For Elementor Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Video player widget settings in all versions up to, and including, 2.5.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated at
fficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/aac9569e-d33d-45b3-bd03-2e7f48536ae5?source=cve - https://plugins.trac.wordpress.org/browser/ht-mega-for-elementor/tags/2.5.3/includes/widgets/htmega_videoplayer.php#L549
CVE ID: CVE-2024-5174 State: PUBLISHED Published: 2025-02-24T13:32:19.344Z Last Updated: 2025-02-24T14:21:07.331Z Vendors: Gliffy Products: Gliffy Online Problem Types: CWE-287 Description: A flaw in Gliffy results in broken authentication through the reset functionality of the application. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://portal.perforce.com/s/detail/a91PA000001ScD3YAK
CVE ID: CVE-2024-5175 State: REJECTED Published: N/A Last Updated: 2025-01-14T20:04:46.997Z Description: No description available.
CVE ID: CVE-2024-5176 State: PUBLISHED Published: 2024-05-31T17:26:05.140Z Last Updated: 2024-09-03T15:31:58.511Z Vendors: Baxter Products: Welch Allyn Configuration Tool Problem Types: CWE-522 Description: Insufficiently Protected Credentials vulnerability in Baxter Welch Allyn Configuration Tool may allow Remote Services with Stolen Credentials.This issue affects Welch Allyn Configuration Tool: versions 1.9.4.1 and prior. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://cisa.gov/news-events/ics-medical-advisories/icsma-24-151-01
CVE ID: CVE-2024-5177 State: PUBLISHED Published: 2024-05-23T05:32:16.412Z Last Updated: 2024-08-01T21:03:11.037Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: hashthemes Products: Hash Elements Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Hash Elements plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'url' parameter within multiple widgets in all versions up to, and including, 1.3.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and
aping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/9ba07137-f834-4f56-bcd5-0f6fde756681?source=cve - https://plugins.trac.wordpress.org/browser/hash-elements/trunk/modules/news-module-one/widgets/news-module-one.php#L720 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3090981%40hash-elements%2Ftrunk&old=3089165%40hash-elements%2Ftrunk&s
.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3090981%40hash-elements%2Ftrunk&old=3089165%40hash-elements%2Ftrunk&sfp_email=&sfph_mail=#file18
CVE ID: CVE-2024-5178 State: PUBLISHED Published: 2024-07-10T16:23:39.270Z Last Updated: 2024-08-01T21:03:11.076Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) Vendors: ServiceNow Products: Now Platform Problem Types: CWE-184 Description: ServiceNow has addressed a sensitive file read vulnerability that was identified in the Washington DC, Vancouver, and Utah Now Platform releases. This vulnerability could allow an administrative user to gain unauthorized access to sensitive files on the web application server. The vulnerability is addressed in the listed patches and hot fixes, which were released during the June 2024 patching cycle. If you have not done so already
e listed patches and hot fixes, which were released during the June 2024 patching cycle. If you have not done so already, we recommend applying security patches relevant to your instance as soon as possible. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB1648312 - https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB1644293
CVE ID: CVE-2024-5179 State: PUBLISHED Published: 2024-06-06T02:03:02.279Z Last Updated: 2024-08-01T21:03:10.973Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: codelessthemes Products: Cowidgets – Elementor Addons Problem Types: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Description: The Cowidgets – Elementor Addons plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.1.1 via the 'item_style' and 'style' parameters. This makes it possible for authenticated attackers, with Contributor-level access and above, to include and execute arbitrary files on the server, allowing t
ted attackers, with Contributor-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/ebd6acc9-b7df-4cf8-a211-1e39f3abcf79?source=cve - https://plugins.trac.wordpress.org/browser/cowidgets-elementor-addons/trunk/inc/widgets-manager/widgets/content/class-ce-posts-carousel.php#L727 - https://plugins.t
owidgets-elementor-addons/trunk/inc/widgets-manager/widgets/content/class-ce-posts-carousel.php#L727 - https://plugins.trac.wordpress.org/browser/cowidgets-elementor-addons/trunk/inc/widgets-manager/widgets/content/class-ce-posts-grid.php#L582 - https://plugins.trac.wordpress.org/browser/cowidgets-elementor-addons/trunk/inc/widgets-manager/widgets/content/class-ce-testimonial-carousel.php#L600 - https://plugins.trac.wordpress.org/browser/cowidgets-elementor-addons/trunk/inc/widgets-manager/widgets/content/class-ce-portfolio-grid.php#L707 - https://plugins.trac.wordpress.org/browser/cowidgets-elementor-addons/trunk/inc/widgets-manager/widgets/content/class-ce-staff-carousel.php#L603 - https:/
/browser/cowidgets-elementor-addons/trunk/inc/widgets-manager/widgets/content/class-ce-staff-carousel.php#L603 - https://plugins.trac.wordpress.org/browser/cowidgets-elementor-addons/trunk/inc/widgets-manager/widgets/content/class-ce-post-navigation.php#L257
CVE ID: CVE-2024-5181 State: PUBLISHED Published: 2024-06-26T02:53:58.461Z Last Updated: 2024-08-01T21:03:11.039Z Severity: CRITICAL (CVSS 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: mudler Products: mudler/localai Problem Types: CWE-78 Description: A command injection vulnerability exists in the mudler/localai version 2.14.0. The vulnerability arises from the application's handling of the backend parameter in the configuration file, which is used in the name of the initialized process. An attacker can exploit this vulnerability by manipulating the path of the vulnerable binary file specified in the backend parameter, allowing the execution of arbitrary code on the system. Thi
e vulnerable binary file specified in the backend parameter, allowing the execution of arbitrary code on the system. This issue is due to improper neutralization of special elements used in an OS command, leading to potential full control over the affected system. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://huntr.com/bounties/c6e3cb58-6fa4-4207-bb92-ae7644174661 - https://github.com/mudler/localai/commit/1a3dedece06cab1acc3332055d285ac540a47f0e
CVE ID: CVE-2024-5182 State: PUBLISHED Published: 2024-06-19T23:30:38.219Z Last Updated: 2024-08-01T21:03:10.990Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: mudler Products: mudler/localai Problem Types: CWE-22 Description: A path traversal vulnerability exists in mudler/localai version 2.14.0, where an attacker can exploit the `model` parameter during the model deletion process to delete arbitrary files. Specifically, by crafting a request with a manipulated `model` parameter, an attacker can traverse the directory structure and target files outside of the intended directory, leading to the deletion of sensitive data. This vulnerability is due to insuffi
files outside of the intended directory, leading to the deletion of sensitive data. This vulnerability is due to insufficient input validation and sanitization of the `model` parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://huntr.com/bounties/f7a87f29-c22a-48e8-9fce-b6d5a273e545 - https://github.com/mudler/localai/commit/1a3dedece06cab1acc3332055d285ac540a47f0e
CVE ID: CVE-2024-5183 State: REJECTED Published: N/A Last Updated: 2025-02-08T21:32:50.924Z Description: No description available.
CVE ID: CVE-2024-5184 State: PUBLISHED Published: 2024-06-05T17:52:13.608Z Last Updated: 2024-08-01T21:03:11.061Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: EmailGPT Products: EmailGPT Problem Types: CWE-74 Description: The EmailGPT service contains a prompt injection vulnerability. The service uses an API service that allows a malicious user to inject a direct prompt and take over the service logic. Attackers can exploit the issue by forcing the AI service to leak the standard hard-coded system prompts and/or execute unwanted prompts. When engaging with EmailGPT by submitting a malicious prompt that requests harmful information, the system will respond
When engaging with EmailGPT by submitting a malicious prompt that requests harmful information, the system will respond by providing the requested data. This vulnerability can be exploited by any individual with access to the service. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.synopsys.com/blogs/software-security/cyrc-advisory-prompt-injection-emailgpt.html
CVE ID: CVE-2024-5185 State: PUBLISHED Published: 2024-05-29T13:00:28.692Z Last Updated: 2024-09-03T17:48:11.058Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H) Vendors: SamurAIGPT Products: EmbedAI Problem Types: CWE-352 Description: The EmbedAI application is susceptible to security issues that enable Data Poisoning attacks. This weakness could result in the application becoming compromised, leading to unauthorized entries or data poisoning attacks, which are delivered by a CSRF vulnerability due to the absence of a secure session management implementation and weak CORS policies weakness. An attacker can direct a user to a malicious webpage that exploits a CSRF vuln
entation and weak CORS policies weakness. An attacker can direct a user to a malicious webpage that exploits a CSRF vulnerability within the EmbedAI application. By leveraging this CSRF vulnerability, the attacker can deceive the user into inadvertently uploading and integrating incorrect data into the application’s language model. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.synopsys.com/blogs/software-security/cyrc-advisory-data-poisoning-embedai.html
CVE ID: CVE-2024-5186 State: PUBLISHED Published: 2024-06-06T18:19:57.023Z Last Updated: 2024-08-01T21:03:11.037Z Severity: HIGH (CVSS 8.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L) Vendors: imartinez Products: imartinez/privategpt Problem Types: CWE-918 Description: A Server-Side Request Forgery (SSRF) vulnerability exists in the file upload section of imartinez/privategpt version 0.5.0. This vulnerability allows attackers to send crafted requests that could result in unauthorized access to the local network and potentially sensitive information. Specifically, by manipulating the 'path' parameter in a file upload request, an attacker can cause the application to make arbitrary requests t
lating the 'path' parameter in a file upload request, an attacker can cause the application to make arbitrary requests to internal services, including the AWS metadata endpoint. This issue could lead to the exposure of internal servers and sensitive data. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://huntr.com/bounties/5f421645-3546-4a67-a421-ee1bc4b6e3a3
CVE ID: CVE-2024-5187 State: PUBLISHED Published: 2024-06-06T18:45:19.456Z Last Updated: 2024-08-01T21:03:10.963Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: onnx Products: onnx/onnx Problem Types: CWE-22 Description: A vulnerability in the `download_model_with_test_data` function of the onnx/onnx framework, version 1.16.0, allows for arbitrary file overwrite due to inadequate prevention of path traversal attacks in malicious tar files. This vulnerability enables attackers to overwrite any file on the system, potentially leading to remote code execution, deletion of system, personal, or application files, thus impacting the integrity and availability of th
code execution, deletion of system, personal, or application files, thus impacting the integrity and availability of the system. The issue arises from the function's handling of tar file extraction without performing security checks on the paths within the tar file, as demonstrated by the ability to overwrite the `/home/kali/.ssh/authorized_keys` file by specifying an absolute path in the malicious tar file. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://huntr.com/bounties/50235ebd-3410-4ada-b064-1a648e11237e
CVE ID: CVE-2024-5188 State: PUBLISHED Published: 2024-06-06T11:03:03.438Z Last Updated: 2024-08-01T21:03:11.069Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: wpdevteam Products: Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'get_manual_calendar_events' function in all versions up to, and including, 5.9.22 due to insu
ss-Site Scripting via the 'get_manual_calendar_events' function in all versions up to, and including, 5.9.22 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/5a1d5fd1-80b6-4d62-9837-59ee1e020373?source=cve - https://plugins.trac.wordpress.org/browser/essential-addons-for-elementor-lite/trunk/includes/Elements/Event_Calendar.php#L3255 - https://
ac.wordpress.org/browser/essential-addons-for-elementor-lite/trunk/includes/Elements/Event_Calendar.php#L3255 - https://plugins.trac.wordpress.org/changeset/3097900/
CVE ID: CVE-2024-5189 State: PUBLISHED Published: 2024-06-11T13:54:00.315Z Last Updated: 2024-08-01T21:03:10.977Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: wpdevteam Products: Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘custom_js’ parameter in all versions up to, and including, 5.9.23 due to insufficient input s
ss-Site Scripting via the ‘custom_js’ parameter in all versions up to, and including, 5.9.23 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/aa70238b-530e-4c90-82f4-c3113887d0e1?source=cve - https://plugins.trac.wordpress.org/browser/essential-addons-for-elementor-lite/tags/5.9.21/includes/Classes/Asset_Builder.php#L264 - https://plugins.trac.
/browser/essential-addons-for-elementor-lite/tags/5.9.21/includes/Classes/Asset_Builder.php#L264 - https://plugins.trac.wordpress.org/changeset/3099937/
CVE ID: CVE-2024-5190 State: REJECTED Published: N/A Last Updated: 2024-05-22T02:41:53.589Z Description: No description available.
CVE ID: CVE-2024-5191 State: PUBLISHED Published: 2024-06-21T06:58:19.215Z Last Updated: 2024-08-01T21:03:11.039Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: wpmudev Products: Branda – White Label WordPress, Custom Login Page Customizer Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Branda – White Label WordPress, Custom Login Page Customizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘mime_types’ parameter in all versions up to, and including, 3.4.17 due to insufficient input sanitization and output escaping. This makes it possible for authenticat
and including, 3.4.17 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/31f4bad5-3a11-42c6-a336-6bd178ab5113?source=cve - https://plugins.trac.wordpress.org/browser/branda-white-labeling/tags/3.4.17/inc/modules/utilities/images.php#L58 - https://plugins.trac.wordpress.org/changeset/3104910/
CVE ID: CVE-2024-5192 State: PUBLISHED Published: 2024-06-29T04:33:27.901Z Last Updated: 2024-08-01T21:03:10.981Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: amans2k Products: Funnel Builder for WordPress by FunnelKit – Customize WooCommerce Checkout Pages, Create Sales Funnels, Order Bumps & One Click Upsells Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Funnel Builder for WordPress by FunnelKit – Customize WooCommerce Checkout Pages, Create Sales Funnels, Order Bumps & One Click Upsells plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘mimes’ paramete
der Bumps & One Click Upsells plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘mimes’ parameter in all versions up to, and including, 3.3.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/2b77703e-b3d3-4105-a162-0afe86d5b3eb?source=cve - https://plugins.trac.wordpress.org/browser/funnel-builder/tags/3.3.1/modules/checkouts
05-a162-0afe86d5b3eb?source=cve - https://plugins.trac.wordpress.org/browser/funnel-builder/tags/3.3.1/modules/checkouts/includes/class-wfacp-common.php#L52 - https://plugins.trac.wordpress.org/browser/funnel-builder/trunk/modules/checkouts/includes/class-wfacp-common-helper.php#L19 - https://plugins.trac.wordpress.org/changeset/3107500/
CVE ID: CVE-2024-5193 State: PUBLISHED Published: 2024-05-22T10:31:04.297Z Last Updated: 2024-08-01T21:03:11.062Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: Ritlabs Products: TinyWeb Server Problem Types: CWE-93 Description: A vulnerability was found in Ritlabs TinyWeb Server 1.94. It has been classified as problematic. Affected is an unknown function of the component Request Handler. The manipulation with the input %0D%0A leads to crlf injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-265830 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early abo
c and may be used. VDB-265830 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.265830 - https://vuldb.com/?ctiid.265830 - https://vuldb.com/?submit.333059 - https://github.com/DMCERTCE/CRLF_Tiny