rainbutterfly/cve_corpus huggingface dataset:
CVE-2023-46455 
In GL.iNET GL-AR300M routers with firmware v4.3.7 it is possible to write arbitrary files through a path traversal attack in the OpenVPN client file upload functionality.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-12-12T00:00:00.000Z
CVE-2023-46456 
In GL.iNET GL-AR300M routers with firmware 3.216 it is possible to inject arbitrary shell commands through the OpenVPN client file upload functionality.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-12-12T00:00:00.000Z
CVE-2023-46467 
Cross Site Scripting vulnerability in juzawebCMS v.3.4 and before allows a remote attacker to execute arbitrary code via a crafted payload to the username parameter of the registration page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-10-28T00:00:00.000Z
CVE-2023-46468 
An issue in juzawebCMS v.3.4 and before allows a remote attacker to execute arbitrary code via a crafted file to the custom plugin function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-10-28T00:00:00.000Z
CVE-2023-46470 
Cross Site Scripting vulnerability in Space Applications Services Yamcs v.5.8.6 allows a remote attacker to execute arbitrary code via crafted telecommand in the timeline view of the ArchiveBrowser.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-11-20T00:00:00.000Z
CVE-2023-46471 
Cross Site Scripting vulnerability in Space Applications Services Yamcs v.5.8.6 allows a remote attacker to execute arbitrary code via the text variable scriptContainer of the ScriptViewer.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-11-20T00:00:00.000Z
CVE-2023-46474 
File Upload vulnerability PMB v.7.4.8 allows a remote attacker to execute arbitrary code and escalate privileges via a crafted PHP file uploaded to the start_import.php file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-01-11T00:00:00.000Z
CVE-2023-46475 
A Stored Cross-Site Scripting vulnerability was discovered in ZenTao 18.3 where a user can create a project, and in the name field of the project, they can inject malicious JavaScript code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-11-02T00:00:00.000Z
CVE-2023-46478 
An issue in minCal v.1.0.0 allows a remote attacker to execute arbitrary code via a crafted script to the customer_data parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-10-30T00:00:00.000Z
CVE-2023-46480 
An issue in OwnCast v.0.1.1 allows a remote attacker to execute arbitrary code and obtain sensitive information via the authHost parameter of the indieauth function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-11-27T00:00:00.000Z
CVE-2023-46482 
SQL injection vulnerability in wuzhicms v.4.1.0 allows a remote attacker to execute arbitrary code via the Database Backup Functionality in the coreframe/app/database/admin/index.php component.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-11-01T00:00:00.000Z
CVE-2023-46483 
Cross Site Scripting vulnerability in timetec AWDMS v.2.0 allows an attacker to obtain sensitive information via a crafted payload to the remark parameter of the New Zone function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-11-08T00:00:00.000Z
CVE-2023-46484 
An issue in TOTOlink X6000R V9.4.0cu.852_B20230719 allows a remote attacker to execute arbitrary code via the setLedCfg function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-10-31T00:00:00.000Z
CVE-2023-46485 
An issue in TOTOlink X6000R V9.4.0cu.852_B20230719 allows a remote attacker to execute arbitrary code via the setTracerouteCfg function of the stecgi.cgi component.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-10-31T00:00:00.000Z
CVE-2023-46490 
SQL Injection vulnerability in Cacti v1.2.25 allows a remote attacker to obtain sensitive information via the form_actions() function in the managers.php function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-10-27T00:00:00.000Z
CVE-2023-46491 
ZenTao Biz version 4.1.3 and before has a Cross Site Scripting (XSS) vulnerability in the Version Library.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-10-26T00:00:00.000Z
CVE-2023-46492 
Cross Site Scripting vulnerability in MLDB.ai v.2017.04.17.0 allows a remote attacker to execute arbitrary code via a crafted payload to the public_html/doc/index.html.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-11-09T00:00:00.000Z
CVE-2023-46493 
Directory Traversal vulnerability in EverShop NPM versions before v.1.0.0-rc.8 allows a remote attacker to obtain sensitive information via a crafted request to the readDirSync function in fileBrowser/browser.js.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-12-08T00:00:00.000Z
CVE-2023-46494 
Cross Site Scripting vulnerability in EverShop NPM versions before v.1.0.0-rc.5 allows a remote attacker to obtain sensitive information via a crafted request to the ProductGrid function in admin/productGrid/Grid.jsx.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-12-08T00:00:00.000Z
CVE-2023-46495 
Cross Site Scripting vulnerability in EverShop NPM versions before v.1.0.0-rc.8 allows a remote attacker to obtain sensitive information via a crafted request to the sortBy parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-12-08T00:00:00.000Z
CVE-2023-46496 
Directory Traversal vulnerability in EverShop NPM versions before v.1.0.0-rc.8 allows a remote attacker to obtain sensitive information via a crafted request to the DELETE function in api/files endpoint.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-12-08T00:00:00.000Z
CVE-2023-46497 
Directory Traversal vulnerability in EverShop NPM versions before v.1.0.0-rc.8 allows a remote attacker to obtain sensitive information via a crafted request to the mkdirSync function in the folderCreate/createFolder.js endpoint.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-12-08T00:00:00.000Z
CVE-2023-46498 
An issue in EverShop NPM versions before v.1.0.0-rc.8 allows a remote attacker to obtain sensitive information and execute arbitrary code via the /deleteCustomer/route.json file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-12-08T00:00:00.000Z
CVE-2023-46499 
Cross Site Scripting vulnerability in EverShop NPM versions before v.1.0.0-rc.5 allows a remote attacker to obtain sensitive information via a crafted scripts to the Admin Panel.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-12-08T00:00:00.000Z
CVE-2023-46501 
An issue in BoltWire v.6.03 allows a remote attacker to obtain sensitive information via a crafted payload to the view and change admin password function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-11-07T00:00:00.000Z
CVE-2023-46502 
An issue in openCRX v.5.2.2 allows a remote attacker to read internal files and execute server side request forgery attack via insecure DocumentBuilderFactory.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-10-30T00:00:00.000Z
CVE-2023-46503 
Cross Site Scripting (XSS) vulnerability in PwnCYN YXBOOKCMS v.1.0.2 allows a remote attacker to execute arbitrary code via the reader management and book input modules.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-10-27T00:00:00.000Z
CVE-2023-46504 
Cross Site Scripting (XSS) vulnerability in PwnCYN YXBOOKCMS v.1.0.2 allows a physically proximate attacker to execute arbitrary code via the library name function in the general settings component.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-10-27T00:00:00.000Z
CVE-2023-46505 
Cross Site Scripting vulnerability in FanCMS v.1.0.0 allows an attacker to execute arbitrary code via the content1 parameter in the demo.php file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-10-27T00:00:00.000Z
CVE-2023-46509 
An issue in Contec SolarView Compact v.6.0 and before allows an attacker to execute arbitrary code via the texteditor.php component.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-10-27T00:00:00.000Z
CVE-2023-46510 
An issue in ZIONCOM (Hong Kong) Technology Limited A7000R v.4.1cu.4154 allows an attacker to execute arbitrary code via the cig-bin/cstecgi.cgi to the settings/setPasswordCfg function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-10-27T00:00:00.000Z
CVE-2023-46518 
Mercury A15 V1.0 20230818_1.0.3 was discovered to contain a command execution vulnerability via the component cloudDeviceTokenSuccCB.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-10-25T00:00:00.000Z
CVE-2023-46520 
TP-LINK TL-WR886N V7.0_3.0.14_Build_221115_Rel.56908n.bin was discovered to contain a stack overflow via the function uninstallPluginReqHandle.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-10-25T00:00:00.000Z
CVE-2023-46521 
TP-LINK TL-WR886N V7.0_3.0.14_Build_221115_Rel.56908n.bin was discovered to contain a stack overflow via the function RegisterRegister.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-10-25T00:00:00.000Z
CVE-2023-46522 
TP-LINK device TL-WR886N V7.0_3.0.14_Build_221115_Rel.56908n.bin and TL-WDR7660 2.0.30 were discovered to contain a stack overflow via the function deviceInfoRegister.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-10-25T00:00:00.000Z
CVE-2023-46523 
TP-LINK TL-WR886N V7.0_3.0.14_Build_221115_Rel.56908n.bin was discovered to contain a stack overflow via the function upgradeInfoRegister.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-10-25T00:00:00.000Z
CVE-2023-46525 
TP-LINK TL-WR886N V7.0_3.0.14_Build_221115_Rel.56908n.bin was discovered to contain a stack overflow via the function loginRegister.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-10-25T00:00:00.000Z
CVE-2023-46526 
TP-LINK TL-WR886N V7.0_3.0.14_Build_221115_Rel.56908n.bin was discovered to contain a stack overflow via the function resetCloudPwdRegister.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-10-25T00:00:00.000Z
CVE-2023-46527 
TP-LINK TL-WR886N V7.0_3.0.14_Build_221115_Rel.56908n.bin and TL-WDR7660 2.0.30 was discovered to contain a stack overflow via the function bindRequestHandle.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-10-25T00:00:00.000Z
CVE-2023-46534 
TP-LINK TL-WR886N V7.0_3.0.14_Build_221115_Rel.56908n.bin was discovered to contain a stack overflow via the function modifyAccPwdRegister.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-10-25T00:00:00.000Z
CVE-2023-46535 
TP-LINK TL-WR886N V7.0_3.0.14_Build_221115_Rel.56908n.bin was discovered to contain a stack overflow via the function getResetVeriRegister.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-10-25T00:00:00.000Z
CVE-2023-46536 
TP-LINK TL-WR886N V7.0_3.0.14_Build_221115_Rel.56908n.bin was discovered to contain a stack overflow via the function chkRegVeriRegister.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-10-25T00:00:00.000Z
CVE-2023-46537 
TP-LINK TL-WR886N V7.0_3.0.14_Build_221115_Rel.56908n.bin was discovered to contain a stack overflow via the function getRegVeriRegister.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-10-25T00:00:00.000Z
CVE-2023-46538 
TP-LINK TL-WR886N V7.0_3.0.14_Build_221115_Rel.56908n.bin was discovered to contain a stack overflow via the function chkResetVeriRegister.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-10-25T00:00:00.000Z
CVE-2023-46539 
TP-LINK TL-WR886N V7.0_3.0.14_Build_221115_Rel.56908n.bin was discovered to contain a stack overflow via the function registerRequestHandle.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-10-25T00:00:00.000Z
CVE-2023-46540 
TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formNtp.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-10-25T00:00:00.000Z
CVE-2023-46541 
TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formIpv6Setup.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-10-25T00:00:00.000Z
CVE-2023-46542 
TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formMeshUploadConfig.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-10-25T00:00:00.000Z
CVE-2023-46543 
TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formWlSiteSurvey.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-10-25T00:00:00.000Z
CVE-2023-46544 
TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formWirelessTbl.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-10-25T00:00:00.000Z
CVE-2023-46545 
TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formWsc.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-10-25T00:00:00.000Z
CVE-2023-46546 
TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formStats.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-10-25T00:00:00.000Z
CVE-2023-46547 
TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formSysLog.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-10-25T00:00:00.000Z
CVE-2023-46548 
TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formWlanRedirect.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-10-25T00:00:00.000Z
CVE-2023-46549 
TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formSetLg.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-10-25T00:00:00.000Z
CVE-2023-46550 
TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formMapDelDevice.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-10-25T00:00:00.000Z
CVE-2023-46551 
TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formReflashClientTbl.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-10-25T00:00:00.000Z
CVE-2023-46552 
TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formMultiAP.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-10-25T00:00:00.000Z
CVE-2023-46553 
TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formParentControl.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-10-25T00:00:00.000Z
CVE-2023-46554 
TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formMapDel.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-10-25T00:00:00.000Z
CVE-2023-46555 
TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formPortFw.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-10-25T00:00:00.000Z
CVE-2023-46556 
TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formFilter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-10-25T00:00:00.000Z
CVE-2023-46557 
TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formMultiAPVLAN.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-10-25T00:00:00.000Z
CVE-2023-46558 
TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formMapDelDevice.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-10-25T00:00:00.000Z
CVE-2023-46559 
TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formIPv6Addr.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-10-25T00:00:00.000Z
CVE-2023-46560 
TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formTcpipSetup.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-10-25T00:00:00.000Z
CVE-2023-46562 
TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formDosCfg.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-10-25T00:00:00.000Z
CVE-2023-46563 
TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formIpQoS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-10-25T00:00:00.000Z
CVE-2023-46564 
TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formDMZ.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-10-25T00:00:00.000Z
CVE-2023-46565 
Buffer Overflow vulnerability in osrg gobgp commit 419c50dfac578daa4d11256904d0dc182f1a9b22 allows a remote attacker to cause a denial of service via the handlingError function in pkg/server/fsm.go.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-04-29T00:00:00.000Z
CVE-2023-46566 
Buffer Overflow vulnerability in msoulier tftpy commit 467017b844bf6e31745138a30e2509145b0c529c allows a remote attacker to cause a denial of service via the parse function in the TftpPacketFactory class.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-04-29T00:00:00.000Z
CVE-2023-46569 
An out-of-bounds read in radare2 v.5.8.9 and before exists in the print_insn32_fpu function of libr/arch/p/nds32/nds32-dis.h.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-10-28T00:00:00.000Z
CVE-2023-46570 
An out-of-bounds read in radare2 v.5.8.9 and before exists in the print_insn32 function of libr/arch/p/nds32/nds32-dis.h.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-10-28T00:00:00.000Z
CVE-2023-46574 
An issue in TOTOLINK A3700R v.9.1.2u.6165_20211012 allows a remote attacker to execute arbitrary code via the FileName parameter of the UploadFirmwareFile function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-10-24T00:00:00.000Z
CVE-2023-46575 
A SQL injection vulnerability exists in Meshery prior to version v0.6.179, enabling a remote attacker to retrieve sensitive information and execute arbitrary code through the “order” parameter
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-11-24T00:00:00.000Z
CVE-2023-46580 
Cross-Site Scripting (XSS) vulnerability in Inventory Management V1.0 allows attackers to execute arbitrary code via the pname parameter of the editProduct.php component.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-11-14T00:00:00.000Z
CVE-2023-46581 
SQL injection vulnerability in Inventory Management v.1.0 allows a local attacker to execute arbitrary code via the name, uname and email parameters in the registration.php component.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-11-14T00:00:00.000Z
CVE-2023-46582 
SQL injection vulnerability in Inventory Management v.1.0 allows a local attacker to execute arbitrary SQL commands via the id paramter in the deleteProduct.php component.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-11-14T00:00:00.000Z
CVE-2023-46583 
Cross-Site Scripting (XSS) vulnerability in PHPGurukul Nipah virus (NiV) " Testing Management System v.1.0 allows attackers to execute arbitrary code via a crafted payload injected into the State field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-10-25T00:00:00.000Z
CVE-2023-46584 
SQL Injection vulnerability in PHPGurukul Nipah virus (NiV) " Testing Management System v.1.0 allows a remote attacker to escalate privileges via a crafted request to the new-user-testing.php endpoint.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-10-25T00:00:00.000Z
CVE-2023-46586 
cgi.c in weborf .0.17, 0.18, 0.19, and 0.20 (before 1.0) lacks '\0' termination of the path for CGI scripts because strncpy is misused.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-10-09T00:00:00.000Z
CVE-2023-46587 
Buffer Overflow vulnerability in XnView Classic v.2.51.5 allows a local attacker to execute arbitrary code via a crafted TIF file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-10-27T00:00:00.000Z
CVE-2023-46589 Apache Tomcat: HTTP request smuggling via malformed trailer headers
Improper Input Validation vulnerability in Apache Tomcat.Tomcat from 11.0.0-M1 through 11.0.0-M10, from 10.1.0-M1 through 10.1.15, from 9.0.0-M1 through 9.0.82 and from 8.5.0 through 8.5.95 did not correctly parse HTTP trailer headers. A trailer header that exceeded the header size limit could cause Tomcat to treat a single 
request as multiple requests leading to the possibility of request 
smuggling when behind a reverse proxy.


Older, EOL versions may also be affected.


Users are recommended to upgrade to version 11.0.0-M11 onwards, 10.1.16 onwards, 9.0.83 onwards or 8.5.96 onwards, which fix the issue.
Problem types: cwe_id: CWE-444
description: CWE-444 Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')
Affected products: vendor: Apache Software Foundation
product: Apache Tomcat
default_status: unaffected
Credits: lang: en
value: Norihito Aimoto (OSSTech Corporation)
Published: 2023-11-28T15:31:52.366Z