rainbutterfly/cve_corpus huggingface dataset:
CVE-2024-27433 clk: mediatek: mt7622-apmixedsys: Fix an error handling path in clk_mt8135_apmixed_probe()
In the Linux kernel, the following vulnerability has been resolved:

clk: mediatek: mt7622-apmixedsys: Fix an error handling path in clk_mt8135_apmixed_probe()

'clk_data' is allocated with mtk_devm_alloc_clk_data(). So calling
mtk_free_clk_data() explicitly in the remove function would lead to a
double-free.

Remove the redundant call.
Affected products: vendor: Linux
product: Linux
default_status: unaffected
vendor: Linux
product: Linux
default_status: affected
Published: 2024-05-17T12:08:47.184Z
CVE-2024-27434 wifi: iwlwifi: mvm: don't set the MFP flag for the GTK
In the Linux kernel, the following vulnerability has been resolved:

wifi: iwlwifi: mvm: don't set the MFP flag for the GTK

The firmware doesn't need the MFP flag for the GTK, it can even make the
firmware crash. in case the AP is configured with: group cipher TKIP and
MFPC. We would send the GTK with cipher = TKIP and MFP which is of course
not possible.
Affected products: vendor: Linux
product: Linux
default_status: unaffected
vendor: Linux
product: Linux
default_status: affected
Published: 2024-05-17T12:08:50.896Z
CVE-2024-27435 nvme: fix reconnection fail due to reserved tag allocation
In the Linux kernel, the following vulnerability has been resolved:

nvme: fix reconnection fail due to reserved tag allocation

We found a issue on production environment while using NVMe over RDMA,
admin_q reconnect failed forever while remote target and network is ok.
After dig into it, we found it may caused by a ABBA deadlock due to tag
allocation. In my case, the tag was hold by a keep alive request
waiting inside admin_q, as we quiesced admin_q while reset ctrl, so the
request maked as idle and will not process before reset success. As
fabric_q shares tagset with admin_q, while reconnect remote target, we
need a tag for connect command, but the only one reserved tag was held
by keep alive command which waiting inside admin_q. As a result, we
failed to reconnect admin_q forever. In order to fix this issue, I
think we should keep two reserved tags for admin queue.
Affected products: vendor: Linux
product: Linux
default_status: unaffected
vendor: Linux
product: Linux
default_status: affected
Published: 2024-05-17T12:12:36.439Z
CVE-2024-27436 ALSA: usb-audio: Stop parsing channels bits when all channels are found.
In the Linux kernel, the following vulnerability has been resolved:

ALSA: usb-audio: Stop parsing channels bits when all channels are found.

If a usb audio device sets more bits than the amount of channels
it could write outside of the map array.
Affected products: vendor: Linux
product: Linux
default_status: unaffected
vendor: Linux
product: Linux
default_status: affected
Published: 2024-05-17T12:12:40.017Z
CVE-2024-27437 vfio/pci: Disable auto-enable of exclusive INTx IRQ
In the Linux kernel, the following vulnerability has been resolved:

vfio/pci: Disable auto-enable of exclusive INTx IRQ

Currently for devices requiring masking at the irqchip for INTx, ie.
devices without DisINTx support, the IRQ is enabled in request_irq()
and subsequently disabled as necessary to align with the masked status
flag.  This presents a window where the interrupt could fire between
these events, resulting in the IRQ incrementing the disable depth twice.
This would be unrecoverable for a user since the masked flag prevents
nested enables through vfio.

Instead, invert the logic using IRQF_NO_AUTOEN such that exclusive INTx
is never auto-enabled, then unmask as required.
Affected products: vendor: Linux
product: Linux
default_status: unaffected
vendor: Linux
product: Linux
default_status: affected
Published: 2024-04-05T08:24:44.561Z
CVE-2024-27438 Apache Doris: Downloading arbitrary remote jar files resulting in remote command execution
Download of Code Without Integrity Check vulnerability in Apache Doris.
The jdbc driver files used for JDBC catalog is not checked and may resulting in remote command execution.
Once the attacker is authorized to create a JDBC catalog, he/she can use arbitrary driver jar file with unchecked code snippet. This code snippet will be run when catalog is initializing without any check.
This issue affects Apache Doris: from 1.2.0 through 2.0.4.

Users are recommended to upgrade to version 2.0.5 or 2.1.x, which fixes the issue.
Problem types: cwe_id: CWE-494
description: CWE-494: Download of Code Without Integrity Check
Affected products: vendor: Apache Software Foundation
product: Apache Doris
default_status: unaffected
Published: 2024-03-21T09:39:21.894Z
CVE-2024-27439 Apache Wicket: Possible bypass of CSRF protection
An error in the evaluation of the fetch metadata headers could allow a bypass of the CSRF protection in Apache Wicket.
This issue affects Apache Wicket: from 9.1.0 through 9.16.0, and the milestone releases for the 10.0 series.
Apache Wicket 8.x does not support CSRF protection via the fetch metadata headers and as such is not affected.

Users are recommended to upgrade to version 9.17.0 or 10.0.0, which fixes the issue.
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
cwe_id: CWE-444
description: CWE-444 Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')
Affected products: vendor: Apache Software Foundation
product: Apache Wicket
default_status: unaffected
Credits: lang: en
value: Jo Theunis
Published: 2024-03-19T11:07:47.648Z
CVE-2024-27440 
The Toyoko Inn official App for iOS versions prior to 1.13.0 and Toyoko Inn official App for Android versions prior 1.3.14 don't properly verify server certificates, which allows a man-in-the-middle attacker to spoof servers and obtain sensitive information via a crafted certificate.
Problem types: description: Improper server certificate verification
Affected products: vendor: Toyoko Inn IT Solution Co., Ltd.
product: Toyoko Inn official App for iOS
vendor: Toyoko Inn IT Solution Co., Ltd.
product: Toyoko Inn official App for Android
Published: 2024-03-13T05:40:22.838Z
CVE-2024-27442 
An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0. The zmmailboxdmgr binary, a component of ZCS, is intended to be executed by the zimbra user with root privileges for specific mailbox operations. However, an attacker can escalate privileges from the zimbra user to root, because of improper handling of input arguments. An attacker can execute arbitrary commands with elevated privileges, leading to local privilege escalation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-12T00:00:00.000Z
CVE-2024-27443 
An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0. A Cross-Site Scripting (XSS) vulnerability exists in the CalendarInvite feature of the Zimbra webmail classic user interface, because of improper input validation in the handling of the calendar header. An attacker can exploit this via an email message containing a crafted calendar header with an embedded XSS payload. When a victim views this message in the Zimbra webmail classic interface, the payload is executed in the context of the victim's session, potentially leading to execution of arbitrary JavaScript code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-12T00:00:00.000Z
CVE-2024-27444 
langchain_experimental (aka LangChain Experimental) in LangChain before 0.1.8 allows an attacker to bypass the CVE-2023-44467 fix and execute arbitrary code via the __import__, __subclasses__, __builtins__, __globals__, __getattribute__, __bases__, __mro__, or __base__ attribute in Python code. These are not prohibited by pal_chain/base.py.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-02-26T00:00:00.000Z
CVE-2024-27447 
pretix before 2024.1.1 mishandles file validation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-02-26T00:00:00.000Z
CVE-2024-27448 
MailDev 2 through 2.1.0 allows Remote Code Execution via a crafted Content-ID header for an e-mail attachment, leading to lib/mailserver.js writing arbitrary code into the routes.js file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-04-05T00:00:00.000Z
CVE-2024-27453 
In Extreme XOS through 22.6.1.4, a read-only user can escalate privileges to root via a crafted HTTP POST request to the python method of the Machine-to-Machine Interface (MMI).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-05-03T00:00:00.000Z
CVE-2024-27454 
orjson.loads in orjson before 3.9.15 does not limit recursion for deeply nested JSON documents.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AC:L/AV:N/A:H/C:N/I:N/PR:N/S:U/UI:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
Published: 2024-02-26T00:00:00.000Z
CVE-2024-27455 
In the Bentley ALIM Web application, certain configuration settings can cause exposure of a user's ALIM session token when the user attempts to download files. This is fixed in Assetwise ALIM Web 23.00.04.04 and Assetwise Information Integrity Server 23.00.02.03.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-02-26T00:00:00.000Z
CVE-2024-27456 
rack-cors (aka Rack CORS Middleware) 2.0.1 has 0666 permissions for the .rb files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-02-26T00:00:00.000Z
CVE-2024-27457 
Improper check for unusual or exceptional conditions in Intel(R) TDX Module firmware before version 1.5.06 may allow a privileged user to potentially enable information disclosure via local access.
Problem types: description: information disclosure
cwe_id: CWE-754
description: Improper check for unusual or exceptional conditions
Affected products: vendor: n/a
product: Intel(R) TDX Module firmware
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 2.5
baseSeverity: LOW
vectorString: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:L/I:N/A:N
attackVector: LOCAL
attackComplexity: HIGH
privilegesRequired: HIGH
userInteraction: NONE
scope: CHANGED
confidentialityImpact: LOW
integrityImpact: NONE
availabilityImpact: NONE
Published: 2024-10-08T18:43:16.361Z
CVE-2024-27458 HP Hotkey Support – Escalation of Privilege
A potential security vulnerability has been identified in the HP Hotkey Support software, which might allow local escalation of privilege. HP is releasing mitigation for the potential vulnerability. Customers using HP Programmable Key are recommended to update HP Hotkey Support.
Problem types: cwe_id: CWE-59
description: CWE-59 Improper Link Resolution Before File Access ('Link Following')
Affected products: vendor: HP, Inc.
product: HP Hotkey Support
default_status: unknown
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
version: 3.1
Published: 2024-10-07T16:51:17.861Z
CVE-2024-27459 
The interactive service in OpenVPN 2.6.9 and earlier allows an attacker to send data causing a stack overflow which can be used to execute arbitrary code with more privileges.
Problem types: cwe_id: CWE-121
description: Stack-based Buffer Overflow
Affected products: vendor: OpenVPN
product: OpenVPN GUI
default_status: unaffected
Published: 2024-07-08T10:14:06.208Z
CVE-2024-27460 
A privilege escalation exists in the updater for Plantronics Hub 3.25.1 and below.
Affected products: vendor: HP Inc.
product: Plantronics Hub
default_status: unknown
Published: 2024-05-10T20:23:40.777Z
CVE-2024-27461 
Incorrect default permissions in software installer for Intel(R) MAS (GUI) may allow an authenticated user to potentially enable denial of service via local access.
Problem types: description: denial of service
cwe_id: CWE-276
description: Incorrect default permissions
Affected products: vendor: n/a
product: Intel(R) MAS (GUI)
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 5.6
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: LOW
availabilityImpact: HIGH
Published: 2024-08-14T13:45:15.965Z
CVE-2024-27474 
Leantime 3.0.6 is vulnerable to Cross Site Request Forgery (CSRF). This vulnerability allows malicious actors to perform unauthorized actions on behalf of authenticated users, specifically administrators.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-04-10T00:00:00.000Z
CVE-2024-27476 
Leantime 3.0.6 is vulnerable to HTML Injection via /dashboard/show#/tickets/newTicket.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-04-10T00:00:00.000Z
CVE-2024-27477 
In Leantime 3.0.6, a Cross-Site Scripting vulnerability exists within the ticket creation and modification functionality, allowing attackers to inject malicious JavaScript code into the title field of tickets (also known as to-dos). This stored XSS vulnerability can be exploited to perform Server-Side Request Forgery (SSRF) attacks.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-04-10T00:00:00.000Z
CVE-2024-27480 
givanz VvvebJs 1.7.2 is vulnerable to Insecure File Upload.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-12-29T00:00:00.000Z
CVE-2024-27488 
Incorrect Access Control vulnerability in ZLMediaKit versions 1.0 through 8.0, allows remote attackers to escalate privileges and obtain sensitive information. The application system enables the http API interface by default and uses the secret parameter method to authenticate the http restful api interface, but the secret is hardcoded by default.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-04-08T00:00:00.000Z
CVE-2024-27489 
An issue in the DelFile() function of WMCMS v4.4 allows attackers to delete arbitrary files via a crafted POST request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-07-19T00:00:00.000Z
CVE-2024-27497 
Linksys E2000 Ver.1.0.06 build 1 is vulnerable to authentication bypass via the position.js file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-03-01T00:00:00.000Z
CVE-2024-27499 
Bagisto v1.5.1 is vulnerable for Cross site scripting(XSS) via png file upload vulnerability in product review option.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-03-01T00:00:00.000Z
CVE-2024-27507 
libLAS 1.8.1 contains a memory leak vulnerability in /libLAS/apps/ts2las.cpp.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-02-27T00:00:00.000Z
CVE-2024-27508 
Atheme 7.2.12 contains a memory leak vulnerability in /atheme/src/crypto-benchmark/main.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-02-27T00:00:00.000Z
CVE-2024-27515 
Osclass 5.1.2 is vulnerable to SQL Injection.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-02-28T00:00:00.000Z
CVE-2024-27516 
Server-Side Template Injection (SSTI) vulnerability in livehelperchat before 4.34v, allows remote attackers to execute arbitrary code and obtain sensitive information via the search parameter in lhc_web/modules/lhfaq/faqweight.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-02-28T00:00:00.000Z
CVE-2024-27517 
Webasyst 2.9.9 has a Cross-Site Scripting (XSS) vulnerability, Attackers can create blogs containing malicious code after gaining blog permissions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-02-28T00:00:00.000Z
CVE-2024-27518 
An issue in SUPERAntiSyware Professional X 10.0.1262 and 10.0.1264 allows unprivileged attackers to escalate privileges via a restore of a crafted DLL file into the C:\Program Files\SUPERAntiSpyware folder.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-04-29T00:00:00.000Z
CVE-2024-27521 
TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain an unauthenticated remote command execution (RCE) vulnerability via multiple parameters in the "setOpModeCfg" function. This security issue allows an attacker to take complete control of the device. In detail, exploitation allows unauthenticated, remote attackers to execute arbitrary system commands with administrative privileges (i.e., as user "root").
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-03-26T00:00:00.000Z
CVE-2024-27524 
Cross Site Scripting vulnerability in Chamilo LMS v.1.11.26 allows a remote attacker to escalate privileges via a crafted script to the filename parameter of the new_ticket.php component.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-11-01T00:00:00.000Z
CVE-2024-27525 
Cross Site Scripting vulnerability in Chamilo LMS v.1.11.26 allows a remote attacker to escalate privileges via a crafted script to the filename parameter of the home.php component.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-11-01T00:00:00.000Z
CVE-2024-27527 
wasm3 139076a is vulnerable to Denial of Service (DoS).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-11-08T00:00:00.000Z
CVE-2024-27528 
wasm3 139076a suffers from Invalid Memory Read, leading to DoS and potential Code Execution.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-11-08T00:00:00.000Z
CVE-2024-27529 
wasm3 139076a contains memory leaks in Read_utf8.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-11-08T00:00:00.000Z
CVE-2024-27530 
wasm3 139076a contains a Use-After-Free in ForEachModule.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-11-08T00:00:00.000Z
CVE-2024-27532 
wasm-micro-runtime (aka WebAssembly Micro Runtime or WAMR) 06df58f is vulnerable to NULL Pointer Dereference in function `block_type_get_result_types.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-11-08T00:00:00.000Z
CVE-2024-27558 
Stupid Simple CMS 1.2.4 is vulnerable to Cross Site Scripting (XSS) within the blog title of the settings.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-03-01T00:00:00.000Z
CVE-2024-27559 
Stupid Simple CMS v1.2.4 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /save_settings.php
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-03-01T00:00:00.000Z
CVE-2024-27561 
A Server-Side Request Forgery (SSRF) in the installUpdateThemePluginAction function of WonderCMS v3.1.3 allows attackers to force the application to make arbitrary requests via injection of crafted URLs into the installThemePlugin parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-03-05T00:00:00.000Z
CVE-2024-27563 
A Server-Side Request Forgery (SSRF) in the getFileFromRepo function of WonderCMS v3.1.3 allows attackers to force the application to make arbitrary requests via injection of crafted URLs into the pluginThemeUrl parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-03-05T00:00:00.000Z
CVE-2024-27564 
pictureproxy.php in the dirk1983 mm1.ltd source code f9f4bbc allows SSRF via the url parameter. NOTE: the references section has an archived copy of pictureproxy.php from its original GitHub location, but the repository name might later change because it is misleading.
Problem types: cwe_id: CWE-918
description: CWE-918 Server-Side Request Forgery (SSRF)
Affected products: vendor: dirk1983
product: mm1.ltd source code
default_status: unknown
CVSS v3.1: version: 3.1
baseScore: 5.8
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N
Published: 2024-03-05T00:00:00.000Z
CVE-2024-27565 
A Server-Side Request Forgery (SSRF) in weixin.php of ChatGPT-wechat-personal commit a0857f6 allows attackers to force the application to make arbitrary requests.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-03-05T00:00:00.000Z
CVE-2024-27567 
LBT T300- T390 v2.2.1.8 were discovered to contain a stack overflow via the vpn_client_ip parameter in the config_vpn_pptp function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-03-01T00:00:00.000Z
CVE-2024-27568 
LBT T300-T390 v2.2.1.8 were discovered to contain a stack overflow via the apn_name_3g parameter in the setupEC20Apn function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-03-01T00:00:00.000Z
CVE-2024-27569 
LBT T300-T390 v2.2.1.8 were discovered to contain a stack overflow via the ApCliSsid parameter in the init_nvram function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-03-01T00:00:00.000Z
CVE-2024-27570 
LBT T300-T390 v2.2.1.8 were discovered to contain a stack overflow via the ApCliSsid parameter in the generate_conf_router function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-03-01T00:00:00.000Z
CVE-2024-27571 
LBT T300-T390 v2.2.1.8 were discovered to contain a stack overflow via the ApCliSsid parameter in the makeCurRemoteApList function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-03-01T00:00:00.000Z
CVE-2024-27572 
LBT T300-T390 v2.2.1.8 were discovered to contain a stack overflow via the ApCliSsid parameter in the updateCurAPlist function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-03-01T00:00:00.000Z
CVE-2024-27574 
SQL Injection vulnerability in Trainme Academy version Ichin v.1.3.2 allows a remote attacker to obtain sensitive information via the informacion, idcurso, and tit parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-04-22T00:00:00.000Z
CVE-2024-27575 
INOTEC Sicherheitstechnik WebServer CPS220/64 3.3.19 allows a remote attacker to read arbitrary files via absolute path traversal, such as with the /cgi-bin/display?file=/etc/passwd URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-04-04T00:00:00.000Z
CVE-2024-27592 
Open Redirect vulnerability in Corezoid Process Engine v6.5.0 allows attackers to redirect to arbitrary websites via appending a crafted link to /login/ in the login page URL.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-04-11T00:00:00.000Z