rainbutterfly/cve_corpus huggingface dataset:
CVE-2024-32904 
In ProtocolVsimOperationAdapter() of protocolvsimadapter.cpp, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with baseband firmware compromise required. User Interaction is not needed for exploitation.
Problem types: description: Information disclosure
Affected products: vendor: Google
product: Android
default_status: unaffected
Published: 2024-06-13T21:01:58.819Z
CVE-2024-32905 
In circ_read of link_device_memory_legacy.c, there is a possible out of bounds write due to an incorrect bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.
Problem types: description: Remote code execution
Affected products: vendor: Google
product: Android
default_status: unaffected
Published: 2024-06-13T21:01:58.976Z
CVE-2024-32906 
In AcvpOnMessage of avcp.cpp, there is a possible EOP due to uninitialized data. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Problem types: description: Elevation of privilege
Affected products: vendor: Google
product: Android
default_status: unaffected
Published: 2024-06-13T21:01:59.122Z
CVE-2024-32907 
In memcall_add of memlog.c, there is a possible buffer overflow due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Problem types: description: Elevation of privilege
Affected products: vendor: Google
product: Android
default_status: unaffected
Published: 2024-06-13T21:01:59.264Z
CVE-2024-32908 
In sec_media_protect of media.c, there is a possible permission bypass due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Problem types: description: Elevation of privilege
Affected products: vendor: Google
product: Android
default_status: unaffected
Published: 2024-06-13T21:01:59.498Z
CVE-2024-32909 
In handle_msg of main.cpp, there is a possible out of bounds write due to a heap buffer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Problem types: description: Elevation of privilege
Affected products: vendor: Google
product: Android
default_status: unaffected
Published: 2024-06-13T21:01:59.725Z
CVE-2024-32910 
In handle_msg_shm_map_req of trusty/user/base/lib/spi/srv/tipc/tipc.c, there is a possible stack data disclosure due to uninitialized data. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
Problem types: description: Information disclosure
Affected products: vendor: Google
product: Android
default_status: unaffected
Published: 2024-06-13T21:01:59.881Z
CVE-2024-32911 
There is a possible escalation of privilege due to improperly used crypto. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Problem types: description: Elevation of privilege
Affected products: vendor: Google
product: Android
default_status: unaffected
Published: 2024-06-13T21:02:00.108Z
CVE-2024-32912 
there is a possible persistent Denial of Service due to test/debugging code left in a production build. This could lead to local denial of service of impaired use of the device with no additional execution privileges needed. User interaction is not needed for exploitation.
Problem types: description: Denial of service
Affected products: vendor: Google
product: Android
default_status: unaffected
Published: 2024-06-13T21:02:00.263Z
CVE-2024-32913 
In wl_notify_rx_mgmt_frame of wl_cfg80211.c, there is a possible out of bounds write due to an integer overflow. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.
Problem types: description: Remote code execution
Affected products: vendor: Google
product: Android
default_status: unaffected
Published: 2024-06-13T21:02:00.412Z
CVE-2024-32914 
In tpu_get_int_state of tpu.c, there is a possible information disclosure due to uninitialized data. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
Problem types: description: Information disclosure
Affected products: vendor: Google
product: Android
default_status: unaffected
Published: 2024-06-13T21:02:00.561Z
CVE-2024-32915 
In CellInfoListParserV2::FillCellInfo() of protocolnetadapter.cpp, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure  with baseband firmware compromise required. User interaction is not needed for exploitation.
Problem types: description: Information disclosure
Affected products: vendor: Google
product: Android
default_status: unaffected
Published: 2024-06-13T21:02:00.728Z
CVE-2024-32916 
In fvp_freq_histogram_init of fvp.c, there is a possible Information Disclosure due to uninitialized data. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
Problem types: description: Information disclosure
Affected products: vendor: Google
product: Android
default_status: unaffected
Published: 2024-06-13T21:02:00.954Z
CVE-2024-32917 
In pl330_dma_from_peri_start() of fp_spi_dma.c, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Problem types: description: Elevation of privilege
Affected products: vendor: Google
product: Android
default_status: unaffected
Published: 2024-06-13T21:02:01.129Z
CVE-2024-32918 
Permission Bypass allowing attackers  to disable HDCP 2.2 encryption by not completing the HDCP Key Exchange initialization steps
Problem types: description: Information disclosure
Affected products: vendor: Google
product: Android
default_status: unaffected
Published: 2024-06-13T21:02:01.322Z
CVE-2024-32919 
In lwis_add_completion_fence of lwis_fence.c, there is a possible escalation of privilege due to type confusion. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Problem types: description: Elevation of privilege
Affected products: vendor: Google
product: Android
default_status: unaffected
Published: 2024-06-13T21:02:01.482Z
CVE-2024-32920 
In set_secure_reg of sac_handler.c, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure of 4 bytes of stack memory with no additional execution privileges needed. User interaction is not needed for exploitation.
Problem types: description: Information disclosure
Affected products: vendor: Google
product: Android
default_status: unaffected
Published: 2024-06-13T21:02:01.622Z
CVE-2024-32921 
In lwis_initialize_transaction_fences of lwis_fence.c, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Problem types: description: Elevation of privilege
Affected products: vendor: Google
product: Android
default_status: unaffected
Published: 2024-06-13T21:02:01.771Z
CVE-2024-32922 
In gpu_pm_power_on_top_nolock of pixel_gpu_power.c, there is a possible compromise of protected memory due to a logic error in the code. This could lead to local escalation of privilege to TEE with no additional execution privileges needed. User interaction is not needed for exploitation.
Problem types: description: Elevation of privilege
Affected products: vendor: Google
product: Android
default_status: unaffected
Published: 2024-06-13T21:02:01.921Z
CVE-2024-32923 
there is a possible cellular denial of service due to a logic error in the code. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.
Problem types: description: Denial of service
Affected products: vendor: Google
product: Android
default_status: unaffected
Published: 2024-06-13T21:02:02.100Z
CVE-2024-32924 
In DeregAcceptProcINT of cn_NrmmStateDeregInit.cpp, there is a possible denial of service due to a logic error in the code. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.
Problem types: description: Denial of service
Affected products: vendor: Google
product: Android
default_status: unaffected
Published: 2024-06-13T21:02:02.256Z
CVE-2024-32925 
In dhd_prot_txstatus_process of dhd_msgbuf.c, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.
Problem types: description: Remote code execution
Affected products: vendor: Google
product: Android
default_status: unaffected
Published: 2024-06-13T21:02:02.404Z
CVE-2024-32926 
there is a possible information disclosure due to side channel information disclosure. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
Problem types: description: Information disclosure
Affected products: vendor: Google
product: Android
default_status: unaffected
Published: 2024-06-13T21:02:02.603Z
CVE-2024-32927 
In sendDeviceState_1_6 of RadioExt.cpp, there is a possible use after free due to improper locking. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Problem types: description: Elevation of privilege
Affected products: vendor: Google
product: Android
default_status: unaffected
Published: 2024-08-19T16:47:50.955Z
CVE-2024-32928 
The libcurl CURLOPT_SSL_VERIFYPEER option was disabled on a subset of requests made by Nest production devices which enabled a potential man-in-the-middle attack on requests to Google cloud services by any host the traffic was routed through.
Problem types: description: Information disclosure
Affected products: vendor: Google
product: Nest Speakers
default_status: unaffected
Published: 2024-08-19T16:38:01.140Z
CVE-2024-32929 
In gpu_slc_get_region of pixel_gpu_slc.c, there is a possible EoP due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Problem types: description: Elevation of privilege
Affected products: vendor: Google
product: Android
default_status: unaffected
Published: 2024-06-13T20:48:11.839Z
CVE-2024-32930 
In plugin_ipc_handler of slc_plugin.c, there is a possible information disclosure due to uninitialized data. This could lead to local information disclosure of 4 bytes of stack memory with no additional execution privileges needed. User interaction is not needed for exploitation.
Problem types: description: Information disclosure
Affected products: vendor: Google
product: Android
default_status: unaffected
Published: 2024-06-13T21:02:02.767Z
CVE-2024-32931 exacqVison - Token Disclosed in URL
Under certain circumstances the exacqVision Web Service can expose authentication token details within communications.
Problem types: cwe_id: CWE-598
description: CWE-598 - Use of GET Request Method With Sensitive Query Strings
Affected products: vendor: Johnson Controls
product: exacqVision
default_status: affected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.7
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
version: 3.1
Credits: lang: en
value: Diego Zaffaroni from Nozomi Networks
Published: 2024-08-01T21:18:07.426Z
CVE-2024-32932 American Dynamics Illustra Essentials Gen 4 - Reversible User Credential - stored web interface
Under certain circumstances the web interface users credentials may be recovered by an authenticated user.
Problem types: cwe_id: CWE-257
description: CWE-257: Storing Passwords in a Recoverable Format
Affected products: vendor: Johnson Controls
product: American Dynamics Illustra Essentials Gen 4
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.8
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: HIGH
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N
version: 3.1
Credits: lang: en
value: Sam Hanson of Dragos
Published: 2024-07-02T14:08:17.013Z
CVE-2024-32936 media: ti: j721e-csi2rx: Fix races while restarting DMA
In the Linux kernel, the following vulnerability has been resolved:

media: ti: j721e-csi2rx: Fix races while restarting DMA

After the frame is submitted to DMA, it may happen that the submitted
list is not updated soon enough, and the DMA callback is triggered
before that.

This can lead to kernel crashes, so move everything in a single
lock/unlock section to prevent such races.
Affected products: vendor: Linux
product: Linux
default_status: unaffected
vendor: Linux
product: Linux
default_status: affected
Published: 2024-06-24T13:56:48.054Z
CVE-2024-32937 
An os command injection vulnerability exists in the CWMP SelfDefinedTimeZone functionality of Grandstream GXP2135 1.0.9.129, 1.0.11.74 and 1.0.11.79. A specially crafted network packet can lead to arbitrary command execution. An attacker can send a sequence of malicious packets to trigger this vulnerability.
Problem types: cwe_id: CWE-78
description: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected products: vendor: Grandstream
product: GXP2135
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: HIGH
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
baseScore: 8.1
baseSeverity: HIGH
Credits: lang: en
value: Discovered by Matthew Bernath of Cisco Talos.
Published: 2024-07-03T14:05:35.575Z
CVE-2024-32938 
Uncontrolled search path for some Intel(R) MPI Library for Windows software before version 2021.13 may allow an authenticated user to potentially enable escalation of privilege via local access.
Problem types: description: Escalation of Privilege
cwe_id: CWE-427
description: Uncontrolled Search Path Element
Affected products: vendor: n/a
product: Intel(R) MPI Library for Windows software
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 6.7
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: HIGH
privilegesRequired: LOW
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
Published: 2025-02-12T21:19:06.076Z
CVE-2024-32939 Email addresses of remote users visible in props regardless of server settings
Mattermost versions 9.9.x <= 9.9.1, 9.5.x <= 9.5.7, 9.10.x <= 9.10.0, 9.8.x <= 9.8.2, when shared channels are enabled, fail to redact remote users' original email addresses stored in user props when email addresses are otherwise configured not to be visible in the local server."
Problem types: cwe_id: CWE-284
description: CWE-284: Improper Access Control
Affected products: vendor: Mattermost
product: Mattermost
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
version: 3.1
Credits: lang: en
value: Juho Forsén
Published: 2024-08-22T06:29:01.203Z
CVE-2024-32940 
Improper access control in Intel(R) RAID Web Console software for all versions may allow an authenticated user to potentially enable denial of service via adjacent access.
Problem types: description: denial of service
cwe_id: CWE-284
description: Improper access control
Affected products: vendor: n/a
product: Intel(R) RAID Web Console software
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 6.5
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
attackVector: ADJACENT_NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: HIGH
Published: 2024-09-16T16:38:36.385Z
CVE-2024-32941 
NULL pointer dereference for some Intel(R) MLC software before version v3.11b may allow an authenticated user to potentially enable denial of service via local access.
Problem types: description: Denial of Service
cwe_id: CWE-476
description: NULL Pointer Dereference
Affected products: vendor: n/a
product: Intel(R) MLC software
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 7.9
baseSeverity: HIGH
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: CHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: HIGH
Published: 2025-02-12T21:19:54.183Z
CVE-2024-32942 
Incorrect default permissions for some Intel(R) DSA installer for Windows before version 24.2.19.5 may allow an authenticated user to potentially enable escalation of privilege via local access.
Problem types: description: Escalation of Privilege
cwe_id: CWE-276
description: Incorrect Default Permissions
Affected products: vendor: n/a
product: Intel(R) DSA installer for Windows
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 6.7
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: HIGH
privilegesRequired: LOW
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
Published: 2025-02-12T21:19:49.430Z
CVE-2024-32943 Westermo L210-F2G Lynx Improper Control of Interaction Frequency
An attacker may be able to cause a denial-of-service condition by sending many SSH packets repeatedly.
Problem types: cwe_id: CWE-799
description: CWE-799
Affected products: vendor: Westermo
product: L210-F2G Lynx
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Credits: lang: en
value: Aviv Malka and Joseph Baum of OTORIO reported these vulnerabilities to CISA.
Published: 2024-06-20T22:12:34.239Z
CVE-2024-32944 
Path traversal vulnerability exists in UTAU versions prior to v0.4.19. If a user of the product installs a crafted UTAU voicebank installer (.uar file, .zip file) to UTAU, an arbitrary file may be placed.
Problem types: description: Path traversal
Affected products: vendor: ameya/ayame
product: UTAU
Published: 2024-05-28T03:11:04.472Z
CVE-2024-32945 LaTeX post content manipulation via renderer state leak across contexts
Mattermost Mobile Apps versions <=2.16.0 fail to protect against abuse of a globally shared MathJax state which allows an attacker to change the contents of a LateX post, by creating another post with specific  macro definitions.
Problem types: cwe_id: CWE-909
description: CWE-909: Missing Initialization of Resource
Affected products: vendor: Mattermost
product: Mattermost
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 2.6
baseSeverity: LOW
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:N
version: 3.1
Credits: lang: en
value: Juho Nurminen
Published: 2024-07-15T08:42:19.268Z
CVE-2024-32946 
A vulnerability in the LevelOne WBR-6012 router's firmware version R0.40e6 allows sensitive information to be transmitted in cleartext via Web and FTP services, exposing it to network sniffing attacks.
Problem types: cwe_id: CWE-319
description: CWE-319: Cleartext Transmission of Sensitive Information
Affected products: vendor: LevelOne
product: WBR-6012
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
attackVector: NETWORK
attackComplexity: HIGH
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: NONE
availabilityImpact: NONE
baseScore: 5.9
baseSeverity: MEDIUM
Credits: lang: en
value: Discovered by Patrick DeSantis of Cisco Talos.
Published: 2024-10-30T13:35:17.990Z
CVE-2024-32947 WordPress WP ADA Compliance Check Basic plugin <= 3.1.3 - Cross Site Request Forgery (CSRF) vulnerability
Cross-Site Request Forgery (CSRF) vulnerability in AlumniOnline Web Services LLC WP ADA Compliance Check Basic.This issue affects WP ADA Compliance Check Basic: from n/a through 3.1.3.
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: AlumniOnline Web Services LLC
product: WP ADA Compliance Check Basic
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
version: 3.1
Credits: lang: en
value: Joshua Chan (Patchstack Alliance)
Published: 2024-04-24T14:48:57.172Z
CVE-2024-32948 WordPress ARMember – Membership Plugin plugin <= 4.0.28 - Broken Access Control vulnerability
Missing Authorization vulnerability in Repute Infosystems ARMember.This issue affects ARMember: from n/a through 4.0.28.
Problem types: cwe_id: CWE-862
description: CWE-862 Missing Authorization
Affected products: vendor: Repute Infosystems
product: ARMember
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.1
baseSeverity: CRITICAL
confidentialityImpact: NONE
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
version: 3.1
Credits: lang: en
value: Kursat Cetin (Patchstack)
Published: 2024-04-24T07:03:17.452Z
CVE-2024-32950 WordPress WP Media Category Management plugin <= 2.2 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in DeBAAT WP Media Category Management allows Reflected XSS.This issue affects WP Media Category Management: from n/a through 2.2.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: DeBAAT
product: WP Media Category Management
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 7.1
baseSeverity: HIGH
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
version: 3.1
Credits: lang: en
value: Abdi Pranata (Patchstack Alliance)
Published: 2024-04-24T08:25:50.058Z