rainbutterfly/cve_corpus huggingface dataset:
CVE-2022-31480 Unauthenticated Firmware Upload and Arbitrary Reboot
An unauthenticated attacker could arbitrarily upload firmware files to the target device, ultimately causing a Denial-of-Service (DoS). This vulnerability impacts products based on HID Mercury Intelligent Controllers LP1501, LP1502, LP2500, LP4502, and EP4502 which contain firmware versions prior to 1.302 for the LP series and 1.296 for the EP series. The attacker needs to have a properly signed and encrypted binary, loading the firmware to the device ultimately triggers a reboot.
Problem types: cwe_id: CWE-425
description: CWE-425 Direct Request (Forced Browsing)
Affected products: vendor: LenelS2
product: LNL-X2210
vendor: LenelS2
product: LNL-X2220
vendor: LenelS2
product: LNL-X3300
vendor: LenelS2
product: LNL-X4420
vendor: LenelS2
product: LNL-4420
vendor: LenelS2
product: S2-LP-1501
vendor: LenelS2
product: S2-LP-1502
vendor: LenelS2
product: S2-LP-2500
vendor: LenelS2
product: S2-LP-4502
vendor: HID Mercury
product: LP1501
vendor: HID Mercury
product: LP1502
vendor: HID Mercury
product: LP2500
vendor: HID Mercury
product: LP4502
vendor: HID Mercury
product: EP4502
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Credits: lang: en
value: Sam Quinn @eAyeP and Steve Povolny @spovolny from Trellix Threat Labs
Published: 2022-06-06T16:37:36.175Z
CVE-2022-31481 Remote Code Execution via buffer overflow in firmware update process
An unauthenticated attacker can send a specially crafted update file to the device that can overflow a buffer. This vulnerability impacts products based on HID Mercury Intelligent Controllers LP1501, LP1502, LP2500, LP4502, and EP4502 which contain firmware versions prior to 1.302 for the LP series and 1.296 for the EP series. The overflowed data can allow the attacker to manipulate the “normal” code execution to that of their choosing. An attacker with this level of access on the device can monitor all communications sent to and from this device, modify onboard relays, change configuration files, or cause the device to become unstable.
Problem types: cwe_id: CWE-120
description: CWE-120 Buffer Overflow
Affected products: vendor: LenelS2
product: LNL-X2210
vendor: LenelS2
product: LNL-X2220
vendor: LenelS2
product: LNL-X3300
vendor: LenelS2
product: LNL-X4420
vendor: LenelS2
product: LNL-4420
vendor: LenelS2
product: S2-LP-1501
vendor: LenelS2
product: S2-LP-1502
vendor: LenelS2
product: S2-LP-2500
vendor: LenelS2
product: S2-LP-4502
vendor: HID Mercury
product: LP1501
vendor: HID Mercury
product: LP1502
vendor: HID Mercury
product: LP2500
vendor: HID Mercury
product: LP4502
vendor: HID Mercury
product: EP4502
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 10
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Sam Quinn @eAyeP and Steve Povolny @spovolny from Trellix Threat Labs
Published: 2022-06-06T16:38:51.453Z
CVE-2022-31482 Denial-of-Service via internal structure overflow
An unauthenticated attacker can send a specially crafted unauthenticated HTTP request to the device that can overflow a buffer. This vulnerability impacts products based on HID Mercury Intelligent Controllers LP1501, LP1502, LP2500, LP4502, and EP4502 which contain firmware versions prior to 1.29. The overflowed data leads to segmentation fault and ultimately a denial-of-service condition, causing the device to reboot. The impact of this vulnerability is that an unauthenticated attacker could leverage this flaw to cause the target device to become unresponsive. An attacker could automate this attack to achieve persistent DoS, effectively rendering the target controller useless.
Problem types: cwe_id: CWE-120
description: CWE-120 Buffer Overflow
Affected products: vendor: LenelS2
product: LNL-X2210
vendor: LenelS2
product: LNL-X2220
vendor: LenelS2
product: LNL-X3300
vendor: LenelS2
product: LNL-X4420
vendor: LenelS2
product: LNL-4420
vendor: LenelS2
product: S2-LP-1501
vendor: LenelS2
product: S2-LP-1502
vendor: LenelS2
product: S2-LP-2500
vendor: LenelS2
product: S2-LP-4502
vendor: HID Mercury
product: LP1501
vendor: HID Mercury
product: LP1502
vendor: HID Mercury
product: LP2500
vendor: HID Mercury
product: LP4502
vendor: HID Mercury
product: EP4502
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Credits: lang: en
value: Sam Quinn @eAyeP and Steve Povolny @spovolny from Trellix Threat Labs
Published: 2022-06-06T16:39:22.500Z
CVE-2022-31483 Arbitrary file write via authenticated OSDP file upload
An authenticated attacker can upload a file with a filename including “..” and “/” to achieve the ability to upload the desired file anywhere on the filesystem. This vulnerability impacts products based on HID Mercury Intelligent Controllers LP1501, LP1502, LP2500, LP4502, and EP4502 which contain firmware versions prior to 1.271. This allows a malicious actor to overwrite sensitive system files and install a startup service to gain remote access to the underlaying Linux operating system with root privileges.
Problem types: cwe_id: CWE-22
description: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products: vendor: LenelS2
product: LNL-X2210
vendor: LenelS2
product: LNL-X2220
vendor: LenelS2
product: LNL-X3300
vendor: LenelS2
product: LNL-X4420
vendor: LenelS2
product: LNL-4420
vendor: LenelS2
product: S2-LP-1501
vendor: LenelS2
product: S2-LP-1502
vendor: LenelS2
product: S2-LP-2500
vendor: LenelS2
product: S2-LP-4502
vendor: HID Mercury
product: LP1501
vendor: HID Mercury
product: LP1502
vendor: HID Mercury
product: LP2500
vendor: HID Mercury
product: LP4502
vendor: HID Mercury
product: EP4502
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.1
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Sam Quinn @eAyeP and Steve Povolny @spovolny from Trellix Threat Labs
Published: 2022-06-06T16:39:56.305Z
CVE-2022-31484 User Account Deletion Unauthenticated
An unauthenticated attacker can send a specially crafted network packet to delete a user from the web interface. This vulnerability impacts products based on HID Mercury Intelligent Controllers LP1501, LP1502, LP2500, LP4502, and EP4502 which contain firmware versions prior to 1.29. The impact of this vulnerability is that an unauthenticated attacker could restrict access to the web interface to legitimate users and potentially requiring them to use the default user dip switch procedure to gain access back.
Problem types: cwe_id: CWE-425
description: CWE-425 Direct Request (Forced Browsing)
Affected products: vendor: LenelS2
product: LNL-X2210
vendor: LenelS2
product: LNL-X2220
vendor: LenelS2
product: LNL-X3300
vendor: LenelS2
product: LNL-X4420
vendor: LenelS2
product: LNL-4420
vendor: LenelS2
product: S2-LP-1501
vendor: LenelS2
product: S2-LP-1502
vendor: LenelS2
product: S2-LP-2500
vendor: LenelS2
product: S2-LP-4502
vendor: HID Mercury
product: LP1501
vendor: HID Mercury
product: LP1502
vendor: HID Mercury
product: LP2500
vendor: HID Mercury
product: LP4502
vendor: HID Mercury
product: EP4502
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Credits: lang: en
value: Sam Quinn @eAyeP and Steve Povolny @spovolny from Trellix Threat Labs
Published: 2022-06-06T16:40:33.983Z
CVE-2022-31485 Unauthenticated homepage note modification
An unauthenticated attacker can send a specially crafted packets to update the “notes” section of the home page of the web interface. This vulnerability impacts products based on HID Mercury Intelligent Controllers LP1501, LP1502, LP2500, LP4502, and EP4502 which contain firmware versions prior to 1.29.
Problem types: cwe_id: CWE-425
description: CWE-425 Direct Request (Forced Browsing)
Affected products: vendor: LenelS2
product: LNL-X2210
vendor: LenelS2
product: LNL-X2220
vendor: LenelS2
product: LNL-X3300
vendor: LenelS2
product: LNL-X4420
vendor: LenelS2
product: LNL-4420
vendor: LenelS2
product: S2-LP-1501
vendor: LenelS2
product: S2-LP-1502
vendor: LenelS2
product: S2-LP-2500
vendor: LenelS2
product: S2-LP-4502
vendor: HID Mercury
product: LP1501
vendor: HID Mercury
product: LP1502
vendor: HID Mercury
product: LP2500
vendor: HID Mercury
product: LP4502
vendor: HID Mercury
product: EP4502
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
version: 3.1
Credits: lang: en
value: Sam Quinn @eAyeP and Steve Povolny @spovolny from Trellix Threat Labs
Published: 2022-06-06T16:41:09.100Z
CVE-2022-31486 Command injection via Advanced Networking route add functionality
An authenticated attacker can send a specially crafted route to the “edit_route.cgi” binary and have it execute shell commands. This vulnerability impacts products based on HID Mercury Intelligent Controllers LP1501, LP1502, LP2500, LP4502, and EP4502 which contain firmware versions prior to 1.303 for the LP series and 1.297 for the EP series. An attacker with this level of access on the device can monitor all communications sent to and from this device, modify onboard relays, change configuration files, or cause the device to become unstable.
Problem types: cwe_id: CWE-78
description: CWE-78 OS Command Injection
Affected products: vendor: LenelS2
product: LNL-X2210
vendor: LenelS2
product: LNL-X2220
vendor: LenelS2
product: LNL-X3300
vendor: LenelS2
product: LNL-X4420
vendor: LenelS2
product: LNL-4420
vendor: LenelS2
product: S2-LP-1501
vendor: LenelS2
product: S2-LP-1502
vendor: LenelS2
product: S2-LP-2500
vendor: LenelS2
product: S2-LP-4502
vendor: HID Mercury
product: LP1501
vendor: HID Mercury
product: LP1502
vendor: HID Mercury
product: LP2500
vendor: HID Mercury
product: LP4502
vendor: HID Mercury
product: EP4502
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Sam Quinn @eAyeP and Steve Povolny @spovolny from Trellix Threat Labs
Published: 2022-06-06T16:41:46.407Z
CVE-2022-31487 
Inout Blockchain AltExchanger 1.2.1 and Inout Blockchain FiatExchanger 2.2.1 allow Chart/TradingView/chart_content/master.php symbol SQL injection.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-23T19:45:08.000Z
CVE-2022-31488 
Inout Blockchain AltExchanger 1.2.1 allows index.php/coins/update_marketboxslider marketcurrency SQL injection.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-23T19:44:59.000Z
CVE-2022-31489 
Inout Blockchain AltExchanger 1.2.1 allows index.php/home/about inoutio_language cookie SQL injection.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-23T19:44:50.000Z
CVE-2022-31491 
Voltronic Power ViewPower through 1.04-24215, ViewPower Pro through 2.0-22165, and PowerShield Netguard before 1.04-23292 allows a remote attacker to run arbitrary code via an unspecified web interface related to detection of a managed UPS shutting down. An unauthenticated attacker can use this to run arbitrary code immediately regardless of any managed UPS state or presence.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-08-22T00:00:00.000Z
CVE-2022-31492 
Cross Site scripting (XSS) vulnerability inLibreHealth EHR Base 2.0.0 via interface/usergroup/usergroup_admin_add.php Username.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-06T19:56:46.000Z
CVE-2022-31493 
LibreHealth EHR Base 2.0.0 allows gacl/admin/acl_admin.php acl_id XSS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-06T18:18:59.000Z
CVE-2022-31494 
LibreHealth EHR Base 2.0.0 allows gacl/admin/acl_admin.php action XSS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-06T22:28:14.000Z
CVE-2022-31495 
LibreHealth EHR Base 2.0.0 allows gacl/admin/acl_admin.php return_page XSS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-07T14:09:53.000Z
CVE-2022-31496 
LibreHealth EHR Base 2.0.0 allows incorrect interface/super/manage_site_files.php access.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-08T23:53:04.000Z
CVE-2022-31497 
LibreHealth EHR Base 2.0.0 allows interface/main/finder/finder_navigation.php patient XSS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-08T11:32:38.000Z
CVE-2022-31498 
LibreHealth EHR Base 2.0.0 allows interface/orders/patient_match_dialog.php key XSS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-06T20:10:49.000Z
CVE-2022-31499 
Nortek Linear eMerge E3-Series devices before 0.32-08f allow an unauthenticated attacker to inject OS commands via ReaderNo. NOTE: this issue exists because of an incomplete fix for CVE-2019-7256.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-25T22:09:38.000Z
CVE-2022-31500 
In KNIME Analytics Platform below 4.6.0, the Windows installer sets improper filesystem permissions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-31T13:03:14.000Z
CVE-2022-31501 
The ChaoticOnyx/OnyxForum repository before 2022-05-04 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-11T00:52:41.000Z
CVE-2022-31502 
The operatorequals/wormnest repository through 0.4.7 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-11T00:53:39.000Z
CVE-2022-31503 
The orchest/orchest repository before 2022.05.0 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-11T00:53:45.000Z
CVE-2022-31504 
The ChangeWeDer/BaiduWenkuSpider_flaskWeb repository before 2021-11-29 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-11T00:53:50.000Z
CVE-2022-31505 
The cheo0/MercadoEnLineaBack repository through 2022-05-04 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-11T00:53:56.000Z
CVE-2022-31506 
The cmusatyalab/opendiamond repository through 10.1.1 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-11T00:54:01.000Z
CVE-2022-31507 
The ganga-devs/ganga repository before 8.5.10 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-11T00:54:07.000Z
CVE-2022-31508 
The idayrus/evoting repository before 2022-05-08 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-11T00:54:12.000Z
CVE-2022-31509 
The iedadata/usap-dc-website repository through 1.0.1 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-11T00:54:17.000Z
CVE-2022-31510 
The sergeKashkin/Simple-RAT repository before 2022-05-03 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-11T00:54:24.000Z
CVE-2022-31511 
The AFDudley/equanimity repository through 2014-04-23 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-11T00:54:30.000Z
CVE-2022-31512 
The Atom02/flask-mvc repository through 2020-09-14 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-11T00:54:36.000Z
CVE-2022-31513 
The BolunHan/Krypton repository through 2021-06-03 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-11T00:54:41.000Z
CVE-2022-31514 
The Caoyongqi912/Fan_Platform repository through 2021-04-20 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-11T00:54:48.000Z
CVE-2022-31515 
The Delor4/CarceresBE repository through 1.0 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-11T00:54:54.000Z
CVE-2022-31516 
The Harveyzyh/Python repository through 2022-05-04 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-11T00:55:00.000Z
CVE-2022-31517 
The HolgerGraef/MSM repository through 2021-04-20 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-11T00:55:06.000Z
CVE-2022-31518 
The JustAnotherSoftwareDeveloper/Python-Recipe-Database repository through 2021-03-31 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-11T00:55:11.000Z
CVE-2022-31519 
The Lukasavicus/WindMill repository through 1.0 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-11T00:55:19.000Z
CVE-2022-31520 
The Luxas98/logstash-management-api repository through 2020-05-04 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-11T00:55:25.000Z
CVE-2022-31521 
The Niyaz-Mohamed/mosaic repository through 1.0.0 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-11T00:55:32.000Z
CVE-2022-31522 
The NotVinay/karaokey repository through 2019-12-11 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-11T00:55:38.000Z
CVE-2022-31523 
The PaddlePaddle/Anakin repository through 0.1.1 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-11T00:55:44.000Z
CVE-2022-31524 
The PureStorage-OpenConnect/swagger repository through 1.1.5 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-11T00:55:49.000Z
CVE-2022-31525 
The SummaLabs/DLS repository through 0.1.0 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-11T00:55:54.000Z
CVE-2022-31526 
The ThundeRatz/ThunderDocs repository through 2020-05-01 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-11T00:55:59.000Z
CVE-2022-31527 
The Wildog/flask-file-server repository through 2020-02-20 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-11T00:56:07.000Z
CVE-2022-31528 
The bonn-activity-maps/bam_annotation_tool repository through 2021-08-31 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-11T00:56:15.000Z
CVE-2022-31529 
The cinemaproject/monorepo repository through 2021-03-03 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-11T00:56:20.000Z
CVE-2022-31530 
The csm-aut/csm repository through 3.5 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-11T00:56:29.000Z
CVE-2022-31531 
The dainst/cilantro repository through 0.0.4 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-11T00:56:35.000Z
CVE-2022-31532 
The dankolbman/travel_blahg repository through 2016-01-16 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-11T00:56:44.000Z
CVE-2022-31533 
The decentraminds/umbral repository through 2020-01-15 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-11T00:56:51.000Z
CVE-2022-31534 
The echoleegroup/PythonWeb repository through 2018-10-31 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-11T00:56:59.000Z