rainbutterfly/cve_corpus huggingface dataset:
CVE-2024-34139 Adobe Bridge has an integer overflow vulnerability when parsing SVG file
Bridge versions 14.0.4, 13.0.7, 14.1 and earlier are affected by an Integer Overflow or Wraparound vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Problem types: cwe_id: CWE-190
description: Integer Overflow or Wraparound (CWE-190)
Affected products: vendor: Adobe
product: Bridge
default_status: affected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
availabilityRequirement: NOT_DEFINED
baseScore: 7.8
baseSeverity: HIGH
confidentialityImpact: HIGH
confidentialityRequirement: NOT_DEFINED
environmentalScore: 7.8
environmentalSeverity: HIGH
exploitCodeMaturity: NOT_DEFINED
integrityImpact: HIGH
integrityRequirement: NOT_DEFINED
modifiedAttackComplexity: LOW
modifiedAttackVector: LOCAL
modifiedAvailabilityImpact: HIGH
modifiedConfidentialityImpact: HIGH
modifiedIntegrityImpact: HIGH
modifiedPrivilegesRequired: NONE
modifiedScope: NOT_DEFINED
modifiedUserInteraction: REQUIRED
privilegesRequired: NONE
remediationLevel: NOT_DEFINED
reportConfidence: NOT_DEFINED
scope: UNCHANGED
temporalScore: 7.8
temporalSeverity: HIGH
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
version: 3.1
Published: 2024-07-09T19:26:32.806Z
CVE-2024-34140 Adobe Bridge PDF File Parsing Memory Corruption
Bridge versions 14.0.4, 13.0.7, 14.1 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Problem types: cwe_id: CWE-125
description: Out-of-bounds Read (CWE-125)
Affected products: vendor: Adobe
product: Bridge
default_status: affected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: NONE
availabilityRequirement: NOT_DEFINED
baseScore: 5.5
baseSeverity: MEDIUM
confidentialityImpact: HIGH
confidentialityRequirement: NOT_DEFINED
environmentalScore: 5.5
environmentalSeverity: MEDIUM
exploitCodeMaturity: NOT_DEFINED
integrityImpact: NONE
integrityRequirement: NOT_DEFINED
modifiedAttackComplexity: LOW
modifiedAttackVector: LOCAL
modifiedAvailabilityImpact: NONE
modifiedConfidentialityImpact: HIGH
modifiedIntegrityImpact: NONE
modifiedPrivilegesRequired: NONE
modifiedScope: NOT_DEFINED
modifiedUserInteraction: REQUIRED
privilegesRequired: NONE
remediationLevel: NOT_DEFINED
reportConfidence: NOT_DEFINED
scope: UNCHANGED
temporalScore: 5.5
temporalSeverity: MEDIUM
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
version: 3.1
Published: 2024-07-09T19:26:33.554Z
CVE-2024-34141 Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)
Adobe Experience Manager versions 6.5.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.
Problem types: cwe_id: CWE-79
description: Cross-site Scripting (Stored XSS) (CWE-79)
Affected products: vendor: Adobe
product: Adobe Experience Manager
default_status: affected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
availabilityRequirement: NOT_DEFINED
baseScore: 5.4
baseSeverity: MEDIUM
confidentialityImpact: LOW
confidentialityRequirement: NOT_DEFINED
environmentalScore: 5.4
environmentalSeverity: MEDIUM
exploitCodeMaturity: NOT_DEFINED
integrityImpact: LOW
integrityRequirement: NOT_DEFINED
modifiedAttackComplexity: LOW
modifiedAttackVector: NETWORK
modifiedAvailabilityImpact: NONE
modifiedConfidentialityImpact: LOW
modifiedIntegrityImpact: LOW
modifiedPrivilegesRequired: LOW
modifiedScope: CHANGED
modifiedUserInteraction: REQUIRED
privilegesRequired: LOW
remediationLevel: NOT_DEFINED
reportConfidence: NOT_DEFINED
scope: CHANGED
temporalScore: 5.4
temporalSeverity: MEDIUM
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
version: 3.1
Published: 2024-06-25T08:50:01.824Z
CVE-2024-34142 Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)
Adobe Experience Manager versions 6.5.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.
Problem types: cwe_id: CWE-79
description: Cross-site Scripting (Stored XSS) (CWE-79)
Affected products: vendor: Adobe
product: Adobe Experience Manager
default_status: affected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
availabilityRequirement: NOT_DEFINED
baseScore: 5.4
baseSeverity: MEDIUM
confidentialityImpact: LOW
confidentialityRequirement: NOT_DEFINED
environmentalScore: 5.4
environmentalSeverity: MEDIUM
exploitCodeMaturity: NOT_DEFINED
integrityImpact: LOW
integrityRequirement: NOT_DEFINED
modifiedAttackComplexity: LOW
modifiedAttackVector: NETWORK
modifiedAvailabilityImpact: NONE
modifiedConfidentialityImpact: LOW
modifiedIntegrityImpact: LOW
modifiedPrivilegesRequired: LOW
modifiedScope: CHANGED
modifiedUserInteraction: REQUIRED
privilegesRequired: LOW
remediationLevel: NOT_DEFINED
reportConfidence: NOT_DEFINED
scope: CHANGED
temporalScore: 5.4
temporalSeverity: MEDIUM
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
version: 3.1
Published: 2024-06-25T08:50:02.677Z
CVE-2024-34144 
A sandbox bypass vulnerability involving crafted constructor bodies in Jenkins Script Security Plugin 1335.vf07d9ce377a_e and earlier allows attackers with permission to define and run sandboxed scripts, including Pipelines, to bypass the sandbox protection and execute arbitrary code in the context of the Jenkins controller JVM.
Affected products: vendor: Jenkins Project
product: Jenkins Script Security Plugin
default_status: unaffected
Published: 2024-05-02T13:28:03.226Z
CVE-2024-34145 
A sandbox bypass vulnerability involving sandbox-defined classes that shadow specific non-sandbox-defined classes in Jenkins Script Security Plugin 1335.vf07d9ce377a_e and earlier allows attackers with permission to define and run sandboxed scripts, including Pipelines, to bypass the sandbox protection and execute arbitrary code in the context of the Jenkins controller JVM.
Affected products: vendor: Jenkins Project
product: Jenkins Script Security Plugin
default_status: unaffected
Published: 2024-05-02T13:28:03.965Z
CVE-2024-34146 
Jenkins Git server Plugin 114.v068a_c7cc2574 and earlier does not perform a permission check for read access to a Git repository over SSH, allowing attackers with a previously configured SSH public key but lacking Overall/Read permission to access these repositories.
Affected products: vendor: Jenkins Project
product: Jenkins Git server Plugin
default_status: unaffected
Published: 2024-05-02T13:28:04.598Z
CVE-2024-34147 
Jenkins Telegram Bot Plugin 1.4.0 and earlier stores the Telegram Bot token unencrypted in its global configuration file on the Jenkins controller where it can be viewed by users with access to the Jenkins controller file system.
Affected products: vendor: Jenkins Project
product: Jenkins Telegram Bot Plugin
default_status: unknown
Published: 2024-05-02T13:28:05.238Z
CVE-2024-34148 
Jenkins Subversion Partial Release Manager Plugin 1.0.1 and earlier programmatically disables the fix for CVE-2016-3721 whenever a build is triggered from a release tag, by setting the Java system property 'hudson.model.ParametersAction.keepUndefinedParameters'.
Affected products: vendor: Jenkins Project
product: Jenkins Subversion Partial Release Manager Plugin
default_status: unknown
Published: 2024-05-02T13:28:05.952Z
CVE-2024-34149 
In Bitcoin Core through 27.0 and Bitcoin Knots before 25.1.knots20231115, tapscript lacks a policy size limit check, a different issue than CVE-2023-50428. NOTE: some parties oppose this new limit check (for example, because they agree with the objective but disagree with the technical mechanism, or because they have a different objective).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-04-30T00:00:00.000Z
CVE-2024-34152 Playbook Run Metadata leak to Guest
Mattermost versions 9.5.x <= 9.5.3, 9.6.x <= 9.6.1 and 8.1.x <= 8.1.12 fail to perform proper access control which allows a guest to get the metadata of a public playbook run that linked to the channel they are guest via sending an RHSRuns GraphQL query request to the server
Problem types: cwe_id: CWE-284
description: CWE-284: Improper Access Control
Affected products: vendor: Mattermost
product: Mattermost
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
version: 3.1
Credits: lang: en
value: BhaRat (hackit_bharat)
Published: 2024-05-26T13:28:16.722Z
CVE-2024-34153 
Uncontrolled search path element in Intel(R) RAID Web Console software for all versions may allow an authenticated user to potentially enable escalation of privilege via local access.
Problem types: description: escalation of privilege
cwe_id: CWE-427
description: Uncontrolled search path element
Affected products: vendor: n/a
product: Intel(R) RAID Web Console software
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 6.7
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: HIGH
privilegesRequired: LOW
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
Published: 2024-09-16T16:38:35.808Z
CVE-2024-34155 Stack exhaustion in all Parse functions in go/parser
Calling any of the Parse functions on Go source code which contains deeply nested literals can cause a panic due to stack exhaustion.
Problem types: description: CWE-674: Uncontrolled Recursion
Affected products: vendor: Go standard library
product: go/parser
default_status: unaffected
Published: 2024-09-06T20:42:42.518Z
CVE-2024-34156 Stack exhaustion in Decoder.Decode in encoding/gob
Calling Decoder.Decode on a message which contains deeply nested structures can cause a panic due to stack exhaustion. This is a follow-up to CVE-2022-30635.
Problem types: description: CWE-674: Uncontrolled Recursion
Affected products: vendor: Go standard library
product: encoding/gob
default_status: unaffected
Credits: lang: en
value: Md Sakib Anwar of The Ohio State University (anwar.40@osu.edu)
Published: 2024-09-06T20:42:42.661Z
CVE-2024-34158 Stack exhaustion in Parse in go/build/constraint
Calling Parse on a "// +build" build tag line with deeply nested expressions can cause a panic due to stack exhaustion.
Problem types: description: CWE-674: Uncontrolled Recursion
Affected products: vendor: Go standard library
product: go/build/constraint
default_status: unaffected
Published: 2024-09-06T20:42:42.822Z
CVE-2024-34161 NGINX HTTP/3 QUIC vulnerability
When NGINX Plus or NGINX OSS are configured to use the HTTP/3 QUIC module and the network infrastructure supports a Maximum Transmission Unit (MTU) of 4096 or greater without fragmentation, undisclosed QUIC packets can cause NGINX worker processes to leak previously freed memory.
Problem types: cwe_id: CWE-416
description: CWE-416 Use After Free
Affected products: vendor: F5
product: NGINX Open Source
default_status: unknown
vendor: F5
product: NGINX Plus
default_status: unknown
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
version: 3.1
Credits: lang: en
value: F5
Published: 2024-05-29T16:02:05.696Z
CVE-2024-34162 
The web interface of the affected devices is designed to hide the LDAP credentials even for administrative users. But configuring LDAP authentication to "SIMPLE", the device communicates with the LDAP server in clear-text. The LDAP password can be retrieved from this clear-text communication. As for the details of affected product names, model numbers, and versions, refer to the information provided by the respective vendors listed under [References].
Problem types: cwe_id: CWE-767
description: Access to critical private variable via public method
Affected products: vendor: Sharp Corporation
product: Multiple MFPs (multifunction printers)
vendor: Toshiba Tec Corporation
product: Multiple MFPs (multifunction printers)
CVSS v3.1: version: 3.1
baseSeverity: MEDIUM
baseScore: 5.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Published: 2024-11-26T07:37:57.671Z
CVE-2024-34163 
Improper input validation in firmware for some Intel(R) NUC may allow a privileged user to potentially enableescalation of privilege via local access.
Problem types: description: escalation of privilege
cwe_id: CWE-20
description: Improper input validation
Affected products: vendor: n/a
product: Intel(R) NUC
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 7.5
baseSeverity: HIGH
vectorString: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: HIGH
privilegesRequired: HIGH
userInteraction: NONE
scope: CHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
Published: 2024-08-14T13:45:38.963Z
CVE-2024-34164 
Uncontrolled search path element in some Intel(R) MAS software before version 2.5 may allow an authenticated user to potentially enable escalation of privilege via local access.
Problem types: description: escalation of privilege
cwe_id: CWE-427
description: Uncontrolled search path element
Affected products: vendor: n/a
product: Intel(R) MAS software
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 6.7
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: HIGH
privilegesRequired: LOW
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
Published: 2024-11-13T21:09:00.359Z
CVE-2024-34165 
Uncontrolled search path in some Intel(R) oneAPI DPC++/C++ Compiler before version 2024.2 may allow an authenticated user to potentially enable escalation of privilege via local access.
Problem types: description: escalation of privilege
cwe_id: CWE-427
description: Uncontrolled search path
Affected products: vendor: n/a
product: Intel(R) oneAPI DPC++/C++ Compiler
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 6.7
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: HIGH
privilegesRequired: LOW
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
Published: 2024-11-13T21:12:03.928Z
CVE-2024-34166 
An os command injection vulnerability exists in the touchlist_sync.cgi touchlistsync() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted set of HTTP requests can lead to arbitrary code execution. An attacker can send an HTTP request to trigger this vulnerability.
Problem types: cwe_id: CWE-77
description: CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')
Affected products: vendor: Wavlink
product: Wavlink AC3000
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: CHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
baseScore: 10
baseSeverity: CRITICAL
Credits: lang: en
value: Discovered by Lilith &gt;_&gt; of Cisco Talos.
Published: 2025-01-14T14:21:36.712Z
CVE-2024-34167 
Uncontrolled search path for the Intel(R) Server Board S2600ST Family BIOS and Firmware Update software all versions may allow an authenticated user to potentially enable escalation of privilege via local access.
Problem types: description: escalation of privilege
cwe_id: CWE-427
description: Uncontrolled search path
Affected products: vendor: n/a
product: Intel(R) Server Board S2600ST Family BIOS and Firmware Update software
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 6.7
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: HIGH
privilegesRequired: LOW
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
Published: 2024-11-13T21:11:37.417Z
CVE-2024-34170 
Improper buffer restrictions in some Intel(R) Graphics Drivers may allow an authenticated user to potentially enable denial of service via local access.
Problem types: description: denial of service
cwe_id: CWE-92
description: Improper buffer restrictions
Affected products: vendor: n/a
product: Intel(R) Graphics Drivers
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 6.6
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: HIGH
Published: 2024-11-13T21:06:04.604Z
CVE-2024-34171 Fuji Electric Monitouch V-SFT Stack-Based Buffer Overflow
Fuji Electric Monitouch V-SFT 
is vulnerable to a stack-based buffer overflow, which could allow an attacker to execute arbitrary code.
Problem types: cwe_id: CWE-121
description: CWE-121
Affected products: vendor: Fuji Electric
product: Monitouch V-SFT
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: kimiya working with Trend Micro Zero Day Initiative, reported these vulnerabilities to CISA.
Published: 2024-05-30T19:55:23.835Z
CVE-2024-34191 
htmly v2.9.6 was discovered to contain an arbitrary file deletion vulnerability via the delete_post() function at admin.php. This vulnerability allows attackers to delete arbitrary files via a crafted request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-05-14T15:31:00.798Z
CVE-2024-34193 
smanga 3.2.7 does not filter the file parameter at the PHP/get file flow.php interface, resulting in a path traversal vulnerability that can cause arbitrary file reading.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-05-20T17:32:46.532Z
CVE-2024-34195 
TOTOLINK AC1200 Wireless Router A3002R Firmware V1.1.1-B20200824 is vulnerable to Buffer Overflow. In the boa server program's CGI handling function formWlEncrypt, there is a lack of length restriction on the wlan_ssid field. This oversight leads to potential buffer overflow under specific circumstances. For instance, by invoking the formWlanRedirect function with specific parameters to alter wlan_idx's value and subsequently invoking the formWlEncrypt function, an attacker can trigger buffer overflow, enabling arbitrary command execution or denial of service attacks.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-28T00:00:00.000Z
CVE-2024-34196 
Totolink AC1200 Wireless Dual Band Gigabit Router A3002RU_V3 Firmware V3.0.0-B20230809.1615 is vulnerable to Buffer Overflow. The "boa" program allows attackers to modify the value of the "vwlan_idx" field via "formMultiAP". This can lead to a stack overflow through the "formWlEncrypt" CGI function by constructing malicious HTTP requests and passing a WLAN SSID value exceeding the expected length, potentially resulting in command execution or denial of service attacks.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-05-08T21:35:35.815Z
CVE-2024-34198 
TOTOLINK AC1200 Wireless Router A3002RU V2.1.1-B20230720.1011 is vulnerable to Buffer Overflow. The formWlEncrypt CGI handler in the boa program fails to limit the length of the wlan_ssid field from user input. This allows attackers to craft malicious HTTP requests by supplying an excessively long value for the wlan_ssid field, leading to a stack overflow. This can be further exploited to execute arbitrary commands or launch denial-of-service attacks.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-28T00:00:00.000Z
CVE-2024-34199 
TinyWeb 1.94 and below allows unauthenticated remote attackers to cause a denial of service (Buffer Overflow) when sending excessively large elements in the request line.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-05-10T16:24:43.075Z
CVE-2024-34200 
TOTOLINK CPE CP450 v4.1.0cu.747_B20191224 was discovered to contain a stack buffer overflow vulnerability in the setIpQosRules function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-05-09T16:41:15.360Z
CVE-2024-34201 
TOTOLINK CP450 v4.1.0cu.747_B20191224 was discovered to contain a stack buffer overflow vulnerability in the getSaveConfig function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-05-09T16:39:16.897Z
CVE-2024-34202 
TOTOLINK CP450 v4.1.0cu.747_B20191224 was discovered to contain a stack buffer overflow vulnerability in the setMacFilterRules function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-05-09T16:37:30.945Z
CVE-2024-34203 
TOTOLINK CP450 v4.1.0cu.747_B20191224 was discovered to contain a stack buffer overflow vulnerability in the setLanguageCfg function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-05-09T16:35:43.519Z
CVE-2024-34204 
TOTOLINK outdoor CPE CP450 v4.1.0cu.747_B20191224 was discovered to contain a command injection vulnerability in the setUpgradeFW function via the FileName parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-05-09T16:33:40.378Z
CVE-2024-34205 
TOTOLINK CP450 v4.1.0cu.747_B20191224 was discovered to contain a command injection vulnerability in the download_firmware function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-05-09T16:31:55.864Z
CVE-2024-34206 
TOTOLINK outdoor CPE CP450 v4.1.0cu.747_B20191224 was discovered to contain a command injection vulnerability in the setWebWlanIdx function via the webWlanIdx parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-05-09T16:29:41.793Z
CVE-2024-34207 
TOTOLINK CP450 v4.1.0cu.747_B20191224 was discovered to contain a stack buffer overflow vulnerability in the setStaticDhcpConfig function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-05-09T16:27:45.809Z
CVE-2024-34209 
TOTOLINK CP450 v4.1.0cu.747_B20191224 was discovered to contain a stack buffer overflow vulnerability in the setIpPortFilterRules function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-05-09T16:42:41.636Z
CVE-2024-34210 
TOTOLINK outdoor CPE CP450 v4.1.0cu.747_B20191224 was discovered to contain a command injection vulnerability in the CloudACMunualUpdate function via the FileName parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-05-09T14:22:20.145Z