rainbutterfly/cve_corpus huggingface dataset:
CVE-2024-35277 
A missing authentication for critical function in Fortinet FortiPortal version 6.0.0 through 6.0.15, FortiManager version 7.4.0 through 7.4.2, 7.2.0 through 7.2.5, 7.0.0 through 7.0.12, 6.4.0 through 6.4.14 allows attacker to access to the configuration of the managed devices by sending specifically crafted packets
Problem types: cwe_id: CWE-306
description: Improper access control
Affected products: vendor: Fortinet
product: FortiManager
cpes: cpe:2.3:o:fortinet:fortimanager:7.4.2:*:*:*:*:*:*:*
cpe:2.3:o:fortinet:fortimanager:7.4.1:*:*:*:*:*:*:*
cpe:2.3:o:fortinet:fortimanager:7.4.0:*:*:*:*:*:*:*
cpe:2.3:o:fortinet:fortimanager:7.2.5:*:*:*:*:*:*:*
cpe:2.3:o:fortinet:fortimanager:7.2.4:*:*:*:*:*:*:*
cpe:2.3:o:fortinet:fortimanager:7.2.3:*:*:*:*:*:*:*
cpe:2.3:o:fortinet:fortimanager:7.2.2:*:*:*:*:*:*:*
cpe:2.3:o:fortinet:fortimanager:7.2.1:*:*:*:*:*:*:*
cpe:2.3:o:fortinet:fortimanager:7.2.0:*:*:*:*:*:*:*
cpe:2.3:o:fortinet:fortimanager:7.0.12:*:*:*:*:*:*:*
cpe:2.3:o:fortinet:fortimanager:7.0.11:*:*:*:*:*:*:*
cpe:2.3:o:fortinet:fortimanager:7.0.10:*:*:*:*:*:*:*
cpe:2.3:o:fortinet:fortimanager:7.0.9:*:*:*:*:*:*:*
cpe:2.3:o:fortinet:fortimanager:7.0.8:*:*:*:*:*:*:*
cpe:2.3:o:fortinet:fortimanager:7.0.7:*:*:*:*:*:*:*
cpe:2.3:o:fortinet:fortimanager:7.0.6:*:*:*:*:*:*:*
cpe:2.3:o:fortinet:fortimanager:7.0.5:*:*:*:*:*:*:*
cpe:2.3:o:fortinet:fortimanager:7.0.4:*:*:*:*:*:*:*
cpe:2.3:o:fortinet:fortimanager:7.0.3:*:*:*:*:*:*:*
cpe:2.3:o:fortinet:fortimanager:7.0.2:*:*:*:*:*:*:*
cpe:2.3:o:fortinet:fortimanager:7.0.1:*:*:*:*:*:*:*
cpe:2.3:o:fortinet:fortimanager:7.0.0:*:*:*:*:*:*:*
cpe:2.3:o:fortinet:fortimanager:6.4.14:*:*:*:*:*:*:*
cpe:2.3:o:fortinet:fortimanager:6.4.13:*:*:*:*:*:*:*
cpe:2.3:o:fortinet:fortimanager:6.4.12:*:*:*:*:*:*:*
cpe:2.3:o:fortinet:fortimanager:6.4.11:*:*:*:*:*:*:*
cpe:2.3:o:fortinet:fortimanager:6.4.10:*:*:*:*:*:*:*
cpe:2.3:o:fortinet:fortimanager:6.4.9:*:*:*:*:*:*:*
cpe:2.3:o:fortinet:fortimanager:6.4.8:*:*:*:*:*:*:*
cpe:2.3:o:fortinet:fortimanager:6.4.7:*:*:*:*:*:*:*
cpe:2.3:o:fortinet:fortimanager:6.4.6:*:*:*:*:*:*:*
cpe:2.3:o:fortinet:fortimanager:6.4.5:*:*:*:*:*:*:*
cpe:2.3:o:fortinet:fortimanager:6.4.4:*:*:*:*:*:*:*
cpe:2.3:o:fortinet:fortimanager:6.4.3:*:*:*:*:*:*:*
cpe:2.3:o:fortinet:fortimanager:6.4.2:*:*:*:*:*:*:*
cpe:2.3:o:fortinet:fortimanager:6.4.1:*:*:*:*:*:*:*
cpe:2.3:o:fortinet:fortimanager:6.4.0:*:*:*:*:*:*:*
default_status: unaffected
CVSS v3.1: version: 3.1
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 8.4
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N/E:F/RL:U/RC:C
Published: 2025-01-14T14:09:54.348Z
CVE-2024-35278 
A improper neutralization of special elements used in an sql command ('sql injection') in Fortinet FortiPortal versions 7.2.4 through 7.2.0 and 7.0.0 through 7.2.8 may allow an authenticated attacker to view the SQL query being run server-side when submitting an HTTP request, via including special elements in said request.
Problem types: cwe_id: CWE-89
description: Information disclosure
Affected products: vendor: Fortinet
product: FortiPortal
default_status: unaffected
CVSS v3.1: version: 3.1
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.1
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:U/RC:C
Published: 2025-01-14T14:09:45.115Z
CVE-2024-35279 
A stack-based buffer overflow [CWE-121] vulnerability in Fortinet FortiOS version 7.2.4 through 7.2.8 and version 7.4.0 through 7.4.4 allows a remote unauthenticated attacker to execute arbitrary code or commands via crafted UDP packets through the CAPWAP control, provided the attacker were able to evade FortiOS stack protections and provided the fabric service is running on the exposed interface.
Problem types: cwe_id: CWE-121
description: Execute unauthorized code or commands
Affected products: vendor: Fortinet
product: FortiOS
cpes: cpe:2.3:o:fortinet:fortios:7.4.4:*:*:*:*:*:*:*
cpe:2.3:o:fortinet:fortios:7.4.3:*:*:*:*:*:*:*
cpe:2.3:o:fortinet:fortios:7.4.2:*:*:*:*:*:*:*
cpe:2.3:o:fortinet:fortios:7.4.1:*:*:*:*:*:*:*
cpe:2.3:o:fortinet:fortios:7.4.0:*:*:*:*:*:*:*
cpe:2.3:o:fortinet:fortios:7.2.8:*:*:*:*:*:*:*
cpe:2.3:o:fortinet:fortios:7.2.7:*:*:*:*:*:*:*
cpe:2.3:o:fortinet:fortios:7.2.6:*:*:*:*:*:*:*
cpe:2.3:o:fortinet:fortios:7.2.5:*:*:*:*:*:*:*
cpe:2.3:o:fortinet:fortios:7.2.4:*:*:*:*:*:*:*
default_status: unaffected
CVSS v3.1: version: 3.1
attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.7
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:C
Published: 2025-02-11T16:09:02.911Z
CVE-2024-35280 
A improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Fortinet FortiDeceptor 5.3.0, FortiDeceptor 5.2.0, FortiDeceptor 5.1 all versions, FortiDeceptor 5.0 all versions, FortiDeceptor 4.3 all versions, FortiDeceptor 4.2 all versions, FortiDeceptor 4.1 all versions, FortiDeceptor 4.0 all versions, FortiDeceptor 3.3 all versions, FortiDeceptor 3.2 all versions, FortiDeceptor 3.1 all versions, FortiDeceptor 3.0 all versions may allow an attacker to perform a reflected cross-site scripting attack in the recovery endpoints
Problem types: cwe_id: CWE-79
description: Execute unauthorized code or commands
Affected products: vendor: Fortinet
product: FortiDeceptor
cpes: cpe:2.3:a:fortinet:fortideceptor:5.3.0:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortideceptor:5.2.0:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortideceptor:5.1.0:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortideceptor:5.0.0:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortideceptor:4.3.0:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortideceptor:4.2.0:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortideceptor:4.1.1:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortideceptor:4.1.0:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortideceptor:4.0.2:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortideceptor:4.0.1:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortideceptor:4.0.0:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortideceptor:3.3.3:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortideceptor:3.3.2:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortideceptor:3.3.1:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortideceptor:3.3.0:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortideceptor:3.2.2:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortideceptor:3.2.1:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortideceptor:3.2.0:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortideceptor:3.1.1:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortideceptor:3.1.0:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortideceptor:3.0.2:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortideceptor:3.0.1:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortideceptor:3.0.0:*:*:*:*:*:*:*
default_status: unaffected
CVSS v3.1: version: 3.1
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.1
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:U/RC:C
Published: 2025-01-15T10:07:14.953Z
CVE-2024-35281 
An improper isolation or compartmentalization vulnerability [CWE-653] in FortiClientMac version 7.4.2 and below, version 7.2.8 and below, 7.0 all versions and FortiVoiceUCDesktop 3.0 all versions desktop application may allow an authenticated attacker to inject code via Electron environment variables.
Problem types: cwe_id: CWE-653
description: Execute unauthorized code or commands
Affected products: vendor: Fortinet
product: FortiClientMac
default_status: unaffected
vendor: Fortinet
product: FortiVoiceUCDesktop
default_status: unaffected
CVSS v3.1: version: 3.1
attackComplexity: HIGH
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 2.3
baseSeverity: LOW
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R
Published: 2025-05-13T14:46:42.574Z
CVE-2024-35282 
A cleartext storage of sensitive information in memory vulnerability [CWE-316] affecting FortiClient VPN iOS 7.2 all versions, 7.0 all versions, 6.4 all versions, 6.2 all versions, 6.0 all versions may allow an unauthenticated attacker that has physical access to a jailbroken device to obtain cleartext passwords via keychain dump.
Problem types: cwe_id: CWE-316
description: Information disclosure
Affected products: vendor: Fortinet
product: FortiClientiOS
cpes: cpe:2.3:a:fortinet:forticlientios:7.2.5:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:forticlientios:7.2.4:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:forticlientios:7.2.3:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:forticlientios:7.2.2:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:forticlientios:7.2.1:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:forticlientios:7.2.0:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:forticlientios:7.0.9:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:forticlientios:7.0.8:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:forticlientios:7.0.7:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:forticlientios:7.0.6:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:forticlientios:7.0.5:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:forticlientios:7.0.4:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:forticlientios:7.0.3:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:forticlientios:7.0.1:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:forticlientios:7.0.0:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:forticlientios:6.4.6:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:forticlientios:6.4.5:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:forticlientios:6.4.4:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:forticlientios:6.4.3:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:forticlientios:6.4.2:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:forticlientios:6.4.0:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:forticlientios:6.2.4:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:forticlientios:6.2.3:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:forticlientios:6.2.2:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:forticlientios:6.2.1:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:forticlientios:6.0.5:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:forticlientios:6.0.4:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:forticlientios:6.0.3:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:forticlientios:6.0.2:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:forticlientios:6.0.1:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:forticlientios:6.0.0:*:*:*:*:*:*:*
default_status: unaffected
CVSS v3.1: version: 3.1
attackComplexity: HIGH
attackVector: PHYSICAL
availabilityImpact: NONE
baseScore: 3.9
baseSeverity: LOW
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N/E:F/RL:O/RC:C
Published: 2024-09-10T14:37:46.189Z
CVE-2024-35283 
A vulnerability in the Ignite component of Mitel MiContact Center Business through 10.0.0.4 could allow an unauthenticated attacker to conduct a stored cross-site scripting (XSS) attack due to insufficient input validation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-05-29T15:42:46.257Z
CVE-2024-35284 
A vulnerability in the legacy chat component of Mitel MiContact Center Business through 10.0.0.4 could allow an unauthenticated attacker to conduct a reflected cross-site scripting (XSS) attack due to insufficient input validation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-05-29T15:52:40.256Z
CVE-2024-35285 
A vulnerability in NuPoint Messenger (NPM) of Mitel MiCollab through 9.8.0.33 allows an unauthenticated attacker to conduct a command injection attack due to insufficient parameter sanitization.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-10-21T00:00:00.000Z
CVE-2024-35286 
A vulnerability in NuPoint Messenger (NPM) of Mitel MiCollab through 9.8.0.33 allows an unauthenticated attacker to conduct a SQL injection attack due to insufficient sanitization of user input. A successful exploit could allow an attacker to access sensitive information and execute arbitrary database and management operations.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-10-21T00:00:00.000Z
CVE-2024-35287 
A vulnerability in the NuPoint Messenger (NPM) component of Mitel MiCollab through version 9.8 SP1 (9.8.1.5) could allow an authenticated attacker with administrative privilege to conduct a privilege escalation attack due to the execution of a resource with unnecessary privileges. A successful exploit could allow an attacker to execute arbitrary commands with elevated privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-10-21T00:00:00.000Z
CVE-2024-35288 
Nitro PDF Pro before 13.70.8.82 and 14.x before 14.26.1.0 allows Local Privilege Escalation in the MSI Installer because custom actions occur unsafely in repair mode. CertUtil is run in a conhost.exe window, and there is a mechanism allowing CTRL+o to launch cmd.exe as NT AUTHORITY\SYSTEM.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-10-09T00:00:00.000Z
CVE-2024-35291 
Cross-site scripting vulnerability exists in Splunk Config Explorer versions prior to 1.7.16. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who is using the product.
Problem types: description: Cross-site scripting (XSS)
Affected products: vendor: Chris Younger 
product: Splunk Config Explorer
Published: 2024-05-27T04:39:56.699Z
CVE-2024-35293 Schneider Elektronik Series 700 prone to missing authentication for critical reset function
An unauthenticated remote attacker may use a missing authentication for critical function vulnerability to reboot or erase the affected devices resulting in data loss and/or a DoS.
Problem types: cwe_id: CWE-306
description: CWE-306: Missing Authentication for Critical Function
Affected products: vendor: Schneider Elektronik
product: Series 700
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.1
baseSeverity: CRITICAL
confidentialityImpact: NONE
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
version: 3.1
Credits: lang: en
value: Felix Eberstaller and David Schauer from Limes Security
Published: 2024-10-02T09:51:01.799Z
CVE-2024-35294 Schneider Elektronik Series 700 prone to missing authentication for traffic capture function
An unauthenticated remote attacker may use the devices traffic capture without authentication to grab plaintext administrative credentials.
Problem types: cwe_id: CWE-306
description: CWE-306: Missing Authentication for Critical Function
Affected products: vendor: Schneider Elektronik
product: Series 700
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
version: 3.1
Credits: lang: en
value: Felix Eberstaller and David Schauer from Limes Security
Published: 2024-10-02T10:07:28.219Z
CVE-2024-35295 
A vulnerability has been identified in Perfect Harmony GH180 (All versions >= V8.0 < V8.3.3 with NXGPro+ controller manufactured between April 2020 to April 2025). The maintenance connection of affected devices fails to protect access to the device's control unit configuration. This could allow an attacker with physical access to the maintenance connection's door port to perform arbitrary configuration changes.
Problem types: cwe_id: CWE-306
description: CWE-306: Missing Authentication for Critical Function
Affected products: vendor: Innomotics
product: Perfect Harmony GH180
default_status: unknown
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
baseScore: 6.1
baseSeverity: MEDIUM
Published: 2025-06-11T06:55:31.200Z
CVE-2024-35296 Apache Traffic Server: Invalid Accept-Encoding can force forwarding requests
Invalid Accept-Encoding header can cause Apache Traffic Server to fail cache lookup and force forwarding requests.

This issue affects Apache Traffic Server: from 8.0.0 through 8.1.10, from 9.0.0 through 9.2.4.

Users are recommended to upgrade to version 8.1.11 or 9.2.5, which fixes the issue.
Problem types: cwe_id: CWE-20
description: CWE-20 Improper Input Validation
Affected products: vendor: Apache Software Foundation
product: Apache Traffic Server
default_status: unaffected
Credits: lang: en
value: Min Chen
Published: 2024-07-26T09:11:11.221Z
CVE-2024-35297 
Cross-site scripting vulnerability exists in WP Booking versions prior to 2.4.5. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who is accessing the web site using the product.
Problem types: description: Cross-site scripting (XSS)
Affected products: vendor: aviplugins.com
product: WP Booking
Published: 2024-05-27T04:40:54.654Z
CVE-2024-35298 
Improper authorization in handler for custom URL scheme issue in 'ZOZOTOWN' App for Android versions prior to 7.39.6 allows an attacker to lead a user to access an arbitrary website via another application installed on the user's device. As a result, the user may become a victim of a phishing attack.
Problem types: description: Improper authorization in handler for custom URL scheme
Affected products: vendor: ZOZO, Inc.
product: 'ZOZOTOWN' App for Android
Published: 2024-06-19T05:07:24.711Z
CVE-2024-35299 
In JetBrains YouTrack before 2024.1.29548 the SMTPS protocol communication lacked proper certificate hostname validation
Problem types: cwe_id: CWE-295
description: CWE-295
Affected products: vendor: JetBrains
product: YouTrack
default_status: unaffected
CVSS v3.1: version: 3.1
attackVector: NETWORK
attackComplexity: HIGH
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: NONE
availabilityImpact: NONE
baseScore: 5.9
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Published: 2024-05-16T10:31:58.950Z
CVE-2024-35300 
In JetBrains TeamCity between 2024.03 and 2024.03.1 several stored XSS in the available updates page were possible
Problem types: cwe_id: CWE-79
description: CWE-79
Affected products: vendor: JetBrains
product: TeamCity
default_status: unaffected
CVSS v3.1: version: 3.1
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: HIGH
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: NONE
baseScore: 3.5
baseSeverity: LOW
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N
Published: 2024-05-16T10:31:59.565Z
CVE-2024-35301 
In JetBrains TeamCity before 2024.03.1 commit status publisher didn't check project scope of the GitHub App token
Problem types: cwe_id: CWE-280
description: CWE-280
Affected products: vendor: JetBrains
product: TeamCity
default_status: unaffected
CVSS v3.1: version: 3.1
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: HIGH
userInteraction: NONE
scope: CHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: NONE
baseScore: 5.5
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N
Published: 2024-05-16T10:32:00.362Z
CVE-2024-35302 
In JetBrains TeamCity before 2023.11 stored XSS during restore from backup was possible
Problem types: cwe_id: CWE-79
description: CWE-79
Affected products: vendor: JetBrains
product: TeamCity
default_status: unaffected
CVSS v3.1: version: 3.1
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: NONE
baseScore: 5.4
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Published: 2024-05-16T10:32:01.010Z
CVE-2024-35303 
A vulnerability has been identified in Tecnomatix Plant Simulation V2302 (All versions < V2302.0012), Tecnomatix Plant Simulation V2404 (All versions < V2404.0001). The affected applications contain a type confusion vulnerability while parsing specially crafted MODEL files. This could allow an attacker to execute code in the context of the current process.  (ZDI-CAN-22958)
Problem types: cwe_id: CWE-704
description: CWE-704: Incorrect Type Conversion or Cast
Affected products: vendor: Siemens
product: Tecnomatix Plant Simulation V2302
default_status: unknown
vendor: Siemens
product: Tecnomatix Plant Simulation V2404
default_status: unknown
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
baseScore: 7.8
baseSeverity: HIGH
Published: 2024-06-11T11:15:57.792Z
CVE-2024-35304 System command injection through Netflow function
System command injection through Netflow function due to improper input validation, allowing attackers to execute arbitrary system commands. This issue affects Pandora FMS: from 700 through <777.
Problem types: cwe_id: CWE-78
description: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected products: vendor: Pandora FMS
product: Pandora FMS
default_status: unaffected
Credits: lang: en
value: u32i@proton.me
Published: 2024-06-10T14:21:10.487Z
CVE-2024-35305 Unauth Time-Based SQL Injection via API
Unauth Time-Based SQL Injection in API allows to exploit HTTP request Authorization header. This issue affects Pandora FMS: from 700 through <777.
Problem types: cwe_id: CWE-89
description: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: Pandora FMS
product: Pandora FMS
default_status: unaffected
Credits: lang: en
value: Aleksey Solovev (Positive Technologies)
Published: 2024-06-10T14:28:18.393Z
CVE-2024-35306 OS Command injection in Ajax PHP files through HTTP Request
OS Command injection in Ajax PHP files via HTTP Request, allows to execute system commands by exploiting variables. This issue affects Pandora FMS: from 700 through <777.
Problem types: cwe_id: CWE-78
description: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected products: vendor: Pandora FMS
product: Pandora FMS
default_status: unaffected
Credits: lang: en
value: Aleksey Solovev (Positive Technologies)
Published: 2024-06-10T14:30:36.784Z
CVE-2024-35307 Argument Injection Leading to Remote Code Execution in Realtime Graph Extension
Argument Injection Leading to Remote Code Execution in Realtime Graph Extension, allowing unauthenticated attackers to execute arbitrary code on the server. This issue affects Pandora FMS: from 700 through <777.
Problem types: cwe_id: CWE-88
description: CWE-88 Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')
Affected products: vendor: Pandora FMS
product: Pandora FMS
default_status: unaffected
Credits: lang: en
value: u32i@proton.me
Published: 2024-06-10T14:33:29.127Z
CVE-2024-35308 Post-auth Arbitrary File Read in the Server Plugins Section
A post-authentication arbitrary file read vulnerability within the server plugins section in plugin edition feature. This issue affects Pandora FMS: from 700 through <777.3.
Problem types: cwe_id: CWE-22
description: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products: vendor: Pandora FMS
product: Pandora FMS
default_status: unaffected
Credits: lang: en
value: i@qvq.im
Published: 2024-10-22T09:03:15.776Z
CVE-2024-35311 
Yubico YubiKey 5 Series before 5.7.0, Security Key Series before 5.7.0, YubiKey Bio Series before 5.6.4, and YubiKey 5 FIPS before 5.7.2 have Incorrect Access Control.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-05-29T15:55:05.390Z
CVE-2024-35312 
In Tor Arti before 1.2.3, STUB circuits incorrectly have a length of 2 (with lite vanguards), aka TROVE-2024-003.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-05-17T21:29:25.481Z