rainbutterfly/cve_corpus huggingface dataset:
CVE-2023-38944 
An issue in Multilaser RE160V firmware v12.03.01.09_pt and Multilaser RE163V firmware v12.03.01.10_pt allows attackers to bypass the access control and gain complete access to the application via modifying a HTTP header.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-03-05T00:00:00.000Z
CVE-2023-38945 
Multilaser RE160 v5.07.51_pt_MTL01 and v5.07.52_pt_MTL01, Multilaser RE160V v12.03.01.08_pt and V12.03.01.09_pt, and Multilaser RE163V v12.03.01.08_pt allows attackers to bypass the access control and gain complete access to the application via supplying a crafted URL.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-03-06T00:00:00.000Z
CVE-2023-38946 
An issue in Multilaser RE160 firmware v5.07.51_pt_MTL01 and v5.07.52_pt_MTL01 allows attackers to bypass the access control and gain complete access to the application via supplying a crafted cookie.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-03-06T00:00:00.000Z
CVE-2023-38947 
An arbitrary file upload vulnerability in the /languages/install.php component of WBCE CMS v1.6.1 allows attackers to execute arbitrary code via a crafted PHP file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-08-03T00:00:00.000Z
CVE-2023-38948 
An arbitrary file download vulnerability in the /c/PluginsController.php component of jizhi CMS 1.9.5 allows attackers to execute arbitrary code via downloading a crafted plugin.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-08-03T00:00:00.000Z
CVE-2023-38949 
An issue in a hidden API in ZKTeco BioTime v8.5.5 allows unauthenticated attackers to arbitrarily reset the Administrator password via a crafted web request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-08-03T00:00:00.000Z
CVE-2023-38950 
A path traversal vulnerability in the iclock API of ZKTeco BioTime v8.5.5 allows unauthenticated attackers to read arbitrary files via supplying a crafted payload. This vulnerability was fixed in version 9.0.120240617.19506 of ZKBioTime.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-08-03T00:00:00.000Z
CVE-2023-38951 
ZKTeco BioTime 8.5.5 through 9.x before 9.0.1 (20240617.19506) allows authenticated attackers to create or overwrite arbitrary files on the server via crafted requests to /base/sftpsetting/ endpoints that abuse a path traversal issue in the Username field and a lack of input sanitization on the SSH Key field. Overwriting specific files may lead to arbitrary code execution as NT AUTHORITY\SYSTEM.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-08-03T00:00:00.000Z
CVE-2023-38952 
Insecure access control in ZKTeco BioTime through 9.0.1 allows authenticated attackers to escalate their privileges due to the fact that session ids are not validated for the type of user accessing the application by default. Privilege restrictions between non-admin and admin users are not enforced and any authenticated user can leverage admin functions without restriction by making direct requests to administrative endpoints.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-08-03T00:00:00.000Z
CVE-2023-38954 
ZKTeco BioAccess IVS v3.3.1 was discovered to contain a SQL injection vulnerability.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-08-03T00:00:00.000Z
CVE-2023-38955 
ZKTeco BioAccess IVS v3.3.1 allows unauthenticated attackers to obtain sensitive information about all managed devices, including their IP addresses and device names.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-08-03T00:00:00.000Z
CVE-2023-38956 
A path traversal vulnerability in ZKTeco BioAccess IVS v3.3.1 allows unauthenticated attackers to read arbitrary files via supplying a crafted payload.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-08-03T00:00:00.000Z
CVE-2023-38958 
An access control issue in ZKTeco BioAccess IVS v3.3.1 allows unauthenticated attackers to arbitrarily close and open the doors managed by the platform remotely via sending a crafted web request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-08-03T00:00:00.000Z
CVE-2023-38960 
Insecure Permissions issue in Raiden Professional Server RaidenFTPD v.2.4 build 4005 allows a local attacker to gain privileges and execute arbitrary code via crafted executable running from the installation directory.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-02-13T00:00:00.000Z
CVE-2023-38961 
Buffer Overflwo vulnerability in JerryScript Project jerryscript v.3.0.0 allows a remote attacker to execute arbitrary code via the scanner_is_context_needed component in js-scanner-until.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-08-21T00:00:00.000Z
CVE-2023-38964 
Creative Item Academy LMS 6.0 was discovered to contain a cross-site scripting (XSS) vulnerability.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-08-04T00:00:00.000Z
CVE-2023-38965 
Lost and Found Information System 1.0 allows account takeover via username and password to a /classes/Users.php?f=save URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-11-03T00:00:00.000Z
CVE-2023-38969 
Cross Site Scripting vulnerabiltiy in Badaso v.2.9.7 allows a remote attacker to execute arbitrary code via a crafted payload to the title parameter in the new book and edit book function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-08-28T00:00:00.000Z
CVE-2023-38970 
Cross Site Scripting vulnerabiltiy in Badaso v.0.0.1 thru v.2.9.7 allows a remote attacker to execute arbitrary code via a crafted payload to the Name of member parameter in the add new member function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-08-30T00:00:00.000Z
CVE-2023-38971 
Cross Site Scripting vulnerabiltiy in Badaso v.0.0.1 thru v.2.9.7 allows a remote attacker to execute arbitrary code via a crafted payload to the rack number parameter in the add new rack function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-08-29T00:00:00.000Z
CVE-2023-38973 
A stored cross-site scripting (XSS) vulnerability in the Add Tag function of Badaso v2.9.7 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Title parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-08-25T00:00:00.000Z
CVE-2023-38974 
A stored cross-site scripting (XSS) vulnerability in the Edit Category function of Badaso v2.9.7 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Title parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-08-25T00:00:00.000Z
CVE-2023-38975 
* Buffer Overflow vulnerability in qdrant v.1.3.2 allows a remote attacker cause a denial of service via the chucnked_vectors.rs component.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-08-29T00:00:00.000Z
CVE-2023-38976 
An issue in weaviate v.1.20.0 allows a remote attacker to cause a denial of service via the handleUnbatchedGraphQLRequest function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-08-21T00:00:00.000Z
CVE-2023-38988 
An issue in the delete function in the OaNotifyController class of jeesite v1.2.6 allows authenticated attackers to arbitrarily delete notifications created by Administrators.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-07-28T00:00:00.000Z
CVE-2023-38989 
An issue in the delete function in the UserController class of jeesite v1.2.6 allows authenticated attackers to arbitrarily delete the Administrator's role information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-07-31T00:00:00.000Z
CVE-2023-38990 
An issue in the delete function in the MenuController class of jeesite v1.2.6 allows authenticated attackers to arbitrarily delete menus created by the Administrator.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-08-01T00:00:00.000Z
CVE-2023-38991 
An issue in the delete function in the ActModelController class of jeesite v1.2.6 allows authenticated attackers to arbitrarily delete models created by the Administrator.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-08-03T00:00:00.000Z
CVE-2023-38992 
jeecg-boot v3.5.1 was discovered to contain a SQL injection vulnerability via the title parameter at /sys/dict/loadTreeData.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-07-28T00:00:00.000Z
CVE-2023-38994 
The 'check_univention_joinstatus' prometheus monitoring script (and other scripts) in UCS 5.0-5 revealed the LDAP plaintext password of the machine account in the process list allowing attackers with local ssh access to gain higher privileges and perform followup attacks. By default, the configuration of UCS does not allow local ssh access for regular users.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AC:L/AV:L/A:N/C:H/I:H/PR:H/S:C/UI:N
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: HIGH
userInteraction: NONE
scope: CHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: NONE
baseScore: 7.9
baseSeverity: HIGH
Published: 2023-10-31T00:00:00.000Z
CVE-2023-38995 
An issue in SCHUHFRIED v.8.22.00 allows remote attacker to obtain the database password via crafted curl command.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-02-07T00:00:00.000Z
CVE-2023-38996 
An issue in all versions of Douran DSGate allows a local authenticated privileged attacker to execute arbitrary code via the debug command.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-08-22T00:00:00.000Z
CVE-2023-38997 
A directory traversal vulnerability in the Captive Portal templates of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 allows attackers to execute arbitrary system commands as root via a crafted ZIP archive.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-08-09T00:00:00.000Z
CVE-2023-38998 
An open redirect in the Login page of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 allows attackers to redirect a victim user to an arbitrary web site via a crafted URL.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-08-09T00:00:00.000Z
CVE-2023-38999 
A Cross-Site Request Forgery (CSRF) in the System Halt API (/system/halt) of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 allows attackers to cause a Denial of Service (DoS) via a crafted GET request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-08-09T00:00:00.000Z
CVE-2023-39000 
A reflected cross-site scripting (XSS) vulnerability in the component /ui/diagnostics/log/core/ of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 allows attackers to inject arbitrary JavaScript via the URL path.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-08-09T00:00:00.000Z
CVE-2023-39001 
A command injection vulnerability in the component diag_backup.php of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 allows attackers to execute arbitrary commands via a crafted backup configuration file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-08-09T00:00:00.000Z
CVE-2023-39002 
A cross-site scripting (XSS) vulnerability in the act parameter of system_certmanager.php in OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-08-09T00:00:00.000Z
CVE-2023-39003 
OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 was discovered to contain insecure permissions in the directory /tmp.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-08-09T00:00:00.000Z
CVE-2023-39004 
Insecure permissions in the configuration directory (/conf/) of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 allow attackers to access sensitive information (e.g., hashed root password) which could lead to privilege escalation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-08-09T00:00:00.000Z
CVE-2023-39005 
Insecure permissions exist for configd.socket in OPNsense Community Edition before 23.7 and Business Edition before 23.4.2.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-08-09T00:00:00.000Z
CVE-2023-39006 
The Crash Reporter (crash_reporter.php) component of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 mishandles input sanitization.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-08-09T00:00:00.000Z
CVE-2023-39007 
/ui/cron/item/open in the Cron component of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 allows XSS via openAction in app/controllers/OPNsense/Cron/ItemController.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-08-09T00:00:00.000Z
CVE-2023-39008 
A command injection vulnerability in the component /api/cron/settings/setJob/ of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 allows attackers to execute arbitrary system commands.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-08-09T00:00:00.000Z
CVE-2023-39010 
BoofCV 0.42 was discovered to contain a code injection vulnerability via the component boofcv.io.calibration.CalibrationIO.load. This vulnerability is exploited by loading a crafted camera calibration file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-07-28T00:00:00.000Z
CVE-2023-39013 
Duke v1.2 and below was discovered to contain a code injection vulnerability via the component no.priv.garshol.duke.server.CommonJTimer.init.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-07-28T00:00:00.000Z
CVE-2023-39015 
webmagic-extension v0.9.0 and below was discovered to contain a code injection vulnerability via the component us.codecraft.webmagic.downloader.PhantomJSDownloader.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-07-28T00:00:00.000Z
CVE-2023-39016 
bboss-persistent v6.0.9 and below was discovered to contain a code injection vulnerability in the component com.frameworkset.common.poolman.util.SQLManager.createPool. This vulnerability is exploited via passing an unchecked argument.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-07-28T00:00:00.000Z
CVE-2023-39017 
quartz-jobs 2.3.2 and below was discovered to contain a code injection vulnerability in the component org.quartz.jobs.ee.jms.SendQueueMessageJob.execute. This vulnerability is exploited via passing an unchecked argument. NOTE: this is disputed by multiple parties because it is not plausible that untrusted user input would reach the code location where injection must occur.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-07-28T00:00:00.000Z
CVE-2023-39018 
FFmpeg 0.7.0 and below was discovered to contain a code injection vulnerability in the component net.bramp.ffmpeg.FFmpeg.<constructor>. This vulnerability is exploited via passing an unchecked argument. NOTE: this is disputed by multiple third parties because there are no realistic use cases in which FFmpeg.java uses untrusted input for the path of the executable file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-07-28T00:00:00.000Z
CVE-2023-39020 
stanford-parser v3.9.2 and below was discovered to contain a code injection vulnerability in the component edu.stanford.nlp.io.getBZip2PipedInputStream. This vulnerability is exploited via passing an unchecked argument.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-07-28T00:00:00.000Z
CVE-2023-39021 
wix-embedded-mysql v4.6.1 and below was discovered to contain a code injection vulnerability in the component com.wix.mysql.distribution.Setup.apply. This vulnerability is exploited via passing an unchecked argument.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-07-28T00:00:00.000Z
CVE-2023-39022 
oscore v2.2.6 and below was discovered to contain a code injection vulnerability in the component com.opensymphony.util.EJBUtils.createStateless. This vulnerability is exploited via passing an unchecked argument.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-07-28T00:00:00.000Z
CVE-2023-39023 
university compass v2.2.0 and below was discovered to contain a code injection vulnerability in the component org.compass.core.executor.DefaultExecutorManager.configure. This vulnerability is exploited via passing an unchecked argument.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-07-28T00:00:00.000Z
CVE-2023-39026 
Directory Traversal vulnerability in FileMage Gateway Windows Deployments v.1.10.8 and before allows a remote attacker to obtain sensitive information via a crafted request to the /mgmt/ component.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-08-22T00:00:00.000Z
CVE-2023-39039 
An information leak in Camp Style Project Line v13.6.1 allows attackers to obtain the channel access token and send crafted messages.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-09-18T00:00:00.000Z
CVE-2023-39040 
An information leak in Cheese Cafe Line v13.6.1 allows attackers to obtain the channel access token and send crafted messages.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-09-18T00:00:00.000Z
CVE-2023-39041 
An information leak in KUKURUDELI Line v13.6.1 allows attackers to obtain the channel access token and send crafted messages.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-09-20T00:00:00.000Z
CVE-2023-39042 
An information leak in Gyouza-newhushimi v13.6.1 allows attackers to obtain the channel access token and send crafted messages.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-11-02T00:00:00.000Z
CVE-2023-39043 
An information leak in YKC Tokushima_awayokocho Line v13.6.1 allows attackers to obtain the channel access token and send crafted messages.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-09-18T00:00:00.000Z
CVE-2023-39044 
An information leak in ajino-Shiretoko Line v13.6.1 allows attackers to obtain the channel access token and send crafted messages.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-09-20T00:00:00.000Z
CVE-2023-39045 
An information leak in kokoroe_members card Line 13.6.1 allows attackers to obtain the channel access token and send crafted messages.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-09-20T00:00:00.000Z
CVE-2023-39046 
An information leak in TonTon-Tei_waiting Line v13.6.1 allows attackers to obtain the channel access token and send crafted messages.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-09-18T00:00:00.000Z
CVE-2023-39047 
An information leak in shouzu sweets oz v13.6.1 allows attackers to obtain the channel access token and send crafted messages.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-11-02T00:00:00.000Z
CVE-2023-39048 
An information leak in Tokudaya.honten v13.6.1 allows attackers to obtain the channel access token and send crafted messages.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-11-02T00:00:00.000Z
CVE-2023-39049 
An information leak in youmart-tokunaga v13.6.1 allows attackers to obtain the channel access token and send crafted messages.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-09-18T00:00:00.000Z
CVE-2023-39050 
An information leak in Daiky-value.Fukueten v13.6.1 allows attackers to obtain the channel access token and send crafted messages.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-11-02T00:00:00.000Z
CVE-2023-39051 
An information leak in VISION MEAT WORKS Track Diner 10/10mbl v13.6.1 allows attackers to obtain the channel access token and send crafted messages.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-11-02T00:00:00.000Z
CVE-2023-39052 
An information leak in Earthgarden_waiting 13.6.1 allows attackers to obtain the channel access token and send crafted messages.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-09-20T00:00:00.000Z
CVE-2023-39053 
An information leak in Hattoriya v13.6.1 allows attackers to obtain the channel access token and send crafted messages.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-11-02T00:00:00.000Z
CVE-2023-39054 
An information leak in Tokudaya.ekimae_mc v13.6.1 allows attackers to obtain the channel access token and send crafted messages.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-11-02T00:00:00.000Z
CVE-2023-39056 
An information leak in Coffee-jumbo v13.6.1 allows attackers to obtain the channel access token and send crafted messages.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-09-18T00:00:00.000Z
CVE-2023-39057 
An information leak in hirochanKAKIwaiting v13.6.1 allows attackers to obtain the channel access token and send crafted messages.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-11-02T00:00:00.000Z
CVE-2023-39058 
An information leak in THE_B_members card v13.6.1 allows attackers to obtain the channel access token and send crafted messages.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-09-18T00:00:00.000Z
CVE-2023-39059 
An issue in ansible semaphore v.2.8.90 allows a remote attacker to execute arbitrary code via a crafted payload to the extra variables parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-08-28T00:00:00.000Z
CVE-2023-39061 
Cross Site Request Forgery (CSRF) vulnerability in Chamilo v.1.11 thru v.1.11.20 allows a remote authenticated privileged attacker to execute arbitrary code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-08-21T00:00:00.000Z
CVE-2023-39062 
Cross Site Scripting vulnerability in Spipu HTML2PDF before v.5.2.8 allows a remote attacker to execute arbitrary code via a crafted script to the forms.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-08-28T00:00:00.000Z