rainbutterfly/cve_corpus huggingface dataset:
CVE-2022-24668 
A program using swift-nio-http2 is vulnerable to a denial of service attack caused by a network peer sending ALTSVC or ORIGIN frames. This attack affects all swift-nio-http2 versions from 1.0.0 to 1.19.1. This vulnerability is caused by a logical error after frame parsing but before frame handling. ORIGIN and ALTSVC frames are not currently supported by swift-nio-http2, and should be ignored. However, one code path that encounters them has a deliberate trap instead. This was left behind from the original development process and was never removed. Sending an ALTSVC or ORIGIN frame does not require any special permission, so any HTTP/2 connection peer may send such a frame. For clients, this means any server to which they connect may launch this attack. For servers, anyone they allow to connect to them may launch such an attack. The attack is low-effort: it takes very little resources to send one of these frames. The impact on availability is high: receiving the frame immediately crashes the server, dropping all in-flight connections and causing the service to need to restart. It is straightforward for an attacker to repeatedly send these frames, so attackers require very few resources to achieve a substantial denial of service. The attack does not have any confidentiality or integrity risks in and of itself. This is a controlled, intentional crash. However, sudden process crashes can lead to violations of invariants in services, so it is possible that this attack can be used to trigger an error condition that has confidentiality or integrity risks. The risk can be mitigated if untrusted peers can be prevented from communicating with the service. This mitigation is not available to many services. The issue is fixed by rewriting the parsing code to correctly handle the condition. The issue was found by automated fuzzing by oss-fuzz.
Problem types: cwe_id: CWE-241
description: CWE-241: Improper Handling of Unexpected Data Type
Affected products: vendor: Swift Project
product: SwiftNIO HTTP2
Published: 2022-02-09T22:05:18.000Z
CVE-2022-24669 Anonymous users can register / de-register for configuration change notifications
It may be possible to gain some details of the deployment through a well-crafted attack. This may allow that data to be used to probe internal network services.
Problem types: cwe_id: CWE-862
description: CWE-862 Missing Authorization
Affected products: vendor: ForgeRock
product: Access Management
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: NONE
baseScore: 6.5
baseSeverity: MEDIUM
Published: 2022-10-27T16:53:56.378Z
CVE-2022-24670 Any user can run unrestricted LDAP queries against a configuration endpoint
An attacker can use the unrestricted LDAP queries to determine configuration entries
Problem types: cwe_id: CWE-200
description: CWE-200 Information Exposure
Affected products: vendor: ForgeRock
product: Access Management
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: NONE
availabilityImpact: LOW
baseScore: 7.1
baseSeverity: HIGH
Published: 2022-10-27T16:53:00.019Z
CVE-2022-24671 
A link following privilege escalation vulnerability in Trend Micro Antivirus for Max 11.0.2150 and below could allow a local attacker to modify a file during the update process and escalate their privileges. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
Problem types: description: Link Following Privilege Escalation
Affected products: vendor: Trend Micro
product: Trend Micro Antivirus for Mac
Published: 2022-02-24T02:45:48.000Z
CVE-2022-24672 
This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Canon imageCLASS MF644Cdw 10.02 printers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the CADM service. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-15802.
Problem types: cwe_id: CWE-122
description: CWE-122: Heap-based Buffer Overflow
Affected products: vendor: Canon
product: imageCLASS MF644Cdw
Credits: lang: en
value: Mehdi Talbi (@abu_y0ussef), Remi Jullian (@netsecurity1), Thomas Jeunet (@cleptho), from @Synacktiv
Published: 2023-03-28T00:00:00.000Z
CVE-2022-24673 
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Canon imageCLASS MF644Cdw 10.02 printers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the implementation of the SLP protocol. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-15845.
Problem types: cwe_id: CWE-121
description: CWE-121: Stack-based Buffer Overflow
Affected products: vendor: Canon
product: imageCLASS MF644Cdw
Credits: lang: en
value: Angelboy (@scwuaptx) from DEVCORE Research Team
Published: 2023-03-28T00:00:00.000Z
CVE-2022-24674 
This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Canon imageCLASS MF644Cdw 10.02 printers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the privet API. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-15834.
Problem types: cwe_id: CWE-121
description: CWE-121: Stack-based Buffer Overflow
Affected products: vendor: Canon
product: imageCLASS MF644Cdw
Credits: lang: en
value: Nicolas Devillers ( @nikaiw ), Jean-Romain Garnier and Raphael Rigo ( @_trou_ )
Published: 2023-03-28T00:00:00.000Z
CVE-2022-24675 
encoding/pem in Go before 1.17.9 and 1.18.x before 1.18.1 has a Decode stack overflow via a large amount of PEM data.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-04-20T00:00:00.000Z
CVE-2022-24676 
update_code in Admin.php in HYBBS2 through 2.3.2 allows arbitrary file upload via a crafted ZIP archive.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-08T23:48:56.000Z
CVE-2022-24677 
Admin.php in HYBBS2 through 2.3.2 allows remote code execution because it writes plugin-related configuration information to conf.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-08T23:48:40.000Z
CVE-2022-24678 
An security agent resource exhaustion denial-of-service vulnerability in Trend Micro Apex One, Trend Micro Apex One as a Service, Trend Micro Worry-Free Business Security 10.0 SP1 and Trend Micro Worry-Free Business Security Services agents could allow an attacker to flood a temporary log location and consume all disk space on affected installations.
Problem types: description: Resource Exhaustion Denial-of-Service
Affected products: vendor: Trend Micro
product: Trend Micro Apex One
vendor: Trend Micro
product: Trend Micro Worry-Free Business Security
Published: 2022-02-24T02:45:49.000Z
CVE-2022-24679 
A security link following local privilege escalation vulnerability in Trend Micro Apex One, Trend Micro Apex One as a Service, Trend Micro Worry-Free Business Security 10.0 SP1 and Trend Micro Worry-Free Business Security Services agents could allow a local attacker to create an writable folder in an arbitrary location and escalate privileges affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
Problem types: description: Link Following Local Privilege Escalation
Affected products: vendor: Trend Micro
product: Trend Micro Apex One
vendor: Trend Micro
product: Trend Micro Worry-Free Business Security
Published: 2022-02-24T02:45:51.000Z
CVE-2022-24680 
A security link following local privilege escalation vulnerability in Trend Micro Apex One, Trend Micro Apex One as a Service, Trend Micro Worry-Free Business Security 10.0 SP1 and Trend Micro Worry-Free Business Security Services agents could allow a local attacker to create a mount point and leverage this for arbitrary folder deletion, leading to escalated privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
Problem types: description: Link Following Local Privilege Escalation
Affected products: vendor: Trend Micro
product: Trend Micro Apex One
vendor: Trend Micro
product: Trend Micro Worry-Free Business Security
Published: 2022-02-24T02:45:52.000Z
CVE-2022-24681 
Zoho ManageEngine ADSelfService Plus before 6121 allows XSS via the welcome name attribute to the Reset Password, Unlock Account, or User Must Change Password screen.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-04-07T21:49:29.000Z
CVE-2022-24682 
An issue was discovered in the Calendar feature in Zimbra Collaboration Suite 8.8.x before 8.8.15 patch 30 (update 1), as exploited in the wild starting in December 2021. An attacker could place HTML containing executable JavaScript inside element attributes. This markup becomes unescaped, causing arbitrary markup to be injected into the document.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-09T03:19:04.000Z
CVE-2022-24683 
HashiCorp Nomad and Nomad Enterprise 0.9.2 through 1.0.17, 1.1.11, and 1.2.5 allow operators with read-fs and alloc-exec (or job-submit) capabilities to read arbitrary files on the host filesystem as root.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-17T16:36:37.000Z
CVE-2022-24684 
HashiCorp Nomad and Nomad Enterprise 0.9.0 through 1.0.16, 1.1.11, and 1.2.5 allow operators with job-submit capabilities to use the spread stanza to panic server agents. Fixed in 1.0.18, 1.1.12, and 1.2.6.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-15T14:04:46.000Z
CVE-2022-24685 
HashiCorp Nomad and Nomad Enterprise 1.0.17, 1.1.11, and 1.2.5 allow invalid HCL for the jobs parse endpoint, which may cause excessive CPU usage. Fixed in 1.0.18, 1.1.12, and 1.2.6.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-28T13:26:51.000Z
CVE-2022-24686 
HashiCorp Nomad and Nomad Enterprise 0.3.0 through 1.0.17, 1.1.11, and 1.2.5 artifact download functionality has a race condition such that the Nomad client agent could download the wrong artifact into the wrong destination. Fixed in 1.0.18, 1.1.12, and 1.2.6
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-14T13:54:07.000Z
CVE-2022-24687 
HashiCorp Consul and Consul Enterprise 1.9.0 through 1.9.14, 1.10.7, and 1.11.2 clusters with at least one Ingress Gateway allow a user with service:write to register a specifically-defined service that can cause Consul servers to panic. Fixed in 1.9.15, 1.10.8, and 1.11.3.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-24T15:37:51.000Z
CVE-2022-24688 
An issue was discovered in DSK DSKNet 2.16.136.0 and 2.17.136.5. The Touch settings allow unrestricted file upload (and consequently Remote Code Execution) via PDF upload with PHP content and a .php extension. The attacker must hijack or obtain privileged user access to the Parameters page in order to exploit this issue. (That can be easily achieved by exploiting the Broken Access Control with further Brute-force attack or SQL Injection.) The uploaded file is stored within the database and copied to the sync web folder if the attacker visits a certain .php?action= page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-18T12:34:18.000Z
CVE-2022-24689 
An issue was discovered in DSK DSKNet 2.16.136.0 and 2.17.136.5. It mishandles access control. This allows a remote attacker to access account information pages (including personal data) without being authenticated. The collected information includes the badge numbers that operate as user login names. They have a PIN code. The PIN code is 4 digits and thus can be guessed in 10000 brute force attempts.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-18T12:34:24.000Z
CVE-2022-24690 
An issue was discovered in DSK DSKNet 2.16.136.0 and 2.17.136.5. A PresAbs.php SQL Injection vulnerability allows unauthenticated users to taint database data and extract sensitive information via crafted HTTP requests. The type of SQL Injection is blind boolean based. (An unauthenticated attacker can discover the endpoint by abusing a Broken Access Control issue with further SQL injection attacks to gather all user's badge numbers and PIN codes.)
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-18T12:34:29.000Z
CVE-2022-24691 
An issue was discovered in DSK DSKNet 2.16.136.0 and 2.17.136.5. A SQL Injection vulnerability allows authenticated users to taint database data and extract sensitive information via crafted HTTP requests. The type of SQL Injection is blind boolean based.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-18T12:34:34.000Z
CVE-2022-24692 
An issue was discovered in DSK DSKNet 2.16.136.0 and 2.17.136.5. The new menu option within the general Parameters page is vulnerable to stored XSS. The attacker can create a menu option, make it visible to every application user, and conduct session hijacking, account takeover, or malicious code delivery, with the final goal of achieving client-side code execution.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-18T12:34:40.000Z
CVE-2022-24693 
Baicells Nova436Q and Neutrino 430 devices with firmware through QRTB 2.7.8 have hardcoded credentials that are easily discovered, and can be used by remote attackers to authenticate via ssh. (The credentials are stored in the firmware, encrypted by the crypt function.)
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-30T01:43:18.000Z
CVE-2022-24694 
In Mahara 20.10 before 20.10.4, 21.04 before 21.04.3, and 21.10 before 21.10.1, the names of folders in the Files area can be seen by a person not owning the folders. (Only folder names are affected. Neither file names nor file contents are affected.)
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-09T04:31:50.000Z
CVE-2022-24695 
Bluetooth Classic in Bluetooth Core Specification through 5.3 does not properly conceal device information for Bluetooth transceivers in Non-Discoverable mode. By conducting an efficient over-the-air attack, an attacker can fully extract the permanent, unique Bluetooth MAC identifier, along with device capabilities and identifiers, some of which may contain identifying information about the device owner. This additionally allows the attacker to establish a connection to the target device.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-06-02T00:00:00.000Z
CVE-2022-24696 
Mirametrix Glance before 5.1.1.42207 (released on 2018-08-30) allows a local attacker to elevate privileges. NOTE: this is unrelated to products from the glance.com and glance.net websites.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-13T17:50:21.000Z
CVE-2022-24697 Apache Kylin prior to 4.0.2 allows command injection when the configuration overwrites function overwrites system parameters
Kylin's cube designer function has a command injection vulnerability when overwriting system parameters in the configuration overwrites menu. RCE can be implemented by closing the single quotation marks around the parameter value of “-- conf=” to inject any operating system command into the command line parameters. This vulnerability affects Kylin 2 version 2.6.5 and earlier, Kylin 3 version 3.1.2 and earlier, and Kylin 4 version 4.0.1 and earlier.
Problem types: description: Command injection
Affected products: vendor: Apache Software Foundation
product: Apache Kylin
Credits: lang: en
value: Kylin Team would like to thanks Kai Zhao of ToTU Secruity Team.
Published: 2022-10-13T00:00:00.000Z
CVE-2022-24700 
An issue was discovered in WinAPRS 2.9.0. A buffer overflow in DIGI address processing for VHF KISS packets allows a remote attacker to cause a denial of service (daemon crash) via a malicious AX.25 packet over the air. NOTE: This vulnerability only affects products that are no longer supported by the maintainer
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-31T19:51:23.000Z
CVE-2022-24701 
An issue was discovered in WinAPRS 2.9.0. A buffer overflow in national.txt processing allows a local attacker to cause a denial of service or possibly achieve code execution. NOTE: This vulnerability only affects products that are no longer supported by the maintainer
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-31T19:52:15.000Z
CVE-2022-24702 
An issue was discovered in WinAPRS 2.9.0. A buffer overflow in the VHF KISS TNC component allows a remote attacker to achieve remote code execution via malicious AX.25 packets over the air. NOTE: This vulnerability only affects products that are no longer supported by the maintainer
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-31T19:51:03.000Z
CVE-2022-24704 Buffer Overflow via Crafted IPv6 Addr Attribute Type Client Request in Accel-PPP v1.12
The rad_packet_recv function in opt/src/accel-pppd/radius/packet.c suffers from a buffer overflow vulnerability, whereby user input len is copied into a fixed buffer &attr->val.integer without any bound checks. If the client connects to the server and sends a large radius packet, a buffer overflow vulnerability will be triggered.
Problem types: description: https://cwe.mitre.org/data/definitions/120.html
Affected products: vendor: https://accel-ppp.org/
product: Accel-PPP
Credits: lang: en
value: Chloe Ong from Government Technology Agency of Singapore
lang: en
value: Eugene Lim from Government Technology Agency of Singapore
lang: en
value: Kar Wei Loh from Government Technology Agency of Singapore
Published: 2022-02-14T21:04:29.942Z
CVE-2022-24705 Buffer Overflow via Crafted Ipv6 Prefix Attribute Type Client Request in accel-ppp v1.12
The rad_packet_recv function in radius/packet.c suffers from a memcpy buffer overflow, resulting in an overly-large recvfrom into a fixed buffer that causes a buffer overflow and overwrites arbitrary memory. If the server connects with a malicious client, crafted client requests can remotely trigger this vulnerability.
Problem types: description: https://cwe.mitre.org/data/definitions/120.html
Affected products: vendor: https://accel-ppp.org/
product: accel-ppp
Credits: lang: en
value: Chloe Ong from Government Technology Agency of Singapore
lang: en
value: Eugene Lim from Government Technology Agency of Singapore
lang: en
value: Kar Wei Loh from Government Technology Agency of Singapore
Published: 2022-02-14T21:04:30.848Z
CVE-2022-24706 Remote Code Execution Vulnerability in Packaging
In Apache CouchDB prior to 3.2.2, an attacker can access an improperly secured default installation without authenticating and gain admin privileges. The CouchDB documentation has always made recommendations for properly securing an installation, including recommending using a firewall in front of all CouchDB installations.
Problem types: cwe_id: CWE-1188
description: CWE-1188 Insecure Default Initialization of Resource
Affected products: vendor: Apache Software Foundation
product: Apache CouchDB
Credits: lang: en
value: The Apache CouchDB Team would like to thank Alex Vandiver <alexmv@zulip.com> for the report of this issue.
Published: 2022-04-26T00:00:00.000Z
CVE-2022-24707 SQL injection in anuko timetracker
Anuko Time Tracker is an open source, web-based time tracking application written in PHP. UNION SQL injection and time-based blind injection vulnerabilities existed in Time Tracker Puncher plugin in versions of anuko timetracker prior to 1.20.0.5642. This was happening because the Puncher plugin was reusing code from other places and was relying on an unsanitized date parameter in POST requests. Because the parameter was not checked, it was possible to craft POST requests with malicious SQL for Time Tracker database. This issue has been resolved in in version 1.20.0.5642. Users unable to upgrade are advised to add their own checks to input.
Problem types: cwe_id: CWE-89
description: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: anuko
product: timetracker
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 7.4
baseSeverity: HIGH
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L
version: 3.1
Published: 2022-02-23T23:50:14.000Z
CVE-2022-24708 Stored XSS vulnerability in anuko/timetracker
Anuko Time Tracker is an open source, web-based time tracking application written in PHP. ttUser.class.php in Time Tracker versions prior to 1.20.0.5646 was not escaping primary group name for display. Because of that, it was possible for a logged in user to modify primary group name with elements of JavaScript. Such script could then be executed in user browser on subsequent requests on pages where primary group name was displayed. This is vulnerability has been fixed in version 1.20.0.5646. Users who are unable to upgrade may modify ttUser.class.php to use an additional call to htmlspecialchars when printing group name.
Problem types: cwe_id: CWE-79
description: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: anuko
product: timetracker
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
version: 3.1
Published: 2022-02-23T23:50:09.000Z
CVE-2022-24709 Cross site scripting in @awsui/components-react
@awsui/components-react is the main AWS UI package which contains React components, with TypeScript definitions designed for user interface development. Multiple components in versions before 3.0.367 have been found to not properly neutralize user input and may allow for javascript injection. Users are advised to upgrade to version 3.0.367 or later. There are no known workarounds for this issue.
Problem types: cwe_id: CWE-79
description: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: aws
product: awsui-documentation
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
version: 3.1
Published: 2022-02-24T19:55:11.000Z