rainbutterfly/cve_corpus huggingface dataset:
CVE-2024-29222 
Out-of-bounds write for some Intel(R) Graphics Driver software may allow an authenticated user to potentially enable denial of service via local access.
Problem types: description: Denial of Service
cwe_id: CWE-787
description: Out-of-bounds Write
Affected products: vendor: n/a
product: Intel(R) Graphics Driver software
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 6.1
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: LOW
availabilityImpact: HIGH
Published: 2025-05-13T21:02:57.686Z
CVE-2024-29223 
Uncontrolled search path for some Intel(R) QuickAssist Technology software before version 2.2.0 may allow an authenticated user to potentially enable escalation of privilege via local access.
Problem types: description: Escalation of Privilege
cwe_id: CWE-427
description: Uncontrolled Search Path Element
Affected products: vendor: n/a
product: Intel(R) QuickAssist Technology software
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 6.7
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: HIGH
privilegesRequired: LOW
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
Published: 2025-02-12T21:18:41.442Z
CVE-2024-29224 
An OS command injection vulnerability exists in the NAT parameter of GoCast 1.1.3. A specially crafted HTTP request can lead to arbitrary command execution. An attacker can make an unauthenticated HTTP request to trigger this vulnerability.
Problem types: cwe_id: CWE-78
description: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected products: vendor: GoCast
product: GoCast
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
Credits: lang: en
value: Discovered by Matt Street and Edwin Molenaar of Cisco Meraki.
Published: 2024-11-21T14:41:52.814Z
CVE-2024-29225 
ELECOM wireless LAN routers allow a network-adjacent unauthenticated attacker to obtain the configuration file containing sensitive information by sending a specially crafted request.
Problem types: description: Information disclosure
Affected products: vendor: ELECOM CO.,LTD.
product: WRC-X3200GST3-B
vendor: ELECOM CO.,LTD.
product: WRC-G01-W
vendor: ELECOM CO.,LTD.
product: WMC-2LX-B
vendor: ELECOM CO.,LTD.
product: WMC-X1800GST-B
vendor: ELECOM CO.,LTD.
product: WSC-X1800GS-B
Published: 2024-04-04T00:04:52.089Z
CVE-2024-29227 
Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in Layout.LayoutSave webapi component in Synology Surveillance Station before 9.2.0-9289 and 9.2.0-11289 allows remote authenticated users to read database containing non-sensitive information and conduct limited denial-of-service attacks via unspecified vectors.
Problem types: cwe_id: CWE-89
description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: Synology
product: Surveillance Station
default_status: affected
CVSS v3.1: baseScore: 5.4
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: NONE
availabilityImpact: LOW
version: 3.1
Credits: lang: en
value: TEAM.ENVY (https://team-envy.gitbook.io/team.envy/about-us)
Published: 2024-03-28T06:08:34.641Z
CVE-2024-29228 
Missing authorization vulnerability in GetStmUrlPath webapi component in Synology Surveillance Station before 9.2.0-9289 and 9.2.0-11289 allows remote authenticated users to obtain sensitive information via unspecified vectors.
Problem types: cwe_id: CWE-862
description: CWE-862: Missing Authorization
Affected products: vendor: Synology
product: Surveillance Station
default_status: affected
CVSS v3.1: version: 3.1
baseScore: 7.7
baseSeverity: HIGH
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: CHANGED
confidentialityImpact: HIGH
integrityImpact: NONE
availabilityImpact: NONE
Credits: lang: en
value: TEAM.ENVY (https://team-envy.gitbook.io/team.envy/about-us)
Published: 2024-03-28T06:13:20.333Z
CVE-2024-29229 
Missing authorization vulnerability in GetLiveViewPath webapi component in Synology Surveillance Station before 9.2.0-9289 and 9.2.0-11289 allows remote authenticated users to obtain sensitive information via unspecified vectors.
Problem types: cwe_id: CWE-862
description: CWE-862: Missing Authorization
Affected products: vendor: Synology
product: Surveillance Station
default_status: affected
CVSS v3.1: version: 3.1
baseScore: 7.7
baseSeverity: HIGH
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: CHANGED
confidentialityImpact: HIGH
integrityImpact: NONE
availabilityImpact: NONE
Credits: lang: en
value: TEAM.ENVY (https://team-envy.gitbook.io/team.envy/about-us)
Published: 2024-03-28T06:19:39.482Z
CVE-2024-29230 
Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in SnapShot.CountByCategory webapi component in Synology Surveillance Station before 9.2.0-9289 and 9.2.0-11289 allows remote authenticated users to read database containing non-sensitive information and conduct limited denial-of-service attacks via unspecified vectors.
Problem types: cwe_id: CWE-89
description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: Synology
product: Surveillance Station
default_status: affected
CVSS v3.1: baseScore: 5.4
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: NONE
availabilityImpact: LOW
version: 3.1
Credits: lang: en
value: TEAM.ENVY (https://team-envy.gitbook.io/team.envy/about-us)
Published: 2024-03-28T06:22:54.365Z
CVE-2024-29231 
Improper validation of array index vulnerability in UserPrivilege.Enum webapi component in Synology Surveillance Station before 9.2.0-9289 and 9.2.0-11289 allows remote authenticated users to obtain non-sensitive information and conduct limited denial-of-service attacks via unspecified vectors.
Problem types: cwe_id: CWE-129
description: Improper Validation of Array Index
Affected products: vendor: Synology
product: Surveillance Station
default_status: affected
CVSS v3.1: baseScore: 5.4
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: NONE
availabilityImpact: LOW
version: 3.1
Credits: lang: en
value: TEAM.ENVY (https://team-envy.gitbook.io/team.envy/about-us)
Published: 2024-03-28T06:23:39.710Z
CVE-2024-29232 
Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in Alert.Enum webapi component in Synology Surveillance Station before 9.2.0-11289 and 9.2.0-9289 allows remote authenticated users to read database containing non-sensitive information and conduct limited denial-of-service attacks via unspecified vectors.
Problem types: cwe_id: CWE-89
description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: Synology
product: Surveillance Station
default_status: affected
CVSS v3.1: baseScore: 5.4
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: NONE
availabilityImpact: LOW
version: 3.1
Credits: lang: en
value: TEAM.ENVY (https://team-envy.gitbook.io/team.envy/about-us)
Published: 2024-03-28T06:24:18.371Z
CVE-2024-29233 
Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in Emap.Delete webapi component in Synology Surveillance Station before 9.2.0-9289 and 9.2.0-11289 allows remote authenticated users to read database containing non-sensitive information and conduct limited denial-of-service attacks via unspecified vectors.
Problem types: cwe_id: CWE-89
description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: Synology
product: Surveillance Station
default_status: affected
CVSS v3.1: baseScore: 5.4
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: NONE
availabilityImpact: LOW
version: 3.1
Credits: lang: en
value: TEAM.ENVY (https://team-envy.gitbook.io/team.envy/about-us)
Published: 2024-03-28T06:25:27.881Z
CVE-2024-29234 
Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in Group.Save webapi component in Synology Surveillance Station before 9.2.0-11289 and 9.2.0-9289 allows remote authenticated users to read database containing non-sensitive information and conduct limited denial-of-service attacks via unspecified vectors.
Problem types: cwe_id: CWE-89
description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: Synology
product: Surveillance Station
default_status: affected
CVSS v3.1: baseScore: 5.4
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: NONE
availabilityImpact: LOW
version: 3.1
Credits: lang: en
value: TEAM.ENVY (https://team-envy.gitbook.io/team.envy/about-us)
Published: 2024-03-28T06:26:12.750Z
CVE-2024-29235 
Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in IOModule.EnumLog webapi component in Synology Surveillance Station before 9.2.0-11289 and 9.2.0-9289 allows remote authenticated users to read database containing non-sensitive information and conduct limited denial-of-service attacks via unspecified vectors.
Problem types: cwe_id: CWE-89
description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: Synology
product: Surveillance Station
default_status: affected
CVSS v3.1: baseScore: 5.4
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: NONE
availabilityImpact: LOW
version: 3.1
Credits: lang: en
value: TEAM.ENVY (https://team-envy.gitbook.io/team.envy/about-us)
Published: 2024-03-28T06:26:32.275Z
CVE-2024-29236 
Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in AudioPattern.Delete webapi component in Synology Surveillance Station before 9.2.0-9289 and 9.2.0-11289 allows remote authenticated users to read database containing non-sensitive information and conduct limited denial-of-service attacks via unspecified vectors.
Problem types: cwe_id: CWE-89
description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: Synology
product: Surveillance Station
default_status: affected
CVSS v3.1: baseScore: 5.4
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: NONE
availabilityImpact: LOW
version: 3.1
Credits: lang: en
value: TEAM.ENVY (https://team-envy.gitbook.io/team.envy/about-us)
Published: 2024-03-28T06:27:09.078Z
CVE-2024-29237 
Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in ActionRule.Delete webapi component in Synology Surveillance Station before 9.2.0-11289 and 9.2.0-9289 allows remote authenticated users to read database containing non-sensitive information and conduct limited denial-of-service attacks via unspecified vectors.
Problem types: cwe_id: CWE-89
description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: Synology
product: Surveillance Station
default_status: affected
CVSS v3.1: baseScore: 5.4
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: NONE
availabilityImpact: LOW
version: 3.1
Credits: lang: en
value: TEAM.ENVY (https://team-envy.gitbook.io/team.envy/about-us)
Published: 2024-03-28T06:27:39.249Z
CVE-2024-29238 
Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in Log.CountByCategory webapi component in Synology Surveillance Station before 9.2.0-9289 and 9.2.0-11289 allows remote authenticated users to read database containing non-sensitive information and conduct limited denial-of-service attacks via unspecified vectors.
Problem types: cwe_id: CWE-89
description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: Synology
product: Surveillance Station
default_status: affected
CVSS v3.1: baseScore: 5.4
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: NONE
availabilityImpact: LOW
version: 3.1
Credits: lang: en
value: TEAM.ENVY (https://team-envy.gitbook.io/team.envy/about-us)
Published: 2024-03-28T06:28:14.399Z
CVE-2024-29239 
Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in Recording.CountByCategory webapi component in Synology Surveillance Station before 9.2.0-11289 and 9.2.0-9289 allows remote authenticated users to read database containing non-sensitive information and conduct limited denial-of-service attacks via unspecified vectors.
Problem types: cwe_id: CWE-89
description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: Synology
product: Surveillance Station
default_status: affected
CVSS v3.1: baseScore: 5.4
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: NONE
availabilityImpact: LOW
version: 3.1
Credits: lang: en
value: TEAM.ENVY (https://team-envy.gitbook.io/team.envy/about-us)
Published: 2024-03-28T06:28:31.235Z
CVE-2024-29240 
Missing authorization vulnerability in LayoutSave webapi component in Synology Surveillance Station before 9.2.0-11289 and 9.2.0-9289 allows remote authenticated users to conduct limited denial-of-service attacks via unspecified vectors.
Problem types: cwe_id: CWE-862
description: Missing Authorization
Affected products: vendor: Synology
product: Surveillance Station
default_status: affected
CVSS v3.1: baseScore: 4.3
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: LOW
version: 3.1
Credits: lang: en
value: TEAM.ENVY (https://team-envy.gitbook.io/team.envy/about-us)
Published: 2024-03-28T06:28:38.385Z
CVE-2024-29241 
Missing authorization vulnerability in System webapi component in Synology Surveillance Station before 9.2.0-9289 and 9.2.0-11289 allows remote authenticated users to obtain non-sensitive information, write sensitive configurations in DSM, and reboot or shutdown NAS via unspecified vectors.
Problem types: cwe_id: CWE-862
description: Missing Authorization
Affected products: vendor: Synology
product: Surveillance Station
default_status: affected
CVSS v3.1: baseScore: 9.9
baseSeverity: CRITICAL
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: CHANGED
confidentialityImpact: LOW
integrityImpact: HIGH
availabilityImpact: HIGH
version: 3.1
Credits: lang: en
value: TEAM.ENVY (https://team-envy.gitbook.io/team.envy/about-us)
Published: 2024-03-28T06:28:53.632Z
CVE-2024-29243 
Shenzhen Libituo Technology Co., Ltd LBT-T300-mini v1.2.9 was discovered to contain a buffer overflow via the vpn_client_ip parameter at /apply.cgi.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-03-21T00:00:00.000Z
CVE-2024-29244 
Shenzhen Libituo Technology Co., Ltd LBT-T300-mini v1.2.9 was discovered to contain a buffer overflow via the pin_code_3g parameter at /apply.cgi.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-03-21T00:00:00.000Z
CVE-2024-29269 
An issue discovered in Telesquare TLR-2005Ksh 1.0.0 and 1.1.4 allows attackers to run arbitrary system commands via the Cmd parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-04-10T00:00:00.000Z
CVE-2024-29271 
Reflected Cross-Site Scripting (XSS) vulnerability in VvvebJs before version 1.7.7, allows remote attackers to execute arbitrary code and obtain sensitive information via the action parameter in save.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-03-22T00:00:00.000Z
CVE-2024-29272 
Arbitrary File Upload vulnerability in VvvebJs before version 1.7.5, allows unauthenticated remote attackers to execute arbitrary code and obtain sensitive information via the sanitizeFileName parameter in save.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-03-22T00:00:00.000Z
CVE-2024-29273 
There is Stored Cross-Site Scripting (XSS) in dzzoffice 2.02.1 SC UTF8 in uploadfile to index.php, with the XSS payload in an SVG document.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-03-22T00:00:00.000Z
CVE-2024-29275 
SQL injection vulnerability in SeaCMS version 12.9, allows remote unauthenticated attackers to execute arbitrary code and obtain sensitive information via the id parameter in class.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-03-22T00:00:00.000Z
CVE-2024-29276 
An issue was discovered in seeyonOA version 8, allows remote attackers to execute arbitrary code via the importProcess method in WorkFlowDesignerController.class component.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-04-02T00:00:00.000Z
CVE-2024-29278 
funboot v1.1 is vulnerable to Cross Site Scripting (XSS) via the title field in "create a message ."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-03-30T00:00:00.000Z
CVE-2024-29291 
An issue in Laravel Framework 8 through 11 might allow a remote attacker to discover database credentials in storage/logs/laravel.log. NOTE: this is disputed by multiple third parties because the owner of a Laravel Framework installation can choose to have debugging logs, but needs to set the access control appropriately for the type of data that may be logged.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-04-16T00:00:00.000Z
CVE-2024-29292 
Multiple OS Command Injection vulnerabilities affecting Kasda LinkSmart Router KW6512 <= v1.3 enable an authenticated remote attacker to execute arbitrary OS commands via various cgi parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-11-20T00:00:00.000Z
CVE-2024-29296 
A user enumeration vulnerability was found in Portainer CE 2.19.4. This issue occurs during user authentication process, where a difference in response time could allow a remote unauthenticated user to determine if a username is valid or not.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-04-10T00:00:00.000Z
CVE-2024-29301 
SourceCodester PHP Task Management System 1.0 is vulnerable to SQL Injection via update-admin.php?admin_id=
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-03-25T00:00:00.000Z
CVE-2024-29302 
SourceCodester PHP Task Management System 1.0 is vulnerable to SQL Injection via update-employee.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-03-25T00:00:00.000Z
CVE-2024-29303 
The delete admin users function of SourceCodester PHP Task Management System 1.0 is vulnerable to SQL Injection
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-03-25T00:00:00.000Z
CVE-2024-29309 
An issue in Alfresco Content Services v.23.3.0.7 allows a remote attacker to execute arbitrary code via the Transfer Service.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-05-02T00:00:00.000Z
CVE-2024-29316 
NodeBB 3.6.7 is vulnerable to Incorrect Access Control, e.g., a low-privileged attacker can access the restricted tabs for the Admin group via "isadmin":true.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-03-28T00:00:00.000Z
CVE-2024-29318 
Volmarg Personal Management System 1.4.64 is vulnerable to stored cross site scripting (XSS) via upload of a SVG file with embedded javascript code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-07-05T00:00:00.000Z
CVE-2024-29319 
Volmarg Personal Management System 1.4.64 is vulnerable to SSRF (Server Side Request Forgery) via uploading a SVG file. The server can make unintended HTTP and DNS requests to a server that the attacker controls.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-07-05T00:00:00.000Z
CVE-2024-29320 
Wallos before 1.15.3 is vulnerable to SQL Injection via the category and payment parameters to /subscriptions/get.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-04-30T00:00:00.000Z
CVE-2024-29338 
Anchor CMS v0.12.7 was discovered to contain a Cross-Site Request Forgery (CSRF) via /anchor/admin/categories/delete/2.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-03-22T00:00:00.000Z
CVE-2024-29366 
A command injection vulnerability exists in the cgibin binary in DIR-845L router firmware <= v1.01KRb03.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-03-22T00:00:00.000Z
CVE-2024-29368 
An arbitrary file upload vulnerability in the file handling module of moziloCMS v2.0 allows attackers to bypass extension restrictions via file renaming, potentially leading to unauthorized file execution or storage of malicious content.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-04-22T00:00:00.000Z