deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-54132
Published: 2024-12-04
Description: The GitHub CLI is GitHub’s official command line tool. A security vulnerability has been identified in GitHub CLI that could create or overwrite files in unintended directories when users download a malicious GitHub Actions workflow artifact through gh run download. This vulnerability stems from a GitHub Actions workflow artifact named .. when downloaded using gh run download. The artifact name and --dir flag are used to determine the artifact’s download path. When the artifact is named .., the resulting files within the artifact are extracted exactly 1 directory higher than the specified --dir flag value. This vulnerability is fixed in 2.63.1.
CWE: CWE-22
References: https://github.com/cli/cli/commit/1136764c369aaf0cae4ec2ee09dc35d871076932; https://github.com/cli/cli/security/advisories/GHSA-2m9h-r57g-45pj
CVE: CVE-2024-54134
Published: 2024-12-04
Description: A publish-access account was compromised for `@solana/web3.js`, a JavaScript library that is commonly used by Solana dapps. This allowed an attacker to publish unauthorized and malicious packages that were modified, allowing them to steal private key material and drain funds from dapps, like bots, that handle private keys directly. This issue should not affect non-custodial wallets, as they generally do not expose private keys during transactions. This is not an issue with the Solana protocol itself, but with a specific JavaScript client library and only appears to affect projects that directly handle private keys and that updated within the window of 3:20pm UTC and 8:25pm UTC on Tuesday, December 3, 2024. These two unauthorized versions (1.95.6 and 1.95.7) were caught within hours and have since been unpublished. All Solana app developers should upgrade to version 1.95.8. Developers that suspect they might be compromised should rotate any suspect authority keys, including multisigs, program authorities, server keypairs, and so on.
CWE: CWE-200
References: https://github.com/solana-labs/solana-web3.js/security/advisories/GHSA-jcxm-7wvp-g6p5
CVE: CVE-2024-20397
Published: 2024-12-04
Description: A vulnerability in the bootloader of Cisco NX-OS Software could allow an unauthenticated attacker with physical access to an affected device, or an authenticated, local attacker with administrative credentials, to bypass NX-OS image signature verification.&nbsp;

This vulnerability is due to insecure bootloader settings. An attacker could exploit this vulnerability by executing a series of bootloader commands. A successful exploit could allow the attacker to bypass NX-OS image signature verification and load unverified software.
CVSS Score: 5.2 (MEDIUM)
CWE: CWE-284
References: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-nxos-image-sig-bypas-pQDRQvjL
CVE: CVE-2024-39163
Published: 2024-12-04
Description: binux pyspider up to v0.3.10 was discovered to contain a Cross-Site Request Forgery (CSRF) via the Flask endpoints.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://github.com/binux/pyspider/blob/master/pyspider/webui/debug.py#L39; https://www.sonarsource.com/blog/basic-http-authentication-risk-uncovering-pyspider-vulnerabilities/
CVE: CVE-2024-52676
Published: 2024-12-04
Description: Itsourcecode Online Discussion Forum Project v.1.0.0 is vulnerable to Cross Site Scripting (XSS) via /bcc_forum/members/home.php.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/WTIMITW/System-with-Cross-site-Scripting-XSS-
CVE: CVE-2018-9392
Published: 2024-12-04
Description: In get_binary of vendor/mediatek/proprietary/hardware/connectivity/gps/gps_hal/src/data_coder.c, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://source.android.com/security/bulletin/pixel/2018-06-01
CVE: CVE-2018-9393
Published: 2024-12-04
Description: In procfile_write of drivers/misc/mediatek/connectivity/wlan/gen2/os/linux/gl_proc.c, there is a possible OOB write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://source.android.com/security/bulletin/pixel/2018-06-01
CVE: CVE-2018-9394
Published: 2024-12-04
Description: In mtk_p2p_wext_set_key of drivers/misc/mediatek/connectivity/wlan/gen2/os/linux/gl_p2p.c, there is a possible OOB write due to improper input validation. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://source.android.com/security/bulletin/pixel/2018-06-01
CVE: CVE-2018-9395
Published: 2024-12-04
Description: In mtk_cfg80211_vendor_packet_keep_alive_start and mtk_cfg80211_vendor_set_config of drivers/misc/mediatek/connectivity/wlan/gen2/os/linux/gl_vendor.c, there is a possible OOB write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://source.android.com/security/bulletin/pixel/2018-06-01
CVE: CVE-2024-12147
Published: 2024-12-04
Description: A vulnerability was found in Netgear R6900 1.0.1.26_1.0.20. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file upgrade_check.cgi of the component HTTP Header Handler. The manipulation of the argument Content-Length leads to buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-119, CWE-120
References: https://github.com/upload000/Hub/blob/main/IOT/Netgear_R6900.md; https://vuldb.com/?ctiid.286873; https://vuldb.com/?id.286873
CVE: CVE-2024-12148
Published: 2024-12-04
Description: Incorrect authorization in permission validation component in Devolutions Server 2024.3.6.0 and earlier allows an authenticated user to access some reporting endpoints.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-863, CWE-863
References: https://devolutions.net/security/advisories/DEVO-2024-0017
CVE: CVE-2024-12149
Published: 2024-12-04
Description: Incorrect permission assignment in temporary access requests component in Devolutions Remote Desktop Manager 2024.3.19.0 and earlier on Windows allows an authenticated user that request temporary permissions on an entry to obtain more privileges than requested.
CVSS Score: 8.1 (HIGH)
CWE: CWE-732, CWE-732
References: https://devolutions.net/security/advisories/DEVO-2024-0017
CVE: CVE-2024-12151
Published: 2024-12-04
Description: Incorrect permission assignment in the user migration feature in Devolutions Server 2024.3.8.0 and earlier allows users to retain their old permission sets.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-732, CWE-732
References: https://devolutions.net/security/advisories/DEVO-2024-0017
CVE: CVE-2024-12196
Published: 2024-12-04
Description: Incorrect authorization in the permission component in Devolutions Server 2024.3.7.0 and earlier allows an authenticated user to view the password history of an entry without the view password permission.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-863, CWE-863
References: https://devolutions.net/security/advisories/DEVO-2024-0017
CVE: CVE-2024-48453
Published: 2024-12-04
Description: An issue in INOVANCE AM401_CPU1608TPTN allows a remote attacker to execute arbitrary code via the ExecuteUserProgramUpgrade function
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: https://github.com/N0zoM1z0/CVEs/blob/main/CVE-2024-48453.md; https://github.com/N0zoM1z0/Vuln-Search/blob/main/INOVANCE%20AM401_CPU1608TPTN%20Unauthorized%20Arbitrary%20Code%20Execution%20Vulnerability.md; https://www.inovance.com/
CVE: CVE-2024-38829
Published: 2024-12-04
Description: A vulnerability in Spring LDAP allows data exposure for case sensitive comparisons.This issue affects Spring LDAP: from 2.4.0 through 2.4.3, from 3.0.0 through 3.0.9, from 3.1.0 through 3.1.7, from 3.2.0 through 3.2.7, AND all versions prior to 2.4.0.

The usage of String.toLowerCase() and String.toUpperCase() has some Locale dependent exceptions that could potentially result in unintended columns from being queried
Related to  CVE-2024-38820 https://spring.io/security/cve-2024-38820
CVSS Score: 3.7 (LOW)
CWE: CWE-178
References: https://spring.io/security/cve-2024-38829
CVE: CVE-2024-39219
Published: 2024-12-04
Description: An issue in Aginode GigaSwitch V5 before version 7.06G allows authenticated attackers with Administrator privileges to upload an earlier firmware version, exposing the device to previously patched vulnerabilities.
CVSS Score: 8.8 (HIGH)
References: https://blog.hackvens.fr/advisories/CVE-2024-39967-CVE-2024-39219-GigaSwitch.html; https://www.aginode.support/support/documentation/
CVE: CVE-2024-50947
Published: 2024-12-04
Description: An issue in kmqtt v0.2.7 allows attackers to cause a Denial of Service (DoS) via a crafted request.
CVSS Score: 7.5 (HIGH)
References: https://gist.github.com/pengwGit/40934164f68a8a45ebaacfcdeb598fcb; https://github.com/davidepianca98/KMQTT
CVE: CVE-2024-51210
Published: 2024-12-04
Description: Firepad through 1.5.11 allows remote attackers, who have knowledge of a pad ID, to retrieve both the current text of a document and all content that has previously been pasted into the document. NOTE: in several similar products, this is the intentional behavior for anyone who knows the full document ID and corresponding URL. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-125
References: https://firebase.blog/posts/2013/04/announcing-firepad-our-open-source/; https://github.com/FirebaseExtended/firepad/releases/tag/v1.5.11; https://medium.com/@adityaahuja.work/accessing-full-history-of-firepad-users-ddc889e73936
CVE: CVE-2024-54674
Published: 2024-12-04
Description: app/View/GalaxyClusters/cluster_export_misp_galaxy.ctp in MISP through 2.5.2 has stored XSS when exporting custom clusters into the misp-galaxy format.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/MISP/MISP/commit/d0330989e235a8a9f43c90817896de87a589ef7d
CVE: CVE-2024-54675
Published: 2024-12-04
Description: app/webroot/js/workflows-editor/workflows-editor.js in MISP through 2.5.2 has stored XSS in the editor interface for an ad-hoc workflow.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/MISP/MISP/commit/e02c2b864a85d14d64adf9f878f9c7b2bdd15173
CVE: CVE-2018-9396
Published: 2024-12-04
Description: In rpc_msg_handler and related handlers of drivers/misc/mediatek/eccci/port_rpc.c, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://source.android.com/security/bulletin/pixel/2018-06-01
CVE: CVE-2024-12180
Published: 2024-12-04
Description: A vulnerability classified as problematic has been found in DedeCMS 5.7.116. Affected is an unknown function of the file /member/article_add.php. The manipulation of the argument body leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-94, CWE-79
References: https://github.com/Hebing123/cve/issues/76; https://vuldb.com/?ctiid.286902; https://vuldb.com/?id.286902
CVE: CVE-2024-12181
Published: 2024-12-04
Description: A vulnerability classified as problematic was found in DedeCMS 5.7.116. Affected by this vulnerability is an unknown functionality of the file /member/uploads_add.php of the component SWF File Handler. The manipulation of the argument mediatype leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-94, CWE-79
References: https://github.com/Hebing123/cve/issues/77; https://vuldb.com/?ctiid.286903; https://vuldb.com/?id.286903
CVE: CVE-2024-12182
Published: 2024-12-04
Description: A vulnerability, which was classified as problematic, has been found in DedeCMS 5.7.116. Affected by this issue is some unknown functionality of the file /member/soft_add.php. The manipulation of the argument body leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-94, CWE-79
References: https://github.com/Hebing123/cve/issues/78; https://vuldb.com/?ctiid.286904; https://vuldb.com/?id.286904
CVE: CVE-2024-12183
Published: 2024-12-04
Description: A vulnerability, which was classified as problematic, was found in DedeCMS 5.7.116. This affects the function RemoveXSS of the file /plus/carbuyaction.php of the component HTTP POST Request Handler. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-94, CWE-79
References: https://github.com/Hebing123/cve/issues/79; https://vuldb.com/?ctiid.286905; https://vuldb.com/?id.286905
CVE: CVE-2024-53982
Published: 2024-12-04
Description: ZOO-Project is a C-based WPS (Web Processing Service) implementation. A path traversal vulnerability was discovered in Zoo-Project Echo example. The Echo example available by default in Zoo installs implements file caching, which can be controlled by user-given parameters. No input validation is performed in this parameter, which allows an attacker to fully control the file which is returned in the response. Patch was committed in November 22nd, 2024.
CWE: CWE-434
References: https://github.com/ZOO-Project/ZOO-Project/commit/641cb18fec58de43a3468f314e5f8808c560e6d9; https://github.com/ZOO-Project/ZOO-Project/security/advisories/GHSA-93rv-45r8-h5j4
CVE: CVE-2018-9397
Published: 2024-12-05
Description: In WMT_unlocked_ioctl of MTK WMT device driver, there is a possible OOB
    write due to a missing bounds check. This could lead to local escalation of
    privilege with System execution privileges needed. User interaction is not
    needed for exploitation.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://source.android.com/security/bulletin/pixel/2018-06-01
CVE: CVE-2018-9398
Published: 2024-12-05
Description: In fm_set_stat of mediatek FM radio driver, there is a possible OOB write
    due to improper input validation. This could lead to local escalation of
    privilege with System execution privileges needed. User interaction is not
    needed for exploitation.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://source.android.com/security/bulletin/pixel/2018-06-01
CVE: CVE-2018-9399
Published: 2024-12-05
Description: In /proc/driver/wmt_dbg driver, there are several possible out of bounds
    writes. These could lead to local escalation of privilege with System
    execution privileges needed. User interaction is not needed for
    exploitation.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://source.android.com/security/bulletin/pixel/2018-06-01
CVE: CVE-2018-9400
Published: 2024-12-05
Description: In gt1x_debug_write_proc and gt1x_tool_write of
    drivers/input/touchscreen/mediatek/GT1151/gt1x_generic.c and gt1x_tools.c,
    there is a possible out of bounds write due to a missing bounds check. This
    could lead to local escalation of privilege with System execution privileges
    needed. User interaction is not needed for exploitation.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://source.android.com/security/bulletin/pixel/2018-06-01
CVE: CVE-2018-9402
Published: 2024-12-05
Description: In multiple functions of gl_proc.c, there is a buffer overwrite due to a missing bounds check. This could lead to escalation of privileges in the kernel.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-120
References: https://source.android.com/security/bulletin/pixel/2018-06-01
CVE: CVE-2018-9403
Published: 2024-12-05
Description: In the MTK_FLP_MSG_HAL_DIAG_REPORT_DATA_NTF handler of flp2hal_-
    interface.c, there is a possible stack buffer overflow due to a missing
    bounds check. This could lead to local escalation of privilege in a
    privileged process with System execution privileges needed. User interaction
    is not needed for exploitation.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-787, CWE-120
References: https://source.android.com/security/bulletin/pixel/2018-06-01
CVE: CVE-2018-9404
Published: 2024-12-05
Description: In oemCallback of ril.cpp, there is a possible out of bounds write due to an
    integer overflow. This could lead to local escalation of privilege with
    System execution privileges needed. User interaction is not needed for
    exploitation.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-190, CWE-787
References: https://source.android.com/security/bulletin/pixel/2018-06-01
CVE: CVE-2018-9407
Published: 2024-12-05
Description: In emmc_rpmb_ioctl of emmc_rpmb.c, there is an Information Disclosure due to a Missing Bounds Check. This could lead to  Information Disclosure of kernel data.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://source.android.com/security/bulletin/pixel/2018-06-01
CVE: CVE-2018-9408
Published: 2024-12-05
Description: In m3326_gps_write and m3326_gps_read of gps.s, there is a possible Out Of
    Bounds Read due to a missing bounds check. This could lead to a local
    information disclosure with System execution privileges needed. User
    interaction is not needed for exploitation.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-125, CWE-125
References: https://source.android.com/security/bulletin/pixel/2018-06-01
CVE: CVE-2018-9416
Published: 2024-12-05
Description: In sg_remove_scat of scsi/sg.c, there is a possible memory corruption due to
    an unusual root cause. This could lead to local escalation of privilege with
    System execution privileges needed. User interaction is not needed for
    exploitation.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-787
References: https://source.android.com/security/bulletin/pixel/2018-07-01
CVE: CVE-2018-9439
Published: 2024-12-05
Description: In __unregister_prot_hook and packet_release of af_packet.c, there is a
    possible use-after-free due to improper locking. This could lead to local
    escalation of privilege in the kernel with System execution privileges
    needed. User interaction is not needed for exploitation.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-416, CWE-416
References: https://source.android.com/security/bulletin/pixel/2018-08-01
CVE: CVE-2018-9462
Published: 2024-12-05
Description: In store_cmd of ftm4_pdc.c, there is a possible out of bounds write due to
    an incorrect bounds check. This could lead to local escalation of privilege
    with System execution privileges needed. User interaction is not needed for
    exploitation.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://source.android.com/security/bulletin/pixel/2018-08-01
CVE: CVE-2018-9463
Published: 2024-12-05
Description: In sw49408_irq_runtime_engine_debug of touch_sw49408.c, there is a possible
    out of bounds write due to an incorrect bounds check. This could lead to
    local escalation of privilege with System execution privileges needed. User
    interaction is not needed for exploitation.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://source.android.com/security/bulletin/pixel/2018-08-01
CVE: CVE-2024-12185
Published: 2024-12-05
Description: A vulnerability has been found in code-projects Hotel Management System 1.0 and classified as problematic. This vulnerability affects unknown code of the component Administrator Login Password Handler. The manipulation of the argument Str2 leads to stack-based buffer overflow. An attack has to be approached locally. The exploit has been disclosed to the public and may be used.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-119, CWE-121, CWE-787
References: https://code-projects.org/; https://github.com/1zzan/cve/blob/main/STACK-OVERFLOW1.md; https://vuldb.com/?ctiid.286906
CVE: CVE-2024-12186
Published: 2024-12-05
Description: A vulnerability was found in code-projects Hotel Management System 1.0 and classified as problematic. This issue affects some unknown processing of the file hotelnew.c of the component Available Room Handler. The manipulation of the argument admin_entry leads to stack-based buffer overflow. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-119, CWE-121, CWE-787
References: https://code-projects.org/; https://github.com/1zzan/cve/blob/main/STACK-OVERFLOW2.md; https://vuldb.com/?ctiid.286907
CVE: CVE-2024-54221
Published: 2024-12-05
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in roninwp FAT Services Booking fat-services-booking.This issue affects FAT Services Booking: from n/a through <= 5.6.
CVSS Score: 9.3 (CRITICAL)
CWE: CWE-89
References: https://patchstack.com/database/Wordpress/Plugin/fat-services-booking/vulnerability/wordpress-fat-services-booking-plugin-5-6-unauthenticated-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2024-12187
Published: 2024-12-05
Description: A vulnerability was found in 1000 Projects Library Management System 1.0. It has been classified as critical. Affected is an unknown function of the file /showbook.php. The manipulation of the argument q leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://1000projects.org/; https://github.com/PunyHunter/CVE/issues/1; https://vuldb.com/?ctiid.286908
CVE: CVE-2024-12188
Published: 2024-12-05
Description: A vulnerability was found in 1000 Projects Library Management System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /brains/stu.php. The manipulation of the argument useri leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://1000projects.org/; https://github.com/SkGoing/CVE-repo_00/issues/4; https://vuldb.com/?ctiid.286909
CVE: CVE-2024-54014
Published: 2024-12-05
Description: Improper authorization in handler for custom URL scheme issue in 'Skylark' App for Android 6.2.13 and earlier and 'Skylark' App for iOS 6.2.13 and earlier allows an attacker to lead the application to access an arbitrary web site via another application installed on the user's device.
CVSS Score: 3.6 (LOW)
CWE: CWE-939
References: https://apps.apple.com/jp/app/%E3%81%99%E3%81%8B%E3%81%84%E3%82%89%E3%83%BC%E3%81%8F%E3%82%A2%E3%83%97%E3%83%AA/id906930478; https://jvn.jp/en/jp/JVN03447226/; https://play.google.com/store/apps/details?id=jp.co.skylark.app.gusto
CVE: CVE-2024-10881
Published: 2024-12-05
Description: The LUNA RADIO PLAYER plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'lunaradio' shortcode in versions up to, and including, 6.24.11.07 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://radioplayer.luna-universe.com/update/#release-notes; https://www.wordfence.com/threat-intel/vulnerabilities/id/2ed8a7f8-1af3-4b41-bfaf-fd1c35baa867?source=cve