rainbutterfly/cve_corpus huggingface dataset:
CVE-2023-31454 Apache InLong: IDOR make users can bind any cluster
Incorrect Permission Assignment for Critical Resource Vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.2.0 through 1.6.0. 

The attacker can bind any cluster, even if he is not the cluster owner. Users are advised to upgrade to Apache InLong's 1.7.0 or cherry-pick [1] to solve it.[1]

 https://github.com/apache/inlong/pull/7947 https://github.com/apache/inlong/pull/7947 




Problem types: cwe_id: CWE-732
description: CWE-732 Incorrect Permission Assignment for Critical Resource
Affected products: vendor: Apache Software Foundation
product: Apache InLong
default_status: unaffected
Published: 2023-05-22T13:23:17.332Z
CVE-2023-31455 
Pexip Infinity before 31.2 has Improper Input Validation for RTCP, allowing remote attackers to trigger an abort.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-12-25T00:00:00.000Z
CVE-2023-31456 
There is an SSRF vulnerability in the Fluid Topics platform that affects versions prior to 4.3, where the server can be forced to make arbitrary requests to internal and external resources by an authenticated user.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-07-16T00:00:00.000Z
CVE-2023-31457 
A vulnerability in the Headquarters server component of Mitel MiVoice Connect versions 19.3 SP2 (22.24.1500.0) and earlier could allow an unauthenticated attacker with internal network access to execute arbitrary scripts due to improper access control.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-05-24T00:00:00.000Z
CVE-2023-31458 
A vulnerability in the Edge Gateway component of Mitel MiVoice Connect versions 19.3 SP2 (22.24.1500.0) and earlier could allow an unauthenticated attacker with internal network access to authenticate with administrative privileges, because initial installation does not enforce a password change. A successful exploit could allow an attacker to make arbitrary configuration changes and execute arbitrary commands.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-05-24T00:00:00.000Z
CVE-2023-31459 
A vulnerability in the Connect Mobility Router component of Mitel MiVoice Connect versions 9.6.2208.101 and earlier could allow an unauthenticated attacker with internal network access to authenticate with administrative privileges, because the initial installation does not enforce a password change. A successful exploit could allow an attacker to make arbitrary configuration changes and execute arbitrary commands.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-05-24T00:00:00.000Z
CVE-2023-31460 
A vulnerability in the Connect Mobility Router component of MiVoice Connect versions 9.6.2208.101 and earlier could allow an authenticated attacker with internal network access to conduct a command injection attack due to insufficient restriction on URL parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-05-24T00:00:00.000Z
CVE-2023-31461 
Attackers can exploit an open API listener on SteelSeries GG 36.0.0 to create a sub-application that will be executed automatically from a controlled location, because of a path traversal vulnerability.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-07-20T00:00:00.000Z
CVE-2023-31462 
An issue was discovered in SteelSeries GG 36.0.0. An attacker can change values in an unencrypted database that is writable for all users on the computer, in order to trigger code execution with higher privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-07-20T00:00:00.000Z
CVE-2023-31465 
An issue was discovered in FSMLabs TimeKeeper 8.0.17 through 8.0.28. By intercepting requests from various timekeeper streams, it is possible to find the getsamplebacklog call. Some query parameters are passed directly in the URL and named arg[x], with x an integer starting from 1; it is possible to modify arg[2] to insert Bash code that will be executed directly by the server.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-07-26T00:00:00.000Z
CVE-2023-31466 
An XSS issue was discovered in FSMLabs TimeKeeper 8.0.17. On the "Configuration -> Compliance -> Add a new compliance report" and "Configuration -> Timekeeper Configuration -> Add a new source there" screens, there are entry points to inject JavaScript code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-07-26T00:00:00.000Z
CVE-2023-31468 
An issue was discovered in Inosoft VisiWin 7 through 2022-2.1 (Runtime RT7.3 RC3 20221209.5). The "%PROGRAMFILES(X86)%\INOSOFT GmbH" folder has weak permissions for Everyone, allowing an attacker to insert a Trojan horse file that runs as SYSTEM. 2024-1 is a fixed version.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-09-11T00:00:00.000Z
CVE-2023-31469 Apache StreamPipes: Privilege escalation through non-admin user

A REST interface in Apache StreamPipes (versions 0.69.0 to 0.91.0) was not properly restricted to admin-only access. This allowed a non-admin user with valid login credentials to elevate privileges beyond the initially assigned roles.
The issue is resolved by upgrading to StreamPipes 0.92.0.


Problem types: cwe_id: CWE-269
description: CWE-269 Improper Privilege Management
Affected products: vendor: Apache Software Foundation
product: Apache StreamPipes
default_status: unaffected
Credits: lang: en
value: Xun Bai, LJQC Open Source Security Institute
Published: 2023-06-23T07:07:42.875Z
CVE-2023-31470 
SmartDNS through 41 before 56d0332 allows an out-of-bounds write because of a stack-based buffer overflow in the _dns_encode_domain function in the dns.c file, via a crafted DNS request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-04-28T00:00:00.000Z
CVE-2023-31471 
An issue was discovered on GL.iNet devices before 3.216. Through the software installation feature, it is possible to install arbitrary software, such as a reverse shell, because the restrictions on the available package list are limited to client-side verification. It is possible to install software from the filesystem, the package list, or a URL.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-05-10T00:00:00.000Z
CVE-2023-31472 
An issue was discovered on GL.iNet devices before 3.216. There is an arbitrary file write in which an empty file can be created anywhere on the filesystem. This is caused by a command injection vulnerability with a filter applied.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-05-09T00:00:00.000Z
CVE-2023-31473 
An issue was discovered on GL.iNet devices before 3.216. There is an arbitrary file write in which an empty file can be created anywhere on the filesystem. This is caused by a command injection vulnerability with a filter applied. Through the software installation feature, it is possible to inject arbitrary parameters in a request to cause opkg to read an arbitrary file name while using root privileges. The -f option can be used with a configuration file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-05-11T00:00:00.000Z
CVE-2023-31474 
An issue was discovered on GL.iNet devices before 3.216. Through the software installation feature, it is possible to inject arbitrary parameters in a request to cause opkg to obtain a list of files in a specific directory, by using the regex feature in a package name.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-05-09T00:00:00.000Z
CVE-2023-31475 
An issue was discovered on GL.iNet devices before 3.216. The function guci2_get() found in libglutil.so has a buffer overflow when an item is requested from a UCI context, and the value is pasted into a char pointer to a buffer without checking the size of the buffer.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-05-11T00:00:00.000Z
CVE-2023-31476 
An issue was discovered on GL.iNet devices running firmware before 3.216. There is an arbitrary file write in which an empty file can be created almost anywhere on the filesystem, as long as the filename and path is no more than 6 characters (the working directory is /www).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-05-09T00:00:00.000Z
CVE-2023-31477 
A path traversal issue was discovered on GL.iNet devices before 3.216. Through the file sharing feature, it is possible to share an arbitrary directory, such as /tmp or /etc, because there is no server-side restriction to limit sharing to the USB path.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-05-11T00:00:00.000Z
CVE-2023-31478 
An issue was discovered on GL.iNet devices before 3.216. An API endpoint reveals information about the Wi-Fi configuration, including the SSID and key.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-05-09T00:00:00.000Z
CVE-2023-31483 
tar/TarFileReader.cpp in Cauldron cbang before bastet-v8.1.17 has a directory traversal during extraction that allows the attacker to create or write to files outside the current directory via a crafted tar archive.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-04-28T00:00:00.000Z
CVE-2023-31484 
CPAN.pm before 2.35 does not verify TLS certificates when downloading distributions over HTTPS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-04-28T00:00:00.000Z
CVE-2023-31485 
GitLab::API::v4 through 0.26 does not verify TLS certificates when connecting to a GitLab server, enabling machine-in-the-middle attacks.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-04-28T00:00:00.000Z
CVE-2023-31486 
HTTP::Tiny before 0.083, a Perl core module since 5.13.9 and available standalone on CPAN, has an insecure default TLS configuration where users must opt in to verify certificates.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-04-28T00:00:00.000Z
CVE-2023-31488 
Hyland Perceptive Filters releases before 2023-12-08 (e.g., 11.4.0.2647), as used in Cisco IronPort Email Security Appliance Software, Cisco Secure Email Gateway, and various non-Cisco products, allow attackers to trigger a segmentation fault and execute arbitrary code via a crafted document.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-01-10T00:00:00.000Z
CVE-2023-31489 
An issue found in Frrouting bgpd v.8.4.2 allows a remote attacker to cause a denial of service via the bgp_capability_llgr() function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-05-09T00:00:00.000Z
CVE-2023-31490 
An issue found in Frrouting bgpd v.8.4.2 allows a remote attacker to cause a denial of service via the bgp_attr_psid_sub() function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-05-09T00:00:00.000Z
CVE-2023-31492 
Zoho ManageEngine ADManager Plus version 7182 and prior disclosed the default passwords for the account restoration of unauthorized domains to the authenticated users.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-08-17T00:00:00.000Z
CVE-2023-31493 
RCE (Remote Code Execution) exists in ZoneMinder through 1.36.33 as an attacker can create a new .php log file in language folder, while executing a crafted payload and escalate privileges allowing execution of any commands on the remote system.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-10-15T00:00:00.000Z
CVE-2023-31497 
Incorrect access control in Quick Heal Technologies Limited Seqrite Endpoint Security (EPS) all versions prior to v8.0 allows attackers to escalate privileges to root via supplying a crafted binary to the target system.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-05-11T00:00:00.000Z
CVE-2023-31498 
A privilege escalation issue was found in PHP Gurukul Hospital Management System In v.4.0 allows a remote attacker to execute arbitrary code and access sensitive information via the session token parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-05-11T00:00:00.000Z
CVE-2023-31502 
Altenergy Power Control Software C1.2.5 was discovered to contain a remote code execution (RCE) vulnerability via the component /models/management_model.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-05-11T00:00:00.000Z
CVE-2023-31505 
An arbitrary file upload vulnerability in Schlix CMS v2.2.8-1, allows remote authenticated attackers to execute arbitrary code and obtain sensitive information via a crafted .phtml file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-01-31T00:00:00.000Z
CVE-2023-31506 
A cross-site scripting (XSS) vulnerability in Grav versions 1.7.44 and before, allows remote authenticated attackers to execute arbitrary web scripts or HTML via the onmouseover attribute of an ISINDEX element.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-02-09T00:00:00.000Z
CVE-2023-31517 
A memory leak in the component CConsole::Chain of Teeworlds v0.7.5 allows attackers to cause a Denial of Service (DoS) via opening a crafted file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-05-23T00:00:00.000Z
CVE-2023-31518 
A heap use-after-free in the component CDataFileReader::GetItem of teeworlds v0.7.5 allows attackers to cause a Denial of Service (DoS) via a crafted map file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-05-23T00:00:00.000Z
CVE-2023-31519 
Pharmacy Management System v1.0 was discovered to contain a SQL injection vulnerability via the email parameter at login_core.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-05-16T00:00:00.000Z
CVE-2023-31528 
Motorola CX2L Router 1.0.1 was discovered to contain a command injection vulnerability via the staticroute_list parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-05-11T00:00:00.000Z
CVE-2023-31529 
Motorola CX2L Router 1.0.1 was discovered to contain a command injection vulnerability via the system_time_timezone parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-05-11T00:00:00.000Z
CVE-2023-31530 
Motorola CX2L Router 1.0.1 was discovered to contain a command injection vulnerability via the smartqos_priority_devices parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-05-11T00:00:00.000Z
CVE-2023-31531 
Motorola CX2L Router 1.0.1 was discovered to contain a command injection vulnerability via the tomography_ping_number parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-05-11T00:00:00.000Z
CVE-2023-31541 
A unrestricted file upload vulnerability was discovered in the ‘Browse and upload images’ feature of the CKEditor v1.2.3 plugin for Redmine, which allows arbitrary files to be uploaded to the server.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-06-13T00:00:00.000Z
CVE-2023-31543 
A dependency confusion in pipreqs v0.3.0 to v0.4.11 allows attackers to execute arbitrary code via uploading a crafted PyPI package to the chosen repository server.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-06-30T00:00:00.000Z
CVE-2023-31544 
A stored cross-site scripting (XSS) vulnerability in alkacon-OpenCMS v11.0.0.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Title field under the Upload Image module.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-05-16T00:00:00.000Z
CVE-2023-31546 
Cross Site Scripting (XSS) vulnerability in DedeBIZ v6.0.3 allows attackers to run arbitrary code via the search feature.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-12-14T00:00:00.000Z
CVE-2023-31548 
A stored Cross-site scripting (XSS) vulnerability in the FundRaiserEditor.php component of ChurchCRM v4.5.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-05-31T00:00:00.000Z
CVE-2023-31555 
podofoinfo 0.10.0 was discovered to contain a segmentation violation via the function PoDoFo::PdfObject::DelayedLoad.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-05-10T00:00:00.000Z
CVE-2023-31556 
podofoinfo 0.10.0 was discovered to contain a segmentation violation via the function PoDoFo::PdfDictionary::findKeyParent.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-05-10T00:00:00.000Z
CVE-2023-31566 
Podofo v0.10.0 was discovered to contain a heap-use-after-free via the component PoDoFo::PdfEncrypt::IsMetadataEncrypted().
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-05-10T00:00:00.000Z
CVE-2023-31567 
Podofo v0.10.0 was discovered to contain a heap buffer overflow via the component PoDoFo::PdfEncryptAESV3::PdfEncryptAESV3.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-05-10T00:00:00.000Z
CVE-2023-31568 
Podofo v0.10.0 was discovered to contain a heap buffer overflow via the component PoDoFo::PdfEncryptRC4::PdfEncryptRC4.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-05-10T00:00:00.000Z
CVE-2023-31569 
TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain a command injection via the setWanCfg function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-06-06T00:00:00.000Z
CVE-2023-31572 
An issue in Bludit 4.0.0-rc-2 allows authenticated attackers to change the Administrator password and escalate privileges via a crafted request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-05-16T00:00:00.000Z
CVE-2023-31576 
An arbitrary file upload vulnerability in Serendipity 2.4-beta1 allows attackers to execute arbitrary code via a crafted HTML or Javascript file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-05-16T00:00:00.000Z
CVE-2023-31579 
Dromara Lamp-Cloud before v3.8.1 was discovered to use a hardcoded cryptographic key when creating and verifying a Json Web Token. This vulnerability allows attackers to authenticate to the application via a crafted JWT token.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-11-02T00:00:00.000Z
CVE-2023-31580 
light-oauth2 before version 2.1.27 obtains the public key without any verification. This could allow attackers to authenticate to the application with a crafted JWT token.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-10-24T00:00:00.000Z
CVE-2023-31581 
Dromara Sureness before v1.0.8 was discovered to use a hardcoded key.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-10-24T00:00:00.000Z
CVE-2023-31582 
jose4j before v0.9.3 allows attackers to set a low iteration count of 1000 or less.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-10-24T00:00:00.000Z
CVE-2023-31584 
GitHub repository cu/silicon commit a9ef36 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the User Input field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-05-22T00:00:00.000Z
CVE-2023-31585 
Grocery-CMS-PHP-Restful-API v1.3 is vulnerable to File Upload via /admin/add-category.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-05-08T00:00:00.000Z
CVE-2023-31587 
Tenda AC5 router V15.03.06.28 was discovered to contain a remote code execution (RCE) vulnerability via the Mac parameter at ip/goform/WriteFacMac.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-05-16T00:00:00.000Z
CVE-2023-31594 
IC Realtime ICIP-P2012T 2.420 is vulnerable to Incorrect Access Control via an exposed HTTP channel using VLC network.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-05-25T00:00:00.000Z
CVE-2023-31595 
IC Realtime ICIP-P2012T 2.420 is vulnerable to Incorrect Access Control via unauthenticated port access.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-05-24T00:00:00.000Z
CVE-2023-31597 
An issue in Zammad v5.4.0 allows attackers to bypass e-mail verification using an arbitrary address and manipulate the data of the generated user. Attackers are also able to gain unauthorized access to existing tickets.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-05-18T00:00:00.000Z
CVE-2023-31606 
A Regular Expression Denial of Service (ReDoS) issue was discovered in the sanitize_html function of redcloth gem v4.0.0. This vulnerability allows attackers to cause a Denial of Service (DoS) via supplying a crafted payload.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-06-06T00:00:00.000Z
CVE-2023-31607 
An issue in the __libc_malloc component of openlink virtuoso-opensource v7.2.9 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-05-15T00:00:00.000Z
CVE-2023-31608 
An issue in the artm_div_int component of openlink virtuoso-opensource v7.2.9 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-05-15T00:00:00.000Z
CVE-2023-31609 
An issue in the dfe_unit_col_loci component of openlink virtuoso-opensource v7.2.9 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-05-15T00:00:00.000Z
CVE-2023-31610 
An issue in the _IO_default_xsputn component of openlink virtuoso-opensource v7.2.9 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-05-15T00:00:00.000Z
CVE-2023-31611 
An issue in the __libc_longjmp component of openlink virtuoso-opensource v7.2.9 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-05-15T00:00:00.000Z
CVE-2023-31612 
An issue in the dfe_qexp_list component of openlink virtuoso-opensource v7.2.9 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-05-15T00:00:00.000Z
CVE-2023-31613 
An issue in the __nss_database_lookup component of openlink virtuoso-opensource v7.2.9 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-05-15T00:00:00.000Z