rainbutterfly/cve_corpus huggingface dataset:
CVE-2022-24102 Adobe Acrobat Reader DC Annotation Use-After-Free Remote Code Execution Vulnerability
Acrobat Reader DC versions 20.001.20085 (and earlier), 20.005.3031x (and earlier) and 17.012.30205 (and earlier) are affected by a use-after-free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Problem types: cwe_id: CWE-416
description: Use After Free (CWE-416)
Affected products: vendor: Adobe
product: Acrobat Reader
Published: 2022-05-11T17:06:12.292Z
CVE-2022-24103 Adobe Acrobat Reader DC Annotation Use-After-Free Remote Code Execution Vulnerability
Acrobat Reader DC versions 20.001.20085 (and earlier), 20.005.3031x (and earlier) and 17.012.30205 (and earlier) are affected by a use-after-free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Problem types: cwe_id: CWE-416
description: Use After Free (CWE-416)
Affected products: vendor: Adobe
product: Acrobat Reader
Published: 2022-05-11T17:07:33.458Z
CVE-2022-24104 Adobe Acrobat Reader DC Annotation Use-After-Free Remote Code Execution Vulnerability
Acrobat Reader DC versions 20.001.20085 (and earlier), 20.005.3031x (and earlier) and 17.012.30205 (and earlier) are affected by a use-after-free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Problem types: cwe_id: CWE-416
description: Use After Free (CWE-416)
Affected products: vendor: Adobe
product: Acrobat Reader
Published: 2022-05-11T17:08:48.324Z
CVE-2022-24105 Adobe Photoshop U3D File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability
Adobe Photoshop versions 22.5.6 (and earlier)and 23.2.2 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious U3D file.
Problem types: cwe_id: CWE-787
description: Out-of-bounds Write (CWE-787)
Affected products: vendor: Adobe
product: Photoshop
Published: 2022-05-06T17:05:54.277Z
CVE-2022-24106 
In Xpdf prior to 4.04, the DCT (JPEG) decoder was incorrectly allowing the 'interleaved' flag to be changed after the first scan of the image, leading to an unknown integer-related vulnerability in Stream.cc.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-30T03:05:08.438Z
CVE-2022-24107 
Xpdf prior to 4.04 lacked an integer overflow check in JPXStream.cc.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-30T03:04:49.762Z
CVE-2022-24108 
The Skyoftech So Listing Tabs module 2.2.0 for OpenCart allows a remote attacker to inject a serialized PHP object via the setting parameter, potentially resulting in the ability to write to files on the server, cause DoS, and achieve remote code execution because of deserialization of untrusted data.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-17T15:55:07.000Z
CVE-2022-24109 
An issue was discovered in ONOS 2.5.1. To attack an intent installed by a normal user, a remote attacker can install a duplicate intent with a different key, and then remove the duplicate one. This will remove the flow rules of the intent, even though the intent still exists in the controller.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-04-20T00:00:00.000Z
CVE-2022-24110 
Kiteworks MFT 7.5 may allow an unauthorized user to reset other users' passwords. This is fixed in version 7.6 and later.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-14T03:52:59.000Z
CVE-2022-24111 
In Mahara 21.04 before 21.04.3 and 21.10 before 21.10.1, portfolios created in groups that have not been shared with non-group members and portfolios created on the site and institution levels can be viewed without requiring a login if the URL to these portfolios is known.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-10T16:01:03.000Z
CVE-2022-24112 apisix/batch-requests plugin allows overwriting the X-REAL-IP header
An attacker can abuse the batch-requests plugin to send requests to bypass the IP restriction of Admin API. A default configuration of Apache APISIX (with default API key) is vulnerable to remote code execution. When the admin key was changed or the port of Admin API was changed to a port different from the data panel, the impact is lower. But there is still a risk to bypass the IP restriction of Apache APISIX's data panel. There is a check in the batch-requests plugin which overrides the client IP with its real remote IP. But due to a bug in the code, this check can be bypassed.
Problem types: cwe_id: CWE-290
description: CWE-290 Authentication Bypass by Spoofing
Affected products: vendor: Apache Software Foundation
product: Apache APISIX
Credits: lang: en
value: Original discovery by Real World CTF at Chaitin Tech. Reported by Sauercloud.
Published: 2022-02-11T12:20:13.000Z
CVE-2022-24113 Local privilege escalation due to excessive permissions assigned to child processes
Local privilege escalation due to excessive permissions assigned to child processes. The following products are affected: Acronis Cyber Protect 15 (Windows) before build 28035, Acronis Agent (Windows) before build 27147, Acronis Cyber Protect Home Office (Windows) before build 39612, Acronis True Image 2021 (Windows) before build 39287
Problem types: cwe_id: CWE-250
description: CWE-250
Affected products: vendor: Acronis
product: Acronis Cyber Protect 15
vendor: Acronis
product: Acronis Agent
vendor: Acronis
product: Acronis Cyber Protect Home Office
vendor: Acronis
product: Acronis True Image 2021
Credits: lang: en
value: @penrose (https://hackerone.com/penrose)
Published: 2022-02-04T22:29:30.215Z
CVE-2022-24114 Local privilege escalation due to race condition on application startup
Local privilege escalation due to race condition on application startup. The following products are affected: Acronis Cyber Protect Home Office (macOS) before build 39605, Acronis True Image 2021 (macOS) before build 39287
Problem types: cwe_id: CWE-362
description: CWE-362
Affected products: vendor: Acronis
product: Acronis Cyber Protect Home Office
vendor: Acronis
product: Acronis True Image 2021
Credits: lang: en
value: @vkas-afk (https://hackerone.com/vkas-afk)
Published: 2022-02-04T22:29:32.323Z
CVE-2022-24115 Local privilege escalation due to unrestricted loading of unsigned libraries
Local privilege escalation due to unrestricted loading of unsigned libraries. The following products are affected: Acronis Cyber Protect Home Office (macOS) before build 39605, Acronis True Image 2021 (macOS) before build 39287
Problem types: cwe_id: CWE-347
description: CWE-347
Affected products: vendor: Acronis
product: Acronis Cyber Protect Home Office
vendor: Acronis
product: Acronis True Image 2021
Credits: lang: en
value: @vkas-afk (https://hackerone.com/vkas-afk)
Published: 2022-02-04T22:29:30.925Z
CVE-2022-24116 
Certain General Electric Renewable Energy products have inadequate encryption strength. This affects iNET and iNET II before 8.3.0.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-12-26T00:00:00.000Z
CVE-2022-24117 
Certain General Electric Renewable Energy products download firmware without an integrity check. This affects iNET and iNET II before 8.3.0, SD before 6.4.7, TD220X before 2.0.16, and TD220MAX before 1.2.6.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-12-26T00:00:00.000Z
CVE-2022-24118 
Certain General Electric Renewable Energy products allow attackers to use a code to trigger a reboot into the factory default configuration. This affects iNET and iNET II before 8.3.0, SD before 6.4.7, TD220X before 2.0.16, and TD220MAX before 1.2.6.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-12-26T00:00:00.000Z
CVE-2022-24119 
Certain General Electric Renewable Energy products have a hidden feature for unauthenticated remote access to the device configuration shell. This affects iNET and iNET II before 8.3.0.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-12-26T00:00:00.000Z
CVE-2022-24120 
Certain General Electric Renewable Energy products store cleartext credentials in flash memory. This affects iNET and iNET II before 8.3.0.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-12-26T00:00:00.000Z
CVE-2022-24121 
SQL Injection vulnerability discovered in Unified Office Total Connect Now that would allow an attacker to extract sensitive information through a cookie parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-03T03:41:31.000Z
CVE-2022-24122 
kernel/ucount.c in the Linux kernel 5.14 through 5.16.4, when unprivileged user namespaces are enabled, allows a use-after-free and privilege escalation because a ucounts object can outlive its namespace.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-01-29T21:33:55.000Z
CVE-2022-24123 
MarkText through 0.16.3 does not sanitize the input of a mermaid block before rendering. This could lead to Remote Code Execution via a .md file containing a mutation Cross-Site Scripting (XSS) payload.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-01-29T22:53:16.000Z
CVE-2022-24124 
The query API in Casdoor before 1.13.1 has a SQL injection vulnerability related to the field and value parameters, as demonstrated by api/get-organizations.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-01-29T22:53:01.000Z
CVE-2022-24125 
The matchmaking servers of Bandai Namco FromSoftware Dark Souls III through 2022-03-19 allow remote attackers to send arbitrary push requests to clients via a RequestSendMessageToPlayers request. For example, ability to send a push message to hundreds of thousands of machines is only restricted on the client side, and can thus be bypassed with a modified client.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-20T00:03:47.000Z
CVE-2022-24126 
A buffer overflow in the NRSessionSearchResult parser in Bandai Namco FromSoftware Dark Souls III through 2022-03-19 allows remote attackers to execute arbitrary code via matchmaking servers, a different vulnerability than CVE-2021-34170.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-19T23:54:31.000Z
CVE-2022-24127 
A Stored Cross-Site Scripting (XSS) vulnerability was discovered in ProjectGeneral/edit_project_settings.php in REDCap 12.0.11. This issue allows any user with project management permissions to inject arbitrary code into the project title (app_title) field when editing an existing project. The payload is then reflected within the title tag of the page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-15T18:16:28.000Z
CVE-2022-24128 
Timescale TimescaleDB 1.x and 2.x before 2.5.2 may allow privilege escalation during extension installation. The installation process uses commands such as CREATE x IF NOT EXIST that allow an unprivileged user to precreate objects. These objects will be used by the installer (which executes as Superuser), leading to privilege escalation. In order to be able to take advantage of this, an unprivileged user would need to be able to create objects in a database and then get a Superuser to install TimescaleDB into their database. (In the fixed versions, the installation aborts when it finds that an object already exists.)
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-13T00:00:00.000Z
CVE-2022-24129 
The OIDC OP plugin before 3.0.4 for Shibboleth Identity Provider allows server-side request forgery (SSRF) due to insufficient restriction of the request_uri parameter. This allows attackers to interact with arbitrary third-party HTTP services.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-04T19:20:46.000Z
CVE-2022-24130 
xterm through Patch 370, when Sixel support is enabled, allows attackers to trigger a buffer overflow in set_sixel in graphics_sixel.c via crafted text.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-01-31T05:01:06.000Z
CVE-2022-24131 
DouPHP v1.6 Release 20220121 is affected by Cross Site Scripting (XSS) through /admin/login.php in the background, which will lead to JavaScript code execution.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-30T11:49:55.000Z
CVE-2022-24132 
phpshe V1.8 is affected by a denial of service (DoS) attack in the registry's verification code, which can paralyze the target service.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-30T17:11:59.000Z
CVE-2022-24135 
QingScan 1.3.0 is affected by Cross Site Scripting (XSS) vulnerability in all search functions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-30T18:01:37.000Z
CVE-2022-24136 
Hospital Management System v1.0 is affected by an unrestricted upload of dangerous file type vulerability in treatmentrecord.php. To exploit, an attacker can upload any PHP file, and then execute it.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-31T10:27:18.000Z
CVE-2022-24138 
IOBit Advanced System Care (Asc.exe) 15 and Action Download Center both download components of IOBit suite into ProgramData folder, ProgramData folder has "rwx" permissions for unprivileged users. Low privilege users can use SetOpLock to wait for CreateProcess and switch the genuine component with a malicious executable thus gaining code execution as a high privilege user (Low Privilege -> high integrity ADMIN).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-06T12:41:26.000Z
CVE-2022-24139 
In IOBit Advanced System Care (AscService.exe) 15, an attacker with SEImpersonatePrivilege can create a named pipe with the same name as one of ASCService's named pipes. ASCService first tries to connect before trying to create the named pipes, because of that during login the service will try to connect to the attacker which will lead to either escalation of privileges (through token manipulation and ImpersonateNamedPipeClient() ) from ADMIN -> SYSTEM or from Local ADMIN-> Domain ADMIN depending on the user and named pipe that is used.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-06T12:41:32.000Z
CVE-2022-24140 
IOBit Advanced System Care 15, iTop Screen Recorder 2.1, iTop VPN 3.2, Driver Booster 9, and iTop Screenshot sends HTTP requests in their update procedure in order to download a config file. After downloading the config file, the products will parse the HTTP location of the update from the file and will try to install the update automatically with ADMIN privileges. An attacker Intercepting this communication can supply the product a fake config file with malicious locations for the updates thus gaining a remote code execution on an endpoint.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-06T12:41:42.000Z
CVE-2022-24141 
The iTopVPNmini.exe component of iTop VPN 3.2 will try to connect to datastate_iTopVPN_Pipe_Server on a loop. An attacker that opened a named pipe with the same name can use it to gain the token of another user by listening for connections and abusing ImpersonateNamedPipeClient().
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-06T12:41:49.000Z
CVE-2022-24142 
Tenda AX3 v16.03.12.10_CN was discovered to contain a stack overflow in the function formSetFirewallCfg. This vulnerability allows attackers to cause a Denial of Service (DoS) via the firewallEn parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-04T01:33:26.000Z
CVE-2022-24143 
Tenda AX3 v16.03.12.10_CN and AX12 22.03.01.2_CN was discovered to contain a stack overflow in the function form_fast_setting_wifi_set. This vulnerability allows attackers to cause a Denial of Service (DoS) via the timeZone parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-04T01:33:25.000Z
CVE-2022-24144 
Tenda AX3 v16.03.12.10_CN was discovered to contain a command injection vulnerability in the function WanParameterSetting. This vulnerability allows attackers to execute arbitrary commands via the gateway, dns1, and dns2 parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-04T01:33:25.000Z
CVE-2022-24145 
Tenda AX3 v16.03.12.10_CN was discovered to contain a stack overflow in the function formWifiBasicSet. This vulnerability allows attackers to cause a Denial of Service (DoS) via the security and security_5g parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-04T01:33:22.000Z
CVE-2022-24146 
Tenda AX3 v16.03.12.10_CN was discovered to contain a stack overflow in the function formSetQosBand. This vulnerability allows attackers to cause a Denial of Service (DoS) via the list parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-04T01:33:22.000Z
CVE-2022-24147 
Tenda AX3 v16.03.12.10_CN was discovered to contain a stack overflow in the function fromAdvSetMacMtuWan. This vulnerability allows attackers to cause a Denial of Service (DoS) via the wanMTU, wanSpeed, cloneType, mac, and serviceName parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-04T01:33:21.000Z
CVE-2022-24148 
Tenda AX3 v16.03.12.10_CN was discovered to contain a command injection vulnerability in the function mDMZSetCfg. This vulnerability allows attackers to execute arbitrary commands via the dmzIp parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-04T01:33:20.000Z
CVE-2022-24149 
Tenda AX3 v16.03.12.10_CN was discovered to contain a stack overflow in the function fromSetWirelessRepeat. This vulnerability allows attackers to cause a Denial of Service (DoS) via the wpapsk_crypto parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-04T01:33:20.000Z
CVE-2022-24150 
Tenda AX3 v16.03.12.10_CN was discovered to contain a command injection vulnerability in the function formSetSafeWanWebMan. This vulnerability allows attackers to execute arbitrary commands via the remoteIp parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-04T01:33:17.000Z
CVE-2022-24151 
Tenda AX3 v16.03.12.10_CN was discovered to contain a stack overflow in the function fromSetWifiGusetBasic. This vulnerability allows attackers to cause a Denial of Service (DoS) via the shareSpeed parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-04T01:33:17.000Z
CVE-2022-24152 
Tenda AX3 v16.03.12.10_CN was discovered to contain a stack overflow in the function fromSetRouteStatic. This vulnerability allows attackers to cause a Denial of Service (DoS) via the list parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-04T01:33:16.000Z
CVE-2022-24153 
Tenda AX3 v16.03.12.10_CN was discovered to contain a stack overflow in the function formAddMacfilterRule. This vulnerability allows attackers to cause a Denial of Service (DoS) via the devName parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-04T01:33:15.000Z
CVE-2022-24154 
Tenda AX3 v16.03.12.10_CN was discovered to contain a stack overflow in the function formSetRebootTimer. This vulnerability allows attackers to cause a Denial of Service (DoS) via the rebootTime parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-04T01:33:15.000Z
CVE-2022-24155 
Tenda AX3 v16.03.12.10_CN was discovered to contain a heap overflow in the function setSchedWifi. This vulnerability allows attackers to cause a Denial of Service (DoS) via the schedStartTime and schedEndTime parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-04T01:33:14.000Z
CVE-2022-24156 
Tenda AX3 v16.03.12.10_CN was discovered to contain a stack overflow in the function formSetVirtualSer. This vulnerability allows attackers to cause a Denial of Service (DoS) via the list parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-04T01:33:13.000Z
CVE-2022-24157 
Tenda AX3 v16.03.12.10_CN was discovered to contain a stack overflow in the function formSetMacFilterCfg. This vulnerability allows attackers to cause a Denial of Service (DoS) via the deviceList parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-04T01:33:12.000Z
CVE-2022-24158 
Tenda AX3 v16.03.12.10_CN was discovered to contain a stack overflow in the function fromSetIpMacBind. This vulnerability allows attackers to cause a Denial of Service (DoS) via the list parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-04T01:33:11.000Z
CVE-2022-24159 
Tenda AX3 v16.03.12.10_CN was discovered to contain a stack overflow in the function formSetPPTPServer. This vulnerability allows attackers to cause a Denial of Service (DoS) via the startIp and endIp parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-04T01:33:08.000Z
CVE-2022-24160 
Tenda AX3 v16.03.12.10_CN was discovered to contain a stack overflow in the function formSetDeviceName. This vulnerability allows attackers to cause a Denial of Service (DoS) via the devName parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-04T01:33:06.000Z
CVE-2022-24161 
Tenda AX3 v16.03.12.10_CN was discovered to contain a heap overflow in the function GetParentControlInfo. This vulnerability allows attackers to cause a Denial of Service (DoS) via the mac parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-04T01:33:06.000Z
CVE-2022-24162 
Tenda AX3 v16.03.12.10_CN was discovered to contain a stack overflow in the function saveParentControlInfo. This vulnerability allows attackers to cause a Denial of Service (DoS) via the time parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-04T01:33:08.000Z
CVE-2022-24163 
Tenda AX3 v16.03.12.10_CN was discovered to contain a stack overflow in the function fromSetSysTime. This vulnerability allows attackers to cause a Denial of Service (DoS) via the timeZone parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-04T01:33:03.000Z
CVE-2022-24164 
Tenda routers G1 and G3 v15.11.0.17(9502)_CN were discovered to contain a stack overflow in the function formSetVirtualSer. This vulnerability allows attackers to cause a Denial of Service (DoS) via the DnsHijackRule parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-04T01:33:04.000Z