rainbutterfly/cve_corpus huggingface dataset:
CVE-2024-29370 
In python-jose 3.3.0 (specifically jwe.decrypt), a vulnerability allows an attacker to cause a Denial-of-Service (DoS) condition by crafting a malicious JSON Web Encryption (JWE) token with an exceptionally high compression ratio. When this token is processed by the server, it results in significant memory allocation and processing time during decompression.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-12-17T00:00:00.000Z
CVE-2024-29371 
In jose4j before 0.9.6, an attacker can cause a Denial-of-Service (DoS) condition by crafting a malicious JSON Web Encryption (JWE) token with an exceptionally high compression ratio. When this token is processed by the server, it results in significant memory allocation and processing time during decompression.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-12-17T00:00:00.000Z
CVE-2024-29374 
A Cross-Site Scripting (XSS) vulnerability exists in the way MOODLE 3.10.9 handles user input within the "GET /?lang=" URL parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-03-21T00:00:00.000Z
CVE-2024-29375 
CSV Injection vulnerability in Addactis IBNRS v.3.10.3.107 allows a remote attacker to execute arbitrary code via a crafted .ibnrs file to the Project Description, Identifiers, Custom Triangle Name (inside Input Triangles) and Yield Curve Name parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-04-04T00:00:00.000Z
CVE-2024-29376 
Sylius 1.12.13 is vulnerable to Cross Site Scripting (XSS) via the "Province" field in Address Book.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-04-22T00:00:00.000Z
CVE-2024-29384 
An issue in CSS Exfil Protection v.1.1.0 allows a remote attacker to obtain sensitive information via the content.js and parseCSSRules functions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-04-30T00:00:00.000Z
CVE-2024-29385 
DIR-845L router <= v1.01KRb03 has an Unauthenticated remote code execution vulnerability in the cgibin binary via soapcgi_main function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-03-22T00:00:00.000Z
CVE-2024-29386 
projeqtor up to 11.2.0 was discovered to contain a SQL injection vulnerability via the component /view/criticalResourceExport.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-04-04T00:00:00.000Z
CVE-2024-29387 
projeqtor up to 11.2.0 was discovered to contain a remote code execution (RCE) vulnerability via the component /view/print.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-04-04T00:00:00.000Z
CVE-2024-29390 
Daily Expenses Management System version 1.0, developed by PHP Gurukul, contains a time-based blind SQL injection vulnerability in the 'add-expense.php' page. An attacker can exploit the 'item' parameter in a POST request to execute arbitrary SQL commands in the backend database. This can be done by injecting specially crafted SQL queries that make the database perform time-consuming operations, thereby confirming the presence of the SQL injection vulnerability based on the delay in the server's response.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-06-20T00:00:00.000Z
CVE-2024-29392 
Silverpeas Core 6.3 is vulnerable to Cross Site Scripting (XSS) via ClipboardSessionController.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-05-22T15:58:05.308Z
CVE-2024-29399 
An issue was discovered in GNU Savane v.3.13 and before, allows a remote attacker to execute arbitrary code and escalate privileges via a crafted file to the upload.php component.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-04-11T00:00:00.000Z
CVE-2024-29400 
An issue was discovered in RuoYi v4.5.1, allows attackers to obtain sensitive information via the status parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-04-12T00:00:00.000Z
CVE-2024-29401 
xzs-mysql 3.8 is vulnerable to Insufficient Session Expiration, which allows attackers to use the session of a deleted admin to do anything.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-03-26T00:00:00.000Z
CVE-2024-29402 
cskefu v7 suffers from Insufficient Session Expiration, which allows attackers to exploit the old session for malicious activity.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-04-16T00:00:00.000Z
CVE-2024-29404 
An issue in Razer Synapse 3 v.3.9.131.20813 and Synapse 3 App v.20240213 allows a local attacker to execute arbitrary code via the export parameter of the Chroma Effects function in the Profiles component.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-12-03T00:00:00.000Z
CVE-2024-29409 
File Upload vulnerability in nestjs nest v.10.3.2 allows a remote attacker to execute arbitrary code via the Content-Type header.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-03-14T00:00:00.000Z
CVE-2024-29413 
Cross Site Scripting vulnerability in Webasyst v.2.9.9 allows a remote attacker to run arbitrary code via the Instant messenger field in the Contact info function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-04-03T00:00:00.000Z
CVE-2024-29415 
The ip package through 2.0.1 for Node.js might allow SSRF because some IP addresses (such as 127.1, 01200034567, 012.1.2.3, 000:0:0000::01, and ::fFFf:127.0.0.1) are improperly categorized as globally routable via isPublic. NOTE: this issue exists because of an incomplete fix for CVE-2023-42282.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-05-27T20:04:14.756Z
CVE-2024-29417 
Insecure Permissions vulnerability in e-trust Horacius 1.0, 1.1, and 1.2 allows a local attacker to escalate privileges via the password reset function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-05-03T00:00:00.000Z
CVE-2024-29419 
There is a Cross-site scripting (XSS) vulnerability in the Wireless settings under the Easy Setup Page of TOTOLINK X2000R before v1.0.0-B20231213.1013.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-03-20T00:00:00.000Z
CVE-2024-29421 
xmedcon 0.23.0 and fixed in v.0.24.0 is vulnerable to Buffer Overflow via libs/dicom/basic.c which allows an attacker to execute arbitrary code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-05-22T17:27:17.361Z
CVE-2024-29432 
Alldata v0.4.6 was discovered to contain a SQL injection vulnerability via the tablename parameter at /data/masterdata/datas.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-04-02T00:00:00.000Z
CVE-2024-29433 
A deserialization vulnerability in the FASTJSON component of Alldata v0.4.6 allows attackers to execute arbitrary commands via supplying crafted data.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-04-01T00:00:00.000Z
CVE-2024-29434 
An issue in the system image upload interface of Alldata v0.4.6 allows attackers to execute a directory traversal when uploading a file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-04-02T00:00:00.000Z
CVE-2024-29435 
An issue discovered in Alldata v0.4.6 allows attacker to run arbitrary commands via the processId parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-04-01T00:00:00.000Z
CVE-2024-29460 
An issue in PX4 Autopilot v.1.14.0 allows an attacker to manipulate the flight path allowing for crashes of the drone via the home point location of the mission_block.cpp component.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-04-10T00:00:00.000Z
CVE-2024-29461 
An issue in Floodlight SDN OpenFlow Controller v.1.2 allows a remote attacker to cause a denial of service via the datapath id component.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-04-12T00:00:00.000Z
CVE-2024-29466 
Directory Traversal vulnerability in lsgwr spring boot online exam v.0.9 allows an attacker to execute arbitrary code via the FileTransUtil.java component.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-04-30T00:00:00.000Z
CVE-2024-29469 
A stored cross-site scripting (XSS) vulnerability in OneBlog v2.3.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Category List parameter under the Lab module.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-03-20T00:00:00.000Z
CVE-2024-29470 
OneBlog v2.3.4 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the component {{rootpath}}/links.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-03-20T00:00:00.000Z
CVE-2024-29471 
OneBlog v2.3.4 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Notice Manage module.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-03-20T00:00:00.000Z
CVE-2024-29472 
OneBlog v2.3.4 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Privilege Management module.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-03-20T00:00:00.000Z
CVE-2024-29473 
OneBlog v2.3.4 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Role Management module.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-03-20T00:00:00.000Z
CVE-2024-29474 
OneBlog v2.3.4 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the User Management module.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-03-20T00:00:00.000Z
CVE-2024-29477 
Lack of sanitization during Installation Process in Dolibarr ERP CRM up to version 19.0.0 allows an attacker with adjacent access to the network to execute arbitrary code via a specifically crafted input.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-04-03T00:00:00.000Z
CVE-2024-29489 
Jerryscript 2.4.0 has SEGV at ./jerry-core/ecma/base/ecma-helpers.c:238:58 in ecma_get_object_type.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-03-28T00:00:00.000Z
CVE-2024-29499 
Anchor CMS v0.12.7 was discovered to contain a Cross-Site Request Forgery (CSRF) via /anchor/admin/users/delete/2.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-03-22T00:00:00.000Z
CVE-2024-29500 
An issue in the kiosk mode of Secure Lockdown Multi Application Edition v2.00.219 allows attackers to execute arbitrary code via running a ClickOnce application instance.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-04-10T00:00:00.000Z
CVE-2024-29502 
An issue in Secure Lockdown Multi Application Edition v2.00.219 allows attackers to read arbitrary files via using UNC paths.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-04-10T00:00:00.000Z
CVE-2024-29504 
Cross Site Scripting vulnerability in Summernote v.0.8.18 and before allows a remote attacker to execute arbtirary code via a crafted payload to the codeview parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-04-10T00:00:00.000Z
CVE-2024-29506 
Artifex Ghostscript before 10.03.0 has a stack-based buffer overflow in the pdfi_apply_filter() function via a long PDF filter name.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-07-03T00:00:00.000Z
CVE-2024-29507 
Artifex Ghostscript before 10.03.0 sometimes has a stack-based buffer overflow via the CIDFSubstPath and CIDFSubstFont parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-07-03T00:00:00.000Z
CVE-2024-29508 
Artifex Ghostscript before 10.03.0 has a heap-based pointer disclosure (observable in a constructed BaseFont name) in the function pdf_base_font_alloc.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-07-03T00:00:00.000Z
CVE-2024-29509 
Artifex Ghostscript before 10.03.0 has a heap-based overflow when PDFPassword (e.g., for runpdf) has a \000 byte in the middle.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-07-03T00:00:00.000Z
CVE-2024-29510 
Artifex Ghostscript before 10.03.1 allows memory corruption, and SAFER sandbox bypass, via format string injection with a uniprint device.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-07-03T00:00:00.000Z
CVE-2024-29511 
Artifex Ghostscript before 10.03.1, when Tesseract is used for OCR, has a directory traversal issue that allows arbitrary file reading (and writing of error messages to arbitrary files) via OCRLanguage. For example, exploitation can use debug_file /tmp/out and user_patterns_file /etc/passwd.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-07-03T00:00:00.000Z
CVE-2024-29513 
An issue in briscKernelDriver.sys in BlueRiSC WindowsSCOPE Cyber Forensics before 3.3 allows a local attacker to execute arbitrary code within the driver and create a local denial-of-service condition due to an improper DACL being applied to the device the driver creates.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-05-13T19:32:39.029Z
CVE-2024-29514 
File Upload vulnerability in lepton v.7.1.0 allows a remote authenticated attackers to execute arbitrary code via uploading a crafted PHP file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-04-02T00:00:00.000Z
CVE-2024-29515 
File Upload vulnerability in lepton v.7.1.0 allows a remote authenticated attackers to execute arbitrary code via uploading a crafted PHP file to the save.php and config.php component.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-03-25T00:00:00.000Z
CVE-2024-29640 
An issue in aliyundrive-webdav v.2.3.3 and before allows a remote attacker to execute arbitrary code via a crafted payload to the sid parameter in the action_query_qrcode component.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-03-29T00:00:00.000Z
CVE-2024-29643 
An issue in croogo v.3.0.2 allows an attacker to perform Host header injection via the feed.rss component.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-04-18T00:00:00.000Z
CVE-2024-29644 
Cross Site Scripting vulnerability in dcat-admin v.2.1.3 and before allows a remote attacker to execute arbitrary code via a crafted script to the user login box.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-03-26T00:00:00.000Z
CVE-2024-29645 
Buffer Overflow vulnerability in radarorg radare2 v.5.8.8 allows an attacker to execute arbitrary code via the parse_die function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-12-02T00:00:00.000Z
CVE-2024-29646 
Buffer Overflow vulnerability in radarorg radare2 v.5.8.8 allows an attacker to execute arbitrary code via the name, type, or group fields.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-12-17T00:00:00.000Z
CVE-2024-29650 
An issue in @thi.ng/paths v.5.1.62 and before allows a remote attacker to execute arbitrary code via the mutIn and mutInManyUnsafe components.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-03-25T00:00:00.000Z
CVE-2024-29651 
A Prototype Pollution issue in API Dev Tools json-schema-ref-parser v.11.0.0 and v.11.1.0 allows a remote attacker to execute arbitrary code via the bundle()`, `parse()`, `resolve()`, `dereference() functions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-05-20T17:15:21.434Z
CVE-2024-29660 
Cross Site Scripting vulnerability in DedeCMS v.5.7 allows a local attacker to execute arbitrary code via a crafted payload to the stepselect_main.php component.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-04-25T00:00:00.000Z
CVE-2024-29661 
A File Upload vulnerability in DedeCMS v5.7 allows a local attacker to execute arbitrary code via a crafted payload.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-04-22T00:00:00.000Z
CVE-2024-29666 
Insecure Permissions vulnerability in Vehicle Monitoring platform system CMSV6 v.7.31.0.2 through v.7.32.0.3 allows a remote attacker to escalate privileges via the default password component.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-03-25T00:00:00.000Z
CVE-2024-29667 
SQL Injection vulnerability in Tongtianxing Technology Co., Ltd CMSV6 v.7.31.0.2 through v.7.31.0.3 allows a remote attacker to escalate privileges and obtain sensitive information via the ids parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-03-29T00:00:00.000Z
CVE-2024-29671 
Buffer Overflow vulnerability in NEXTU FLATA AX1500 Router v.1.0.2 allows a remote attacker to execute arbitrary code via the POST request handler component.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-12-16T00:00:00.000Z
CVE-2024-29672 
Directory Traversal vulnerability in zly2006 Reden before v.0.2.514 allows a remote attacker to execute arbitrary code via the DEBUG_RTC_REQUEST_SYNC_DATA in KeyCallbacks.kt.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AC:L/AV:N/A:H/C:H/I:H/PR:N/S:U/UI:R
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
Published: 2024-04-05T00:00:00.000Z
CVE-2024-29684 
DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /src/dede/makehtml_homepage.php allowing a remote attacker to execute arbitrary code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-03-26T00:00:00.000Z
CVE-2024-29686 
Server-side Template Injection (SSTI) vulnerability in Winter CMS v.1.2.3 allows a remote attacker to execute arbitrary code via a crafted payload to the CMS Pages field and Plugin components. NOTE: the vendor disputes this because the payload could only be entered by a trusted user, such as the owner of the server that hosts Winter CMS, or a developer working for them.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-03-29T00:00:00.000Z
CVE-2024-29720 
An issue in Terra Informatica Software, Inc Sciter v.4.4.7.0 allows a local attacker to obtain sensitive information via the adopt component of the Sciter video rendering function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-12-26T00:00:00.000Z
CVE-2024-29723 Multiple vulnerabilities in SportsNET
SQL injection vulnerabilities in SportsNET affecting version 4.0.1. These vulnerabilities could allow an attacker to retrieve, update and delete all information in the database by sending a specially crafted SQL query: https://XXXXXXX.saludydesafio.com/conexiones/ax/openTracExt/, parameter categoria;.
Problem types: cwe_id: CWE-89
description: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: SportsNET
product: SportsNET
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: https://www.incibe.es/incibe-cert/alerta-temprana/avisos/multiples-vulnerabilidades-en-sportsnet
Published: 2024-08-29T09:46:10.008Z
CVE-2024-29724 Multiple vulnerabilities in SportsNET
SQL injection vulnerabilities in SportsNET affecting version 4.0.1. These vulnerabilities could allow an attacker to retrieve, update and delete all information in the database by sending a specially crafted SQL query: https://XXXXXXX.saludydesafio.com/ax/registerSp/, parameter idDesafio.
Problem types: cwe_id: CWE-89
description: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: SportsNET
product: SportsNET
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: https://www.incibe.es/incibe-cert/alerta-temprana/avisos/multiples-vulnerabilidades-en-sportsnet
Published: 2024-08-29T09:45:07.623Z
CVE-2024-29725 Multiple vulnerabilities in SportsNET
SQL injection vulnerabilities in SportsNET affecting version 4.0.1. These vulnerabilities could allow an attacker to retrieve, update and delete all information in the database by sending a specially crafted SQL query: https://XXXXXXX.saludydesafio.com/app/ax/sort_bloques/, parameter list.
Problem types: cwe_id: CWE-89
description: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: SportsNET
product: SportsNET
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: https://www.incibe.es/incibe-cert/alerta-temprana/avisos/multiples-vulnerabilidades-en-sportsnet
Published: 2024-08-29T09:42:24.817Z
CVE-2024-29726 Multiple vulnerabilities in SportsNET
SQL injection vulnerabilities in SportsNET affecting version 4.0.1. These vulnerabilities could allow an attacker to retrieve, update and delete all information in the database by sending a specially crafted SQL query: https://XXXXXXX.saludydesafio.com/app/ax/setAsRead/, parameter id.
Problem types: cwe_id: CWE-89
description: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: SportsNET
product: SportsNET
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: https://www.incibe.es/incibe-cert/alerta-temprana/avisos/multiples-vulnerabilidades-en-sportsnet
Published: 2024-08-29T09:38:20.813Z