rainbutterfly/cve_corpus huggingface dataset:
CVE-2024-27861 
The issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15. An application may be able to read restricted memory.
Problem types: description: An application may be able to read restricted memory
Affected products: vendor: Apple
product: macOS
Published: 2024-09-16T23:23:07.510Z
CVE-2024-27862 
A logic issue was addressed with improved state management. This issue is fixed in macOS Sonoma 14.6. Enabling Lockdown Mode while setting up a Mac may cause FileVault to become unexpectedly disabled.
Problem types: description: Enabling Lockdown Mode while setting up a Mac may cause FileVault to become unexpectedly disabled
Affected products: vendor: Apple
product: macOS
Published: 2024-07-29T22:16:48.695Z
CVE-2024-27863 
An information disclosure issue was addressed with improved private data redaction for log entries. This issue is fixed in iOS 17.6 and iPadOS 17.6, macOS Sonoma 14.6, tvOS 17.6, visionOS 1.3, watchOS 10.6. A local attacker may be able to determine kernel memory layout.
Problem types: description: A local attacker may be able to determine kernel memory layout
Affected products: vendor: Apple
product: iOS and iPadOS
vendor: Apple
product: macOS
vendor: Apple
product: tvOS
vendor: Apple
product: visionOS
vendor: Apple
product: watchOS
Published: 2024-07-29T22:16:49.497Z
CVE-2024-27867 
An authentication issue was addressed with improved state management. This issue is fixed in AirPods Firmware Update 6A326, AirPods Firmware Update 6F8, and Beats Firmware Update 6F8. When your headphones are seeking a connection request to one of your previously paired devices, an attacker in Bluetooth range might be able to spoof the intended source device and gain access to your headphones.
Problem types: description: When your headphones are seeking a connection request to one of your previously paired devices, an attacker in Bluetooth range might be able to spoof the intended source device and gain access to your headphones
Affected products: vendor: Apple
product: AirPods
Published: 2024-06-26T03:12:26.594Z
CVE-2024-27869 
The issue was addressed with improved checks. This issue is fixed in iOS 18 and iPadOS 18, macOS Sequoia 15. An app may be able to record the screen without an indicator.
Problem types: description: An app may be able to record the screen without an indicator
Affected products: vendor: Apple
product: iOS and iPadOS
vendor: Apple
product: macOS
Published: 2024-09-16T23:22:20.064Z
CVE-2024-27871 
A path handling issue was addressed with improved validation. This issue is fixed in iOS 17.6 and iPadOS 17.6, macOS Sonoma 14.6. An app may be able to access protected user data.
Problem types: description: An app may be able to access protected user data
Affected products: vendor: Apple
product: iOS and iPadOS
vendor: Apple
product: macOS
Published: 2024-07-29T22:17:22.604Z
CVE-2024-27872 
This issue was addressed with improved validation of symlinks. This issue is fixed in macOS Sonoma 14.6. An app may be able to access protected user data.
Problem types: description: An app may be able to access protected user data
Affected products: vendor: Apple
product: macOS
Published: 2024-07-29T22:16:28.477Z
CVE-2024-27873 
An out-of-bounds write issue was addressed with improved input validation. This issue is fixed in iOS 16.7.9 and iPadOS 16.7.9, iOS 17.6 and iPadOS 17.6, macOS Monterey 12.7.6, macOS Sonoma 14.6, macOS Ventura 13.6.8. Processing a maliciously crafted video file may lead to unexpected app termination.
Problem types: description: Processing a maliciously crafted video file may lead to unexpected app termination
Affected products: vendor: Apple
product: iOS and iPadOS
vendor: Apple
product: macOS
Published: 2024-07-29T22:16:40.354Z
CVE-2024-27874 
This issue was addressed through improved state management. This issue is fixed in iOS 18 and iPadOS 18. A remote attacker may be able to cause a denial-of-service.
Problem types: description: A remote attacker may be able to cause a denial-of-service
Affected products: vendor: Apple
product: iOS and iPadOS
Published: 2024-09-16T23:22:39.007Z
CVE-2024-27875 
A logic issue was addressed with improved state management. This issue is fixed in macOS Sequoia 15. Privacy Indicators for microphone or camera access may be attributed incorrectly.
Problem types: description: Privacy Indicators for microphone or camera access may be attributed incorrectly
Affected products: vendor: Apple
product: macOS
Published: 2024-09-16T23:22:39.961Z
CVE-2024-27876 
A race condition was addressed with improved locking. This issue is fixed in iOS 17.7 and iPadOS 17.7, iOS 18 and iPadOS 18, macOS Sequoia 15, macOS Sonoma 14.7, macOS Ventura 13.7, visionOS 2. Unpacking a maliciously crafted archive may allow an attacker to write arbitrary files.
Problem types: description: Unpacking a maliciously crafted archive may allow an attacker to write arbitrary files
Affected products: vendor: Apple
product: iOS and iPadOS
vendor: Apple
product: macOS
vendor: Apple
product: visionOS
Published: 2024-09-16T23:23:00.127Z
CVE-2024-27877 
The issue was addressed with improved memory handling. This issue is fixed in macOS Monterey 12.7.6, macOS Sonoma 14.6, macOS Ventura 13.6.8. Processing a maliciously crafted file may lead to a denial-of-service or potentially disclose memory contents.
Problem types: description: Processing a maliciously crafted file may lead to a denial-of-service or potentially disclose memory contents
Affected products: vendor: Apple
product: macOS
Published: 2024-07-29T22:17:03.511Z
CVE-2024-27878 
A buffer overflow issue was addressed with improved memory handling. This issue is fixed in macOS Sonoma 14.6. An app may be able to execute arbitrary code with kernel privileges.
Problem types: description: An app may be able to execute arbitrary code with kernel privileges
Affected products: vendor: Apple
product: macOS
Published: 2024-07-29T22:16:44.478Z
CVE-2024-27879 
The issue was addressed with improved bounds checks. This issue is fixed in iOS 17.7 and iPadOS 17.7, iOS 18 and iPadOS 18. An attacker may be able to cause unexpected app termination.
Problem types: description: An attacker may be able to cause unexpected app termination
Affected products: vendor: Apple
product: iOS and iPadOS
Published: 2024-09-16T23:22:49.382Z
CVE-2024-27880 
An out-of-bounds read issue was addressed with improved input validation. This issue is fixed in iOS 17.7 and iPadOS 17.7, iOS 18 and iPadOS 18, macOS Sequoia 15, macOS Sonoma 14.7, tvOS 18, visionOS 2, watchOS 11. Processing a maliciously crafted file may lead to unexpected app termination.
Problem types: description: Processing a maliciously crafted file may lead to unexpected app termination
Affected products: vendor: Apple
product: iOS and iPadOS
vendor: Apple
product: macOS
vendor: Apple
product: tvOS
vendor: Apple
product: visionOS
vendor: Apple
product: watchOS
Published: 2024-09-16T23:22:47.649Z
CVE-2024-27881 
A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in macOS Monterey 12.7.6, macOS Sonoma 14.6, macOS Ventura 13.6.8. An app may be able to access information about a user’s contacts.
Problem types: description: An app may be able to access information about a user’s contacts
Affected products: vendor: Apple
product: macOS
Published: 2024-07-29T22:16:46.234Z
CVE-2024-27882 
A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Monterey 12.7.6, macOS Sonoma 14.6, macOS Ventura 13.6.8. An app may be able to modify protected parts of the file system.
Problem types: description: An app may be able to modify protected parts of the file system
Affected products: vendor: Apple
product: macOS
Published: 2024-07-29T22:17:06.133Z
CVE-2024-27883 
A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Monterey 12.7.6, macOS Sonoma 14.6, macOS Ventura 13.6.8. An app may be able to modify protected parts of the file system.
Problem types: description: An app may be able to modify protected parts of the file system
Affected products: vendor: Apple
product: macOS
Published: 2024-07-29T22:16:53.720Z
CVE-2024-27884 
This issue was addressed with a new entitlement. This issue is fixed in iOS 17.5 and iPadOS 17.5, macOS Sonoma 14.5, tvOS 17.5, visionOS 1.2, watchOS 10.5. An app may be able to access user-sensitive data.
Problem types: description: An app may be able to access user-sensitive data
Affected products: vendor: Apple
product: iOS and iPadOS
vendor: Apple
product: macOS
vendor: Apple
product: tvOS
vendor: Apple
product: visionOS
vendor: Apple
product: watchOS
Published: 2024-07-29T22:17:19.135Z
CVE-2024-27885 
This issue was addressed with improved validation of symlinks. This issue is fixed in macOS Monterey 12.7.5, macOS Sonoma 14.5, macOS Ventura 13.6.7. An app may be able to modify protected parts of the file system.
Problem types: description: An app may be able to modify protected parts of the file system
Affected products: vendor: Apple
product: macOS
Published: 2024-06-10T20:56:45.402Z
CVE-2024-27886 
A logic issue was addressed with improved restrictions. This issue is fixed in macOS Sonoma 14.4, macOS Ventura 13.7. An unprivileged app may be able to log keystrokes in other apps including those using secure input mode.
Problem types: description: An unprivileged app may be able to log keystrokes in other apps including those using secure input mode
Affected products: vendor: Apple
product: macOS
Published: 2024-07-29T22:16:35.305Z
CVE-2024-27887 
A path handling issue was addressed with improved validation. This issue is fixed in macOS Sonoma 14.4. An app may be able to access user-sensitive data.
Problem types: description: An app may be able to access user-sensitive data
Affected products: vendor: Apple
product: macOS
Published: 2024-07-29T22:16:31.955Z
CVE-2024-27888 
A permissions issue was addressed by removing vulnerable code and adding additional checks. This issue is fixed in macOS Sonoma 14.4. An app may be able to modify protected parts of the file system.
Problem types: description: An app may be able to modify protected parts of the file system
Affected products: vendor: Apple
product: macOS
Published: 2024-07-29T22:17:24.302Z
CVE-2024-27889 Multiple SQL Injection vulnerabilities exist in the reporting application of the Arista Edge Threat Management - Arista NG Firewall (NGFW).
Multiple SQL Injection vulnerabilities exist in the reporting application of the Arista Edge Threat Management - Arista NG Firewall (NGFW). A user with advanced report application access rights can exploit the SQL injection, allowing them to execute commands on the underlying operating system with elevated privileges.

Problem types: cwe_id: CWE-89
description: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: Arista Networks
product: Arista Edge Threat Management - Arista NG Firewall (NGFW)
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Arista would like to acknowledge and thank Gereon Huppertz, working with Trend Micro's Zero Day Initiative for responsibly reporting CVE-2024-27889
Published: 2024-03-04T19:32:33.109Z
CVE-2024-27890 On affected platforms running Arista EOS with OpenConfig configured, a gNMI Set request can be run when it should have been rejected (No SSL Profiles Enabled).
Affected platforms running Arista EOS with OpenConfig configured, a gNMI Set request can be run when it should have been rejected. This can result in unexpected configuration being applied to the switch.
Problem types: cwe_id: CWE-306
description: CWE-306 Missing Authentication for Critical Function
Affected products: vendor: Arista Networks
product: EOS
default_status: unaffected
CVSS v3.1: version: 3.1
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: CHANGED
confidentialityImpact: NONE
integrityImpact: HIGH
availabilityImpact: HIGH
baseSeverity: CRITICAL
baseScore: 9.6
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H
Published: 2026-06-04T22:27:36.610Z
CVE-2024-27891 On affected platforms running Arista EOS with MACsec and egress ACLs configured on the same interfaces, the ACL policies may not be enforced for packets egressing on those ports.
On affected platforms running Arista EOS with MACsec and egress ACLs configured on the same interfaces, the ACL policies may not be enforced for packets egressing on those ports. This can cause outgoing packets to incorrectly be allowed or denied.
Problem types: cwe_id: CWE-284
description: CWE-284 Improper Access Control
Affected products: vendor: Arista Networks
product: EOS
default_status: unaffected
CVSS v3.1: version: 3.1
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: LOW
availabilityImpact: NONE
baseSeverity: MEDIUM
baseScore: 5.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Published: 2026-06-04T22:08:42.522Z
CVE-2024-27892 On affected platforms running Arista EOS with OpenConfig configured, a gNMI Set request can be run when it should have been rejected (SSL Profiles Enabled).
Affected platforms running Arista EOS with OpenConfig configured, a gNMI Set request can be run when it should have been rejected. This can result in unexpected configuration being applied to the switch.
Problem types: cwe_id: CWE-306
description: CWE-306 Missing Authentication for Critical Function
Affected products: vendor: Arista Networks
product: EOS
default_status: unaffected
CVSS v3.1: version: 3.1
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: CHANGED
confidentialityImpact: NONE
integrityImpact: HIGH
availabilityImpact: HIGH
baseSeverity: CRITICAL
baseScore: 9.6
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H
Published: 2026-06-04T22:33:15.792Z
CVE-2024-27894 Apache Pulsar: Pulsar Functions Worker Allows Unauthorized File Access and Unauthorized HTTP/HTTPS Proxying
The Pulsar Functions Worker includes a capability that permits authenticated users to create functions where the function's implementation is referenced by a URL. The supported URL schemes include "file", "http", and "https". When a function is created using this method, the Functions Worker will retrieve the implementation from the URL provided by the user. However, this feature introduces a vulnerability that can be exploited by an attacker to gain unauthorized access to any file that the Pulsar Functions Worker process has permissions to read. This includes reading the process environment which potentially includes sensitive information, such as secrets. Furthermore, an attacker could leverage this vulnerability to use the Pulsar Functions Worker as a proxy to access the content of remote HTTP and HTTPS endpoint URLs. This could also be used to carry out denial of service attacks.
This vulnerability also applies to the Pulsar Broker when it is configured with "functionsWorkerEnabled=true".

This issue affects Apache Pulsar versions from 2.4.0 to 2.10.5, from 2.11.0 to 2.11.3, from 3.0.0 to 3.0.2, from 3.1.0 to 3.1.2, and 3.2.0. 

2.10 Pulsar Function Worker users should upgrade to at least 2.10.6.
2.11 Pulsar Function Worker users should upgrade to at least 2.11.4.
3.0 Pulsar Function Worker users should upgrade to at least 3.0.3.
3.1 Pulsar Function Worker users should upgrade to at least 3.1.3.
3.2 Pulsar Function Worker users should upgrade to at least 3.2.1.

Users operating versions prior to those listed above should upgrade to the aforementioned patched versions or newer versions.

The updated versions of Pulsar Functions Worker will, by default, impose restrictions on the creation of functions using URLs. For users who rely on this functionality, the Function Worker configuration provides two configuration keys: "additionalEnabledConnectorUrlPatterns" and "additionalEnabledFunctionsUrlPatterns". These keys allow users to specify a set of URL patterns that are permitted, enabling the creation of functions using URLs that match the defined patterns. This approach ensures that the feature remains available to those who require it, while limiting the potential for unauthorized access and exploitation.
Problem types: cwe_id: CWE-20
description: CWE-20 Improper Input Validation
cwe_id: CWE-552
description: CWE-552 Files or Directories Accessible to External Parties
Affected products: vendor: Apache Software Foundation
product: Apache Pulsar
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.5
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Lari Hotari of StreamNative
Published: 2024-03-12T18:19:41.084Z
CVE-2024-27895 
Vulnerability of permission control in the window module. Successful exploitation of this vulnerability may affect confidentiality.
Problem types: description: Permissions, Privileges, and Access Controls
Affected products: vendor: Huawei
product: HarmonyOS
default_status: unaffected
Published: 2024-04-08T09:23:07.774Z
CVE-2024-27896 
Input verification vulnerability in the log module.
Impact: Successful exploitation of this vulnerability can affect integrity.
Problem types: cwe_id: CWE-20
description: CWE-20 Improper Input Validation
Affected products: vendor: Huawei
product: HarmonyOS
default_status: unaffected
vendor: Huawei
product: EMUI
default_status: unaffected
Published: 2024-04-08T09:24:17.171Z
CVE-2024-27897 
Input verification vulnerability in the call module.
Impact: Successful exploitation of this vulnerability may affect service confidentiality.
Problem types: cwe_id: CWE-200
description: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
Affected products: vendor: Huawei
product: HarmonyOS
default_status: unaffected
vendor: Huawei
product: EMUI
default_status: unaffected
Published: 2024-04-08T09:25:40.641Z
CVE-2024-27898 Server-Side Request Forgery in SAP NetWeaver
SAP NetWeaver application, due to insufficient input validation, allows an attacker to send a crafted request from a vulnerable web application targeting internal systems behind firewalls that are normally inaccessible to an attacker from the external network, resulting in a Server-Side Request Forgery vulnerability. Thus, having a low impact on confidentiality.


Problem types: cwe_id: CWE-918
description: CWE-918: Server-Side Request Forgery (SSRF)
Affected products: vendor: SAP_SE
product: SAP NetWeaver
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
version: 3.1
Published: 2024-04-09T00:52:54.390Z
CVE-2024-27899 Security misconfiguration vulnerability in SAP NetWeaver AS Java User Management Engine
Self-Registration and Modify your own profile in User Admin Application of NetWeaver AS Java does not enforce proper security requirements for the content of the newly defined security answer. This can be leveraged by an attacker to cause profound impact on confidentiality and low impact on both integrity and availability.


Problem types: cwe_id: CWE-640
description: CWE-640: Weak Password Recovery Mechanism
Affected products: vendor: SAP_SE
product: SAP NetWeaver AS Java User Management Engine
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: LOW
privilegesRequired: NONE
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:L
version: 3.1
Published: 2024-04-09T00:54:17.167Z
CVE-2024-27900 Missing Authorization check in SAP ABAP Platform
Due to missing authorization check, attacker with business user account in SAP ABAP Platform - version 758, 795, can change the privacy setting of job templates from shared to private. As a result, the selected template would only be accessible to the owner.


Problem types: cwe_id: CWE-862
description: CWE-862: Missing Authorization
Affected products: vendor: SAP_SE
product: SAP ABAP Platform
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
version: 3.1
Published: 2024-03-12T00:44:15.235Z
CVE-2024-27901 Directory Traversal vulnerability in SAP Asset Accounting
SAP Asset Accounting could allow a high privileged attacker to exploit insufficient validation of path information provided by the users and pass it through to the file API's. Thus, causing a considerable impact on confidentiality, integrity and availability of the application.


Problem types: cwe_id: CWE-35
description: CWE-35: Path Traversal
Affected products: vendor: SAP_SE
product: SAP Asset Accounting
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.2
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2024-04-09T00:55:03.642Z
CVE-2024-27902 Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver AS ABAP applications based on SAPGUI for HTML (WebGUI)
Applications based on SAP GUI for HTML in SAP NetWeaver AS ABAP - versions 7.89, 7.93, do not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. A successful attack can allow a malicious attacker to access and modify data through their ability to execute code in a user’s browser. There is no impact on the availability of the system


Problem types: cwe_id: CWE-79
description: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: SAP_SE
product: SAP NetWeaver AS ABAP applications based on SAPGUI for HTML (WebGUI)
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.4
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
version: 3.1
Published: 2024-03-12T00:45:08.794Z
CVE-2024-27903 
OpenVPN plug-ins on Windows with OpenVPN 2.6.9 and earlier could be loaded from any directory, which allows an attacker to load an arbitrary plug-in which can be used to interact with the privileged OpenVPN interactive service.
Problem types: cwe_id: CWE-283
description: Unverified Ownership
Affected products: vendor: OpenVPN
product: OpenVPN 2
default_status: unaffected
Published: 2024-07-08T10:27:40.125Z