rainbutterfly/cve_corpus huggingface dataset:
CVE-2023-29596 
Buffer Overflow vulnerability found in ByronKnoll Cmix v.19 allows an attacker to execute arbitrary code and cause a denial of service via the paq8 function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-04-26T00:00:00.000Z
CVE-2023-29597 
bloofox v0.5.2 was discovered to contain a SQL injection vulnerability via the component /index.php?mode=content&page=pages&action=edit&eid=1.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-04-13T00:00:00.000Z
CVE-2023-29598 
lmxcms v1.4.1 was discovered to contain a SQL injection vulnerability via the setbook parameter at index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-04-13T00:00:00.000Z
CVE-2023-29621 
Purchase Order Management v1.0 was discovered to contain an arbitrary file upload vulnerability which allows attackers to execute arbitrary code via a crafted file uploaded to the server.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-04-14T00:00:00.000Z
CVE-2023-29622 
Purchase Order Management v1.0 was discovered to contain a SQL injection vulnerability via the password parameter at /purchase_order/admin/login.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-04-14T00:00:00.000Z
CVE-2023-29623 
Purchase Order Management v1.0 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the password parameter at /purchase_order/classes/login.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-04-14T00:00:00.000Z
CVE-2023-29625 
Employee Performance Evaluation System v1.0 was discovered to contain an arbitrary file upload vulnerability which allows attackers to execute arbitrary code via a crafted file uploaded to the server.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-04-14T00:00:00.000Z
CVE-2023-29626 
Yoga Class Registration System 1.0 was discovered to contain a SQL injection vulnerability via the cid parameter at /admin/login.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-04-14T00:00:00.000Z
CVE-2023-29627 
Online Pizza Ordering v1.0 was discovered to contain an arbitrary file upload vulnerability which allows attackers to execute arbitrary code via a crafted file uploaded to the server.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-04-14T00:00:00.000Z
CVE-2023-29629 
PrestaShop jmsthemelayout 2.5.5 is vulnerable to SQL Injection via ajax_jmsvermegamenu.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AC:L/AV:N/A:H/C:H/I:H/PR:N/S:U/UI:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
Published: 2023-06-05T00:00:00.000Z
CVE-2023-29630 
PrestaShop jmsmegamenu 1.1.x and 2.0.x is vulnerable to SQL Injection via ajax_jmsmegamenu.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AC:L/AV:N/A:H/C:H/I:H/PR:N/S:U/UI:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
Published: 2023-06-05T00:00:00.000Z
CVE-2023-29631 
PrestaShop jmsslider 1.6.0 is vulnerable to Incorrect Access Control via ajax_jmsslider.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AC:L/AV:N/A:H/C:H/I:H/PR:N/S:U/UI:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
Published: 2023-06-05T00:00:00.000Z
CVE-2023-29632 
PrestaShop jmspagebuilder 3.x is vulnerable to SQL Injection via ajax_jmspagebuilder.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AC:L/AV:N/A:H/C:H/I:H/PR:N/S:U/UI:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
Published: 2023-06-06T00:00:00.000Z
CVE-2023-29635 
File upload vulnerability in Antabot White-Jotter v0.2.2, allows remote attackers to execute malicious code via the file parameter to function coversUpload.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-05-01T00:00:00.000Z
CVE-2023-29636 
Cross site scripting (XSS) vulnerability in ZHENFENG13 My-Blog, allows attackers to inject arbitrary web script or HTML via the "title" field in the "blog management" page due to the the default configuration not using MyBlogUtils.cleanString.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-05-01T00:00:00.000Z
CVE-2023-29637 
Cross Site Scripting (XSS) vulnerability in Qbian61 forum-java, allows attackers to inject arbitrary web script or HTML via editing the article content in the "article editor" page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-05-01T00:00:00.000Z
CVE-2023-29638 
Cross Site Scripting (XSS) vulnerability in WinterChenS my-site before commit 3f0423da6d5200c7a46e200da145c1f54ee18548, allows attackers to inject arbitrary web script or HTML via editing blog articles.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-05-01T00:00:00.000Z
CVE-2023-29639 
Cross site scripting (XSS) vulnerability in ZHENFENG13 My-Blog, allows attackers to inject arbitrary web script or HTML via editing an article in the "blog article" page due to the default configuration not utilizing MyBlogUtils.cleanString.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-05-01T00:00:00.000Z
CVE-2023-29641 
Cross Site Scripting (XSS) vulnerability in pandao editor.md thru 1.5.0 allows attackers to inject arbitrary web script or HTML via crafted markdown text.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-05-01T00:00:00.000Z
CVE-2023-29643 
Cross Site Scripting (XSS) vulnerability in PerfreeBlog 3.1.2 allows attackers to execute arbitrary code via the Post function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-05-01T00:00:00.000Z
CVE-2023-29656 
An improper authorization vulnerability in Darktrace mobile app (Android) prior to version 6.0.15 allows disabled and low-privilege users to control "antigena" actions(block/unblock traffic) from the mobile application. This vulnerability could create a "shutdown", blocking all ingress or egress traffic in the entire infrastructure where darktrace agents are deployed.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-07-06T00:00:00.000Z
CVE-2023-29657 
eXtplorer 2.1.15 is vulnerable to Insecure Permissions. File upload in file manager allows uploading zip file containing php pages with arbitrary code executions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-05-12T00:00:00.000Z
CVE-2023-29659 
A Segmentation fault caused by a floating point exception exists in libheif 1.15.1 using crafted heif images via the heif::Fraction::round() function in box.cc, which causes a denial of service.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-05-05T00:00:00.000Z
CVE-2023-29665 
D-Link DIR823G_V1.0.2B05 was discovered to contain a stack overflow via the NewPassword parameters in SetPasswdSettings.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-04-17T00:00:00.000Z
CVE-2023-29680 
Cleartext Transmission in set-cookie:ecos_pw: Tenda N301 v6.0, Firmware v12.02.01.61_multi allows an authenticated attacker on the LAN or WLAN to intercept communications with the router and obtain the password.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-05-01T00:00:00.000Z
CVE-2023-29681 
Cleartext Transmission in cookie:ecos_pw: in Tenda N301 v6.0, firmware v12.03.01.06_pt allows an authenticated attacker on the LAN or WLAN to intercept communications with the router and obtain the password.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-05-01T00:00:00.000Z
CVE-2023-29689 
PyroCMS 3.9 contains a remote code execution (RCE) vulnerability that can be exploited through a server-side template injection (SSTI) flaw. This vulnerability allows a malicious attacker to send customized commands to the server and execute arbitrary code on the affected system.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-08-04T00:00:00.000Z
CVE-2023-29693 
H3C GR-1200W MiniGRW1A0V100R006 was discovered to contain a stack overflow via the function set_tftp_upgrad.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-05-08T00:00:00.000Z
CVE-2023-29696 
H3C GR-1200W MiniGRW1A0V100R006 was discovered to contain a stack overflow via the function version_set.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-05-08T00:00:00.000Z
CVE-2023-29707 
Cross Site Scripting (XSS) vulnerability in GBCOM LAC WEB Control Center version lac-1.3.x, allows attackers to create an arbitrary device.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-06-22T00:00:00.000Z
CVE-2023-29708 
An issue was discovered in /cgi-bin/adm.cgi in WavLink WavRouter version RPT70HA1.x, allows attackers to force a factory reset via crafted payload.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-06-22T00:00:00.000Z
CVE-2023-29709 
An issue was discovered in /cgi-bin/login_rj.cgi in Wildix WSG24POE version 103SP7D190822, allows attackers to bypass authentication.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-06-22T00:00:00.000Z
CVE-2023-29711 
An incorrect access control issue was discovered in Interlink PSG-5124 version 1.0.4, allows attackers to execute arbitrary code via crafted GET request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-06-22T00:00:00.000Z
CVE-2023-29712 
Cross Site Scripting vulnerability found in Vade Secure Gateway allows a remote attacker to execute arbitrary code via a crafted payload to the X-Rewrite-URL parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-06-09T00:00:00.000Z
CVE-2023-29713 
Cross Site Scripting vulnerability found in Vade Secure Gateway allows a remote attacker to execute arbitrary code via a crafted payload to the GET request after the /css/ directory.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-06-09T00:00:00.000Z
CVE-2023-29714 
Cross Site Scripting vulnerability found in Vade Secure Gateway allows a remote attacker to execute arbitrary code via the username, password, and language cookies parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-06-09T00:00:00.000Z
CVE-2023-29720 
SofaWiki <=3.8.9 is vulnerable to Cross Site Scripting (XSS) via index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-05-18T00:00:00.000Z
CVE-2023-29721 
SofaWiki <= 3.8.9 has a file upload vulnerability that leads to command execution.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-05-24T00:00:00.000Z
CVE-2023-29722 
The Glitter Unicorn Wallpaper app for Android 7.0 thru 8.0 allows unauthorized apps to actively request permission to modify data in the database that records information about a user's personal preferences and will be loaded into memory to be read and used when the app is opened. An attacker could tamper with this data to cause an escalation of privilege attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-06-01T00:00:00.000Z
CVE-2023-29723 
The Glitter Unicorn Wallpaper app for Android 7.0 thru 8.0 allows unauthorized applications to actively request permission to insert data into the database that records information about a user's personal preferences and will be loaded into memory to be read and used when the application is opened. By injecting data, the attacker can force the application to load malicious image URLs and display them in the UI. As the amount of data increases, it will eventually cause the application to trigger an OOM error and crash, resulting in a persistent denial of service attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-06-01T00:00:00.000Z
CVE-2023-29724 
The BT21 x BTS Wallpaper app 12 for Android allows unauthorized apps to actively request permission to modify data in the database that records information about a user's personal preferences and will be loaded into memory to be read and used when the app is opened. An attacker could tamper with this data to cause an escalation of privilege attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-06-02T00:00:00.000Z
CVE-2023-29725 
The BT21 x BTS Wallpaper app 12 for Android allows unauthorized applications to actively request permission to insert data into the database that records information about a user's personal preferences and will be loaded into memory to be read and used when the application is opened. By injecting data, the attacker can force the application to load malicious image URLs and display them in the UI. As the amount of data increases, it will eventually cause the application to trigger an OOM error and crash, resulting in a persistent denial of service attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-06-02T00:00:00.000Z
CVE-2023-29726 
The Call Blocker application 6.6.3 for Android incorrectly opens a key component that an attacker can use to inject large amounts of dirty data into the application's database. When the application starts, it loads the data from the database into memory. Once the attacker injects too much data, the application triggers an OOM error and crashes, resulting in a persistent denial of service.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-05-30T00:00:00.000Z
CVE-2023-29727 
The Call Blocker application 6.6.3 for Android allows unauthorized applications to use exposed components to delete data stored in its database that is related to user privacy settings and affects the implementation of the normal functionality of the application. An attacker can use this to cause an escalation of privilege attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-05-30T00:00:00.000Z
CVE-2023-29728 
The Call Blocker application 6.6.3 for Android allows attackers to tamper with feature-related data, resulting in a severe elevation of privilege attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-05-30T00:00:00.000Z
CVE-2023-29731 
SoLive 1.6.14 thru 1.6.20 for Android has an exposed component that provides a method to modify the SharedPreference file. An attacker can leverage this method to inject a large amount of data into any SharedPreference file, which will be loaded into memory when the application is opened. When an attacker injects too much data, the application will trigger an OOM error and crash at startup, resulting in a persistent denial of service.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-05-30T00:00:00.000Z
CVE-2023-29732 
SoLive 1.6.14 thru 1.6.20 for Android exists exposed component, the component provides the method to modify the SharedPreference file. The attacker can use the method to modify the data in any SharedPreference file, these data will be loaded into the memory when the application is opened. Depending on how the data is used, this can result in various attack consequences, such as ad display exceptions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-05-30T00:00:00.000Z
CVE-2023-29733 
The Lock Master app 2.2.4 for Android allows unauthorized apps to modify the values in its SharedPreference files. These files hold data that affects many app functions. Malicious modifications by unauthorized apps can cause security issues, such as functionality manipulation, resulting in a severe escalation of privilege attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-05-30T00:00:00.000Z
CVE-2023-29734 
An issue found in edjing Mix v.7.09.01 for Android allows unauthorized apps to cause escalation of privilege attacks by manipulating the database.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-05-30T00:00:00.000Z
CVE-2023-29735 
An issue found in edjing Mix v.7.09.01 for Android allows a local attacker to cause a denial of service via the database files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-05-30T00:00:00.000Z
CVE-2023-29736 
Keyboard Themes 1.275.1.164 for Android contains a dictionary traversal vulnerability that allows unauthorized apps to overwrite arbitrary files in its internal storage and achieve arbitrary code execution.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-06-01T00:00:00.000Z
CVE-2023-29737 
An issue found in Wave Animated Keyboard Emoji v.1.70.7 for Android allows a local attacker to cause a denial of service via the database files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-05-30T00:00:00.000Z
CVE-2023-29738 
An issue found in Wave Animated Keyboard Emoji v.1.70.7 for Android allows a local attacker to cause code execution and escalation of Privileges via the database files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-05-30T00:00:00.000Z
CVE-2023-29739 
An issue found in Alarm Clock for Heavy Sleepers v.5.3.2 for Android allows unauthorized apps to cause escalation of privilege attacks by manipulating the component.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-05-30T00:00:00.000Z
CVE-2023-29740 
An issue found in Alarm Clock for Heavy Sleepers v.5.3.2 for Android allows unauthorized apps to cause a denial of service attack by manipulating the database.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-05-30T00:00:00.000Z
CVE-2023-29741 
An issue found in BestWeather v.7.3.1 for Android allows unauthorized apps to cause an escalation of privileges attack by manipulating the database.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-05-30T00:00:00.000Z
CVE-2023-29742 
An issue found in BestWeather v.7.3.1 for Android allows unauthorized apps to cause a code execution attack by manipulating the database.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-05-30T00:00:00.000Z
CVE-2023-29743 
An issue found in BestWeather v.7.3.1 for Android allows unauthorized apps to cause a persistent denial of service attack by manipulating the database.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-05-30T00:00:00.000Z
CVE-2023-29745 
An issue found in BestWeather v.7.3.1 for Android allows unauthorized apps to cause a persistent denial of service attack by manipulating the database.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-05-30T00:00:00.000Z
CVE-2023-29746 
An issue found in The Thaiger v.1.2 for Android allows unauthorized apps to cause a code execution attack by manipulating the SharedPreference files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-06-02T00:00:00.000Z
CVE-2023-29747 
Story Saver for Instragram - Video Downloader 1.0.6 for Android exists exposed component, the component provides the method to modify the SharedPreference file. The attacker can use the method to modify the data in any SharedPreference file, these data will be loaded into the memory when the application is opened. Depending on how the data is used, this can result in various attack consequences, such as ad display exceptions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-05-31T00:00:00.000Z
CVE-2023-29748 
Story Saver for Instragram - Video Downloader 1.0.6 for Android has an exposed component that provides a method to modify the SharedPreference file. An attacker can leverage this method to inject a large amount of data into any SharedPreference file, which will be loaded into memory when the application is opened. When an attacker injects too much data, the application will trigger an OOM error and crash at startup, resulting in a persistent denial of service.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-06-01T00:00:00.000Z
CVE-2023-29749 
An issue found in Yandex Navigator v.6.60 for Android allows unauthorized apps to cause escalation of privilege attacks by manipulating the SharedPreference files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-06-09T00:00:00.000Z
CVE-2023-29751 
An issue found in Yandex Navigator v.6.60 for Android allows unauthorized apps to cause a persistent denial of service by manipulating the SharedPreference files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-06-09T00:00:00.000Z
CVE-2023-29752 
An issue found in Facemoji Emoji Keyboard v.2.9.1.2 for Android allows unauthorized apps to cause escalation of privilege attacks by manipulating the component.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-06-09T00:00:00.000Z
CVE-2023-29753 
An issue found in Facemoji Emoji Keyboard v.2.9.1.2 for Android allows a local attacker to cause a denial of service via the SharedPreference files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-06-09T00:00:00.000Z
CVE-2023-29755 
An issue found in Twilight v.13.3 for Android allows unauthorized apps to cause escalation of privilege attacks by manipulating the SharedPreference files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-06-09T00:00:00.000Z
CVE-2023-29756 
An issue found in Twilight v.13.3 for Android allows unauthorized apps to cause a persistent denial of service by manipulating the SharedPreference files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-06-09T00:00:00.000Z
CVE-2023-29757 
An issue found in Blue Light Filter v.1.5.5 for Android allows unauthorized apps to cause escalation of privilege attacks by manipulating the SharedPreference files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-06-09T00:00:00.000Z
CVE-2023-29758 
An issue found in Blue Light Filter v.1.5.5 for Android allows unauthorized apps to cause a persistent denial of service by manipulating the SharedPreference files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-06-09T00:00:00.000Z