rainbutterfly/cve_corpus huggingface dataset:
CVE-2022-24334 
In JetBrains TeamCity before 2021.2.1, the Agent Push feature allowed selection of any private key on the server.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-25T14:35:18.000Z
CVE-2022-24335 
JetBrains TeamCity before 2021.2 was vulnerable to a Time-of-check/Time-of-use (TOCTOU) race-condition attack in agent registration via XML-RPC.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-25T14:35:21.000Z
CVE-2022-24336 
In JetBrains TeamCity before 2021.2.1, an unauthenticated attacker can cancel running builds via an XML-RPC request to the TeamCity server.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-25T14:35:27.000Z
CVE-2022-24337 
In JetBrains TeamCity before 2021.2, health items of pull requests were shown to users who lacked appropriate permissions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-25T14:35:31.000Z
CVE-2022-24338 
JetBrains TeamCity before 2021.2.1 was vulnerable to reflected XSS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-25T14:35:35.000Z
CVE-2022-24339 
JetBrains TeamCity before 2021.2.1 was vulnerable to stored XSS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-25T14:35:38.000Z
CVE-2022-24340 
In JetBrains TeamCity before 2021.2.1, XXE during the parsing of the configuration file was possible.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-25T14:35:41.000Z
CVE-2022-24341 
In JetBrains TeamCity before 2021.2.1, editing a user account to change its password didn't terminate sessions of the edited user.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-25T14:35:44.000Z
CVE-2022-24342 
In JetBrains TeamCity before 2021.2.1, URL injection leading to CSRF was possible.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-25T14:35:48.000Z
CVE-2022-24343 
In JetBrains YouTrack before 2021.4.31698, a custom logo could be set by a user who has read-only permissions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-25T14:35:52.000Z
CVE-2022-24344 
JetBrains YouTrack before 2021.4.31698 was vulnerable to stored XSS on the Notification templates page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-25T14:35:56.000Z
CVE-2022-24345 
In JetBrains IntelliJ IDEA before 2021.2.4, local code execution (without permission from a user) upon opening a project was possible.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-25T14:36:00.000Z
CVE-2022-24346 
In JetBrains IntelliJ IDEA before 2021.3.1, local code execution via RLO (Right-to-Left Override) characters was possible.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-25T14:36:04.000Z
CVE-2022-24347 
JetBrains YouTrack before 2021.4.36872 was vulnerable to stored XSS via a project icon.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-25T14:36:08.000Z
CVE-2022-24348 
Argo CD before 2.1.9 and 2.2.x before 2.2.4 allows directory traversal related to Helm charts because of an error in helmTemplate in repository.go. For example, an attacker may be able to discover credentials stored in a YAML file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-04T20:26:21.000Z
CVE-2022-24349 Reflected XSS in action configuration window of Zabbix Frontend
An authenticated user can create a link with reflected XSS payload for actions’ pages, and send it to other users. Malicious code has access to all the same objects as the rest of the web page and can make arbitrary modifications to the contents of the page being displayed to a victim. This attack can be implemented with the help of social engineering and expiration of a number of factors - an attacker should have authorized access to the Zabbix Frontend and allowed network connection between a malicious server and victim’s computer, understand attacked infrastructure, be recognized by the victim as a trustee and use trusted communication channel.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Zabbix
product: Frontend
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L
attackVector: NETWORK
attackComplexity: HIGH
privilegesRequired: LOW
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: LOW
baseScore: 4.6
baseSeverity: MEDIUM
Credits: lang: en
value: internal research
Published: 2022-03-09T19:30:26.724Z
CVE-2022-24350 
An issue was discovered in IhisiSmm in Insyde InsydeH2O with kernel 5.0 through 5.5. IHISI function 0x17 verifies that the output buffer lies within the command buffer but does not verify that output data does not go beyond the end of the command buffer. In particular, the GetFlashTable function is called directly on the Command Buffer before the DataSize is check, leading to possible circumstances where the data immediately following the command buffer could be destroyed before returning a buffer size error.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-04-12T00:00:00.000Z
CVE-2022-24351 
TOCTOU race-condition vulnerability in Insyde InsydeH2O with Kernel 5.2 before version 05.27.29, Kernel 5.3 before version 05.36.29, Kernel 5.4 version before 05.44.13, and Kernel 5.5 before version 05.52.13 allows an attacker to alter data and code used by the remainder of the boot process.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-12-16T00:00:00.000Z
CVE-2022-24352 
This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of TP-Link AC1750 prior to 211210 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the NetUSB.ko kernel module. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-15773.
Problem types: cwe_id: CWE-125
description: CWE-125: Out-of-bounds Read
Affected products: vendor: TP-Link
product: AC1750
Credits: lang: en
value: trichimtrich and nyancat0131
Published: 2023-03-28T00:00:00.000Z
CVE-2022-24353 
This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of TP-Link AC1750 1.1.4 Build 20211022 rel.59103(5553) routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the NetUSB.ko module. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the root user. Was ZDI-CAN-15769.
Problem types: cwe_id: CWE-125
description: CWE-125: Out-of-bounds Read
Affected products: vendor: TP-Link
product: AC1750
Credits: lang: en
value: Bien Pham (@bienpnn) from Team Orca of Sea Security (security.sea.com)
Published: 2023-03-28T00:00:00.000Z
CVE-2022-24354 
This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of TP-Link AC1750 prior to 1.1.4 Build 20211022 rel.59103(5553) routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the NetUSB.ko module. The issue results from the lack of proper validation of user-supplied data, which can result in an integer overflow before allocating a buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-15835.
Problem types: cwe_id: CWE-190
description: CWE-190: Integer Overflow or Wraparound
Affected products: vendor: TP-Link
product: AC1750
Credits: lang: en
value: Axel '0vercl0k' Souchet from https://doar-e.github.io/
Published: 2022-02-18T19:52:04.000Z
CVE-2022-24355 
This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of TP-Link TL-WR940N 3.20.1 Build 200316 Rel.34392n (5553) routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the parsing of file name extensions. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-13910.
Problem types: cwe_id: CWE-121
description: CWE-121: Stack-based Buffer Overflow
Affected products: vendor: TP-Link
product: TL-WR940N
Credits: lang: en
value: Vadym Kolisnichenko
Published: 2022-02-18T19:52:05.000Z
CVE-2022-24356 
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader Foxit reader 11.0.1.0719 macOS. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the OnMouseExit method. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-14848.
Problem types: cwe_id: CWE-125
description: CWE-125: Out-of-bounds Read
Affected products: vendor: Foxit
product: PDF Reader
Credits: lang: en
value: DoHyun Lee(@l33d0hyun)
Published: 2022-02-18T19:52:06.000Z
CVE-2022-24357 
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.1.0.52543. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of Annotation objects. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-15743.
Problem types: cwe_id: CWE-416
description: CWE-416: Use After Free
Affected products: vendor: Foxit
product: PDF Reader
Credits: lang: en
value: Rich
Published: 2022-02-18T19:52:08.000Z
CVE-2022-24358 
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.1.0.52543. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of Doc objects. By performing actions in JavaScript, an attacker can trigger a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-15703.
Problem types: cwe_id: CWE-125
description: CWE-125: Out-of-bounds Read
Affected products: vendor: Foxit
product: PDF Reader
Credits: lang: en
value: Anonymous
Published: 2022-02-18T19:52:09.000Z
CVE-2022-24359 
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.1.0.52543. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of Doc objects. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-15702.
Problem types: cwe_id: CWE-416
description: CWE-416: Use After Free
Affected products: vendor: Foxit
product: PDF Reader
Credits: lang: en
value: Anonymous
Published: 2022-02-18T19:52:11.000Z
CVE-2022-24360 
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.1.0.52543. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of Doc objects. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-15744.
Problem types: cwe_id: CWE-416
description: CWE-416: Use After Free
Affected products: vendor: Foxit
product: PDF Reader
Credits: lang: en
value: Anonymous
Published: 2022-02-18T19:52:12.000Z
CVE-2022-24361 
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.1.0.52543. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of JPEG2000 images. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-15811.
Problem types: cwe_id: CWE-787
description: CWE-787: Out-of-bounds Write
Affected products: vendor: Foxit
product: PDF Reader
Credits: lang: en
value: Anonymous
Published: 2022-02-18T19:52:13.000Z
CVE-2022-24362 
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.1.0.52543. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of AcroForms. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-15987.
Problem types: cwe_id: CWE-416
description: CWE-416: Use After Free
Affected products: vendor: Foxit
product: PDF Reader
Credits: lang: en
value: Rich
Published: 2022-02-18T19:52:15.000Z
CVE-2022-24363 
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.1.0.52543. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of Annotation objects. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-15861.
Problem types: cwe_id: CWE-416
description: CWE-416: Use After Free
Affected products: vendor: Foxit
product: PDF Reader
Credits: lang: en
value: Rich
Published: 2022-02-18T19:52:16.000Z
CVE-2022-24364 
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.1.0.52543. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of Doc objects. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-15851.
Problem types: cwe_id: CWE-416
description: CWE-416: Use After Free
Affected products: vendor: Foxit
product: PDF Reader
Credits: lang: en
value: Rich
Published: 2022-02-18T19:52:18.000Z
CVE-2022-24365 
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.1.0.52543. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of AcroForms. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-15852.
Problem types: cwe_id: CWE-416
description: CWE-416: Use After Free
Affected products: vendor: Foxit
product: PDF Reader
Credits: lang: en
value: Rich
Published: 2022-02-18T19:52:19.000Z
CVE-2022-24366 
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.1.0.52543. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of AcroForms. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-15853.
Problem types: cwe_id: CWE-416
description: CWE-416: Use After Free
Affected products: vendor: Foxit
product: PDF Reader
Credits: lang: en
value: Rich
Published: 2022-02-18T19:52:21.000Z
CVE-2022-24367 
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.1.0.52543. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of AcroForms. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-15877.
Problem types: cwe_id: CWE-416
description: CWE-416: Use After Free
Affected products: vendor: Foxit
product: PDF Reader
Credits: lang: en
value: Rich
Published: 2022-02-18T19:52:22.000Z
CVE-2022-24368 
This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit PDF Reader 11.1.0.52543. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of Doc objects. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-16115.
Problem types: cwe_id: CWE-416
description: CWE-416: Use After Free
Affected products: vendor: Foxit
product: PDF Reader
Credits: lang: en
value: Ashfaq Ansari and Krishnakant Patil - HackSys Inc
Published: 2022-02-18T19:52:24.000Z
CVE-2022-24369 
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.1.0.52543. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of JP2 images. Crafted data in a JP2 image can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-16087.
Problem types: cwe_id: CWE-787
description: CWE-787: Out-of-bounds Write
Affected products: vendor: Foxit
product: PDF Reader
Credits: lang: en
value: Anonymous
Published: 2022-02-18T19:52:25.000Z
CVE-2022-24370 
This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit PDF Reader Foxit reader 11.0.1.0719 macOS. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of XFA forms. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-14819.
Problem types: cwe_id: CWE-125
description: CWE-125: Out-of-bounds Read
Affected products: vendor: Foxit
product: PDF Reader
Credits: lang: en
value: DoHyun Lee(@l33d0hyun)
Published: 2022-02-18T19:52:26.000Z
CVE-2022-24372 
Linksys MR9600 devices before 2.0.5 allow attackers to read arbitrary files via a symbolic link to the root directory of a NAS SMB share.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-04-27T17:23:41.000Z
CVE-2022-24373 Regular Expression Denial of Service (ReDoS)
The package react-native-reanimated before 3.0.0-rc.1 are vulnerable to Regular Expression Denial of Service (ReDoS) due to improper usage of regular expression in the parser of Colors.js.
Problem types: description: Regular Expression Denial of Service (ReDoS)
Affected products: vendor: n/a
product: react-native-reanimated
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
exploitCodeMaturity: PROOF_OF_CONCEPT
integrityImpact: NONE
privilegesRequired: NONE
remediationLevel: NOT_DEFINED
reportConfidence: NOT_DEFINED
scope: UNCHANGED
temporalScore: 5
temporalSeverity: MEDIUM
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P
version: 3.1
Credits: lang: en
value: matias-la
Published: 2022-09-30T05:00:17.564Z
CVE-2022-24374 
Cross-site scripting vulnerability in a-blog cms Ver.2.8.x series versions prior to Ver.2.8.75, Ver.2.9.x series versions prior to Ver.2.9.40, Ver.2.10.x series versions prior to Ver.2.10.44, Ver.2.11.x series versions prior to Ver.2.11.42, and Ver.3.0.x series versions prior to Ver.3.0.1 allows a remote authenticated attacker to inject an arbitrary script via unspecified vectors. This vulnerability is different from CVE-2022-23916.
Problem types: description: Cross-site scripting
Affected products: vendor: appleple inc.
product: a-blog cms
Published: 2022-02-24T09:50:32.000Z
CVE-2022-24375 Denial of Service (DoS)
The package node-opcua before 2.74.0 are vulnerable to Denial of Service (DoS) when bypassing the limitations for excessive memory consumption by sending multiple CloseSession requests with the deleteSubscription parameter equal to False.
Problem types: description: Denial of Service (DoS)
Affected products: vendor: n/a
product: node-opcua
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: NONE
exploitCodeMaturity: PROOF_OF_CONCEPT
integrityImpact: NONE
privilegesRequired: NONE
remediationLevel: NOT_DEFINED
reportConfidence: NOT_DEFINED
scope: UNCHANGED
temporalScore: 7.1
temporalSeverity: HIGH
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P
version: 3.1
Credits: lang: en
value: Vera Mens
lang: en
value: Uri Katz
lang: en
value: Sharon Brizinov of Team82 (Claroty Research)
Published: 2022-08-24T05:05:12.475Z
CVE-2022-24376 Command Injection
All versions of package git-promise are vulnerable to Command Injection due to an inappropriate fix of a prior [vulnerability](https://security.snyk.io/vuln/SNYK-JS-GITPROMISE-567476) in this package. **Note:** Please note that the vulnerability will not be fixed. The README file was updated with a warning regarding this issue.
Problem types: description: Command Injection
Affected products: vendor: n/a
product: git-promise
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.2
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Liran Tal
Published: 2022-06-10T20:05:25.958Z