rainbutterfly/cve_corpus huggingface dataset:
CVE-2024-36510 
An observable response discrepancy vulnerability [CWE-204] in FortiClientEMS 7.4.0, 7.2.0 through 7.2.4, 7.0 all versions, and FortiSOAR 7.5.0, 7.4.0 through 7.4.4, 7.3.0 through 7.3.2, 7.2 all versions, 7.0 all versions, 6.4 all versions may allow an unauthenticated attacker to enumerate valid users via observing login request responses.
Problem types: cwe_id: CWE-204
description: Information disclosure
Affected products: vendor: Fortinet
product: FortiClientEMS
default_status: unaffected
vendor: Fortinet
product: FortiSOAR
cpes: cpe:2.3:a:fortinet:fortisoar:7.5.0:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortisoar:7.4.4:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortisoar:7.4.3:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortisoar:7.4.2:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortisoar:7.4.1:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortisoar:7.4.0:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortisoar:7.3.2:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortisoar:7.3.1:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortisoar:7.3.0:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortisoar:7.2.2:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortisoar:7.2.1:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortisoar:7.2.0:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortisoar:7.0.3:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortisoar:7.0.2:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortisoar:7.0.1:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortisoar:7.0.0:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortisoar:6.4.4:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortisoar:6.4.3:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortisoar:6.4.1:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortisoar:6.4.0:*:*:*:*:*:*:*
default_status: unaffected
CVSS v3.1: version: 3.1
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.9
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:U/RL:X/RC:X
Published: 2025-01-14T14:09:49.286Z
CVE-2024-36511 
An improperly implemented security check for standard vulnerability [CWE-358] in FortiADC Web Application Firewall (WAF) 7.4.0 through 7.4.4, 7.2 all versions, 7.1 all versions, 7.0 all versions, 6.2 all versions, 6.1 all versions, 6.0 all versions when cookie security policy is enabled may allow an attacker, under specific conditions, to retrieve the initial encrypted and signed cookie protected by the feature
Problem types: cwe_id: CWE-358
description: Information disclosure
Affected products: vendor: Fortinet
product: FortiADC
cpes: cpe:2.3:h:fortinet:fortiadc:7.4.4:*:*:*:*:*:*:*
cpe:2.3:h:fortinet:fortiadc:7.4.3:*:*:*:*:*:*:*
cpe:2.3:h:fortinet:fortiadc:7.4.2:*:*:*:*:*:*:*
cpe:2.3:h:fortinet:fortiadc:7.4.1:*:*:*:*:*:*:*
cpe:2.3:h:fortinet:fortiadc:7.4.0:*:*:*:*:*:*:*
cpe:2.3:h:fortinet:fortiadc:7.2.7:*:*:*:*:*:*:*
cpe:2.3:h:fortinet:fortiadc:7.2.6:*:*:*:*:*:*:*
cpe:2.3:h:fortinet:fortiadc:7.2.5:*:*:*:*:*:*:*
cpe:2.3:h:fortinet:fortiadc:7.2.4:*:*:*:*:*:*:*
cpe:2.3:h:fortinet:fortiadc:7.2.3:*:*:*:*:*:*:*
cpe:2.3:h:fortinet:fortiadc:7.2.2:*:*:*:*:*:*:*
cpe:2.3:h:fortinet:fortiadc:7.2.1:*:*:*:*:*:*:*
cpe:2.3:h:fortinet:fortiadc:7.2.0:*:*:*:*:*:*:*
cpe:2.3:h:fortinet:fortiadc:7.1.4:*:*:*:*:*:*:*
cpe:2.3:h:fortinet:fortiadc:7.1.3:*:*:*:*:*:*:*
cpe:2.3:h:fortinet:fortiadc:7.1.2:*:*:*:*:*:*:*
cpe:2.3:h:fortinet:fortiadc:7.1.1:*:*:*:*:*:*:*
cpe:2.3:h:fortinet:fortiadc:7.1.0:*:*:*:*:*:*:*
cpe:2.3:h:fortinet:fortiadc:7.0.5:*:*:*:*:*:*:*
cpe:2.3:h:fortinet:fortiadc:7.0.4:*:*:*:*:*:*:*
cpe:2.3:h:fortinet:fortiadc:7.0.3:*:*:*:*:*:*:*
cpe:2.3:h:fortinet:fortiadc:7.0.2:*:*:*:*:*:*:*
cpe:2.3:h:fortinet:fortiadc:7.0.1:*:*:*:*:*:*:*
cpe:2.3:h:fortinet:fortiadc:7.0.0:*:*:*:*:*:*:*
cpe:2.3:h:fortinet:fortiadc:6.2.6:*:*:*:*:*:*:*
cpe:2.3:h:fortinet:fortiadc:6.2.5:*:*:*:*:*:*:*
cpe:2.3:h:fortinet:fortiadc:6.2.4:*:*:*:*:*:*:*
cpe:2.3:h:fortinet:fortiadc:6.2.3:*:*:*:*:*:*:*
cpe:2.3:h:fortinet:fortiadc:6.2.2:*:*:*:*:*:*:*
cpe:2.3:h:fortinet:fortiadc:6.2.1:*:*:*:*:*:*:*
cpe:2.3:h:fortinet:fortiadc:6.2.0:*:*:*:*:*:*:*
cpe:2.3:h:fortinet:fortiadc:6.1.6:*:*:*:*:*:*:*
cpe:2.3:h:fortinet:fortiadc:6.1.5:*:*:*:*:*:*:*
cpe:2.3:h:fortinet:fortiadc:6.1.4:*:*:*:*:*:*:*
cpe:2.3:h:fortinet:fortiadc:6.1.3:*:*:*:*:*:*:*
cpe:2.3:h:fortinet:fortiadc:6.1.2:*:*:*:*:*:*:*
cpe:2.3:h:fortinet:fortiadc:6.1.1:*:*:*:*:*:*:*
cpe:2.3:h:fortinet:fortiadc:6.1.0:*:*:*:*:*:*:*
cpe:2.3:h:fortinet:fortiadc:6.0.4:*:*:*:*:*:*:*
cpe:2.3:h:fortinet:fortiadc:6.0.3:*:*:*:*:*:*:*
cpe:2.3:h:fortinet:fortiadc:6.0.2:*:*:*:*:*:*:*
cpe:2.3:h:fortinet:fortiadc:6.0.1:*:*:*:*:*:*:*
cpe:2.3:h:fortinet:fortiadc:6.0.0:*:*:*:*:*:*:*
default_status: unaffected
CVSS v3.1: version: 3.1
attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 3.4
baseSeverity: LOW
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:U/RC:R
Published: 2024-09-10T14:37:47.230Z
CVE-2024-36513 
A privilege context switching error vulnerability [CWE-270] in FortiClient Windows version 7.2.4 and below, version 7.0.12 and below, 6.4 all versions may allow an authenticated user to escalate their privileges via lua auto patch scripts.
Problem types: cwe_id: CWE-270
description: Escalation of privilege
Affected products: vendor: Fortinet
product: FortiClientWindows
default_status: unaffected
CVSS v3.1: version: 3.1
attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.4
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H/E:P/RL:T/RC:C
Published: 2024-11-12T18:53:41.455Z
CVE-2024-36514 SQL Injection
Zohocorp ManageEngine ADAudit Plus versions below 8000 are vulnerable to the authenticated SQL injection in file summary option.
Problem types: cwe_id: CWE-89
description: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: ManageEngine
product: ADAudit Plus
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 8.3
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L
version: 3.1
Published: 2024-08-23T13:37:56.318Z
CVE-2024-36515 SQL Injection
Zohocorp ManageEngine ADAudit Plus versions below 8000 are vulnerable to the authenticated SQL injection in dashboard.
Note: This vulnerability is different from another vulnerability (CVE-2024-36516), both of which have affected ADAudit Plus' dashboard.
Problem types: cwe_id: CWE-89
description: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: ManageEngine
product: ADAudit Plus
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 8.3
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L
version: 3.1
Published: 2024-08-23T13:37:02.810Z
CVE-2024-36516 SQL Injection
Zohocorp ManageEngine ADAudit Plus versions below 8000 are vulnerable to the authenticated SQL injection in dashboard.
Note: This vulnerability is different from another vulnerability (CVE-2024-36515), both of which have affected ADAudit Plus' dashboard.
Problem types: cwe_id: CWE-89
description: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: ManageEngine
product: ADAudit Plus
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 8.3
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L
version: 3.1
Published: 2024-08-23T13:36:05.237Z
CVE-2024-36517 SQL Injection
Zohocorp ManageEngine ADAudit Plus versions below 8000 are vulnerable to the authenticated SQL injection in alerts module.
Problem types: cwe_id: CWE-89
description: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: ManageEngine
product: ADAudit Plus
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 8.3
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L
version: 3.1
Published: 2024-08-23T13:34:01.453Z
CVE-2024-36518 SQL Injection
Zohocorp ManageEngine ADAudit Plus versions below 8110 are vulnerable to authenticated SQL Injection in attack surface analyzer's dashboard.
Problem types: cwe_id: CWE-89
description: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: ManageEngine
product: ADAudit Plus
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 8.3
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L
version: 3.1
Published: 2024-08-12T07:13:49.843Z
CVE-2024-36522 Apache Wicket: Remote code execution via XSLT injection
The default configuration of XSLTResourceStream.java is vulnerable to remote code execution via XSLT injection when processing input from an untrusted source without validation.
Users are recommended to upgrade to versions 10.1.0, 9.18.0 or 8.16.0, which fix this issue.
Problem types: cwe_id: CWE-74
description: CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
Affected products: vendor: Apache Software Foundation
product: Apache Wicket
default_status: unaffected
Credits: lang: en
value: cigar
Published: 2024-07-12T12:13:51.884Z
CVE-2024-36523 
An access control issue in Wvp GB28181 Pro 2.0 allows users to continue to access information in the application after deleting their own or administrator accounts. This is provided that the users do not log out of their deleted accounts.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-06-12T00:00:00.000Z
CVE-2024-36526 
ZKTeco ZKBio CVSecurity v6.1.1 was discovered to contain a hardcoded cryptographic key.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-07-09T00:00:00.000Z
CVE-2024-36527 
puppeteer-renderer v.3.2.0 and before is vulnerable to Directory Traversal. Attackers can exploit the URL parameter using the file protocol to read sensitive information from the server.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-06-17T00:00:00.000Z
CVE-2024-36528 
nukeviet v.4.5 and before and nukeviet-egov v.1.2.02 and before have a Deserialization vulnerability which results in code execution via /admin/extensions/download.php and /admin/extensions/upload.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-06-10T00:00:00.000Z
CVE-2024-36531 
nukeviet v.4.5 and before and nukeviet-egov v.1.2.02 and before are vulnerable to arbitrary code execution via the /admin/extensions/upload.php component.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-06-10T00:00:00.000Z
CVE-2024-36532 
Insecure permissions in kruise v1.6.2 allows attackers to access sensitive data and escalate privileges by obtaining the service account's token.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-06-21T00:00:00.000Z
CVE-2024-36533 
Insecure permissions in volcano v1.8.2 allows attackers to access sensitive data and escalate privileges by obtaining the service account's token.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-07-24T00:00:00.000Z
CVE-2024-36534 
Insecure permissions in hwameistor v0.14.3 allows attackers to access sensitive data and escalate privileges by obtaining the service account's token.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-07-24T00:00:00.000Z
CVE-2024-36535 
Insecure permissions in meshery v0.7.51 allows attackers to access sensitive data and escalate privileges by obtaining the service account's token.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-07-24T00:00:00.000Z
CVE-2024-36536 
Insecure permissions in fabedge v0.8.1 allows attackers to access sensitive data and escalate privileges by obtaining the service account's token.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-07-24T00:00:00.000Z
CVE-2024-36537 
Insecure permissions in cert-manager v1.14.4 allows attackers to access sensitive data and escalate privileges by obtaining the service account's token.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-07-24T00:00:00.000Z
CVE-2024-36538 
Insecure permissions in chaos-mesh v2.6.3 allows attackers to access sensitive data and escalate privileges by obtaining the service account's token.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-07-24T00:00:00.000Z
CVE-2024-36539 
Insecure permissions in contour v1.28.3 allows attackers to access sensitive data and escalate privileges by obtaining the service account's token.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-07-24T00:00:00.000Z
CVE-2024-36540 
Insecure permissions in external-secrets v0.9.16 allows attackers to access sensitive data and escalate privileges by obtaining the service account's token.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-07-24T00:00:00.000Z
CVE-2024-36541 
Insecure permissions in logging-operator v4.6.0 allows attackers to access sensitive data and escalate privileges by obtaining the service account's token.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-07-24T00:00:00.000Z
CVE-2024-36542 
Insecure permissions in kuma v2.7.0 allows attackers to access sensitive data and escalate privileges by obtaining the service account's token.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-07-25T00:00:00.000Z
CVE-2024-36543 
Incorrect access control in the Kafka Connect REST API in the STRIMZI Project 0.41.0 and earlier allows an attacker to deny the service for Kafka Mirroring, potentially mirror the topics' content to his Kafka cluster via a malicious connector (bypassing Kafka ACL if it exists), and potentially steal Kafka SASL credentials, by querying the MirrorMaker Kafka REST API.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-06-17T00:00:00.000Z
CVE-2024-36547 
idccms V1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component admin/vpsClass_deal.php?mudi=add
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-06-04T14:44:18.532Z
CVE-2024-36548 
idccms V1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via admin/vpsCompany_deal.php?mudi=del
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-06-04T14:45:52.245Z
CVE-2024-36549 
idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via /admin/vpsCompany_deal.php?mudi=rev&nohrefStr=close
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-06-04T14:47:09.634Z
CVE-2024-36550 
idccms V1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via /admin/vpsCompany_deal.php?mudi=add&nohrefStr=close
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-06-04T14:48:31.138Z
CVE-2024-36553 
Forever KidsWatch Call Me KW-50 R36_YDR_A3PW_GM7S_V1.0_2019_07_15_16.19.24_cob_h is vulnerable to MITM attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-02-06T00:00:00.000Z
CVE-2024-36554 
Forever KidsWatch Call Me KW-50 R36_YDR_A3PW_GM7S_V1.0_2019_07_15_16.19.24_cob_h and Forever KidsWatch Call Me KW-60 R36CW_YDE_S4_A29_2_V1.0_2023.05.24_22.49.44_cob_b allow a malicious user to gain information about the device by sending an SMS to the device which returns sensitive information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-02-06T00:00:00.000Z
CVE-2024-36555 
Built-in SMS-configuration command in Forever KidsWatch Call Me KW50 R36_YDR_A3PW_GM7S_V1.0_2019_07_15_16.19.24_cob_h and Forever KidsWatch Call Me 2 KW-60 R36CW_YDE_S4_A29_2_V1.0_2023.05.24_22.49.44_cob_b allows malicious users to change the device IMEI-number which allows for forging the identity of the device.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-02-06T00:00:00.000Z
CVE-2024-36556 
Forever KidsWatch Call Me KW50 R36_YDR_A3PW_GM7S_V1.0_2019_07_15_16.19.24_cob_h, and Forever KidsWatch Call Me 2 KW60 R36CW_YDE_S4_A29_2_V1.0_2023.05.24_22.49.44_cob_b have a Hardcoded password vulnerability.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-02-06T00:00:00.000Z
CVE-2024-36557 
The device ID is based on IMEI in Forever KidsWatch Call Me KW50 R36_YDR_A3PW_GM7S_V1.0_2019_07_15_16.19.24_cob_h and Forever KidsWatch Call Me 2 KW60 R36CW_YDE_S4_A29_2_V1.0_2023.05.24_22.49.44_cob_b. If a malicious user changes the IMEI to the IMEI of a unit they registered in the mobile app, it is possible to hijack the device and control it from the app.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-02-06T00:00:00.000Z
CVE-2024-36558 
Forever KidsWatch Call Me KW-50 R36_YDR_A3PW_GM7S_V1.0_2019_07_15_16.19.24_cob_h suffers from Cleartext Transmission of Sensitive Information due to lack of encryption in device-server communication.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-02-06T00:00:00.000Z
CVE-2024-36568 
Sourcecodester Gas Agency Management System v1.0 is vulnerable to SQL Injection via /gasmark/editbrand.php?id=.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-06-03T13:25:36.809Z
CVE-2024-36569 
Sourcecodester Gas Agency Management System v1.0 is vulnerable to arbitrary code execution via editClientImage.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-06-03T13:28:13.564Z
CVE-2024-36572 
Prototype pollution in allpro form-manager 0.7.4 allows attackers to run arbitrary code and cause other impacts via the functions setDefaults, mergeBranch, and Object.setObjectValue.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-07-30T00:00:00.000Z
CVE-2024-36573 
almela obx before v.0.0.4 has a Prototype Pollution issue which allows arbitrary code execution via the obx/build/index.js:656), reduce (@almela/obx/build/index.js:470), Object.set (obx/build/index.js:269) component.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-06-17T00:00:00.000Z
CVE-2024-36574 
A Prototype Pollution issue in flatten-json 1.0.1 allows an attacker to execute arbitrary code via module.exports.unflattenJSON (flatten-json/index.js:42)
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-06-17T00:00:00.000Z
CVE-2024-36575 
A Prototype Pollution issue in getsetprop 1.1.0 allows an attacker to execute arbitrary code via global.accessor.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-06-17T00:00:00.000Z
CVE-2024-36577 
apphp js-object-resolver < 3.1.1 is vulnerable to Prototype Pollution via Module.setNestedProperty.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-06-17T00:00:00.000Z
CVE-2024-36578 
akbr update 1.0.0 is vulnerable to Prototype Pollution via update/index.js.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-06-17T00:00:00.000Z
CVE-2024-36580 
A Prototype Pollution issue in cdr0 sg 1.0.10 allows an attacker to execute arbitrary code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-06-17T00:00:00.000Z
CVE-2024-36581 
A Prototype Pollution issue in abw badger-database 1.2.1 allows an attacker to execute arbitrary code via dist/badger-database.esm.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-06-17T00:00:00.000Z
CVE-2024-36582 
alexbinary object-deep-assign 1.0.11 is vulnerable to Prototype Pollution via the extend() method of Module.deepAssign (/src/index.js)
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-06-17T00:00:00.000Z
CVE-2024-36583 
A Prototype Pollution issue in byondreal accessor <= 1.0.0 allows an attacker to execute arbitrary code via @byondreal/accessor/index.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-06-17T00:00:00.000Z
CVE-2024-36586 
An issue in AdGuardHome v0.93 to latest allows unprivileged attackers to escalate privileges via overwriting the AdGuardHome binary.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-06-13T00:00:00.000Z
CVE-2024-36587 
Insecure permissions in DNSCrypt-proxy v2.0.0alpha9 to v2.1.5 allows non-privileged attackers to escalate privileges to root via overwriting the binary dnscrypt-proxy.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-06-13T00:00:00.000Z
CVE-2024-36588 
An issue in Annonshop.app DecentralizeJustice/ anonymousLocker commit 2b2b4 allows attackers to send messages erroneously attributed to arbitrary users via a crafted HTTP request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-06-13T00:00:00.000Z
CVE-2024-36589 
An issue in Annonshop.app DecentralizeJustice/anonymousLocker commit 2b2b4 to ba9fd and DecentralizeJustice/anonBackend commit 57837 to cd815 was discovered to store credentials in plaintext.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-06-13T00:00:00.000Z
CVE-2024-36597 
Aegon Life v1.0 was discovered to contain a SQL injection vulnerability via the client_id parameter at clientStatus.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-06-14T00:00:00.000Z
CVE-2024-36598 
An arbitrary file upload vulnerability in Aegon Life v1.0 allows attackers to execute arbitrary code via uploading a crafted image file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-06-14T00:00:00.000Z
CVE-2024-36599 
A cross-site scripting (XSS) vulnerability in Aegon Life v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the name parameter at insertClient.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-06-14T00:00:00.000Z
CVE-2024-36600 
Buffer Overflow Vulnerability in libcdio 2.2.0 (fixed in 2.3.0) allows an attacker to execute arbitrary code via a crafted ISO 9660 image file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-06-14T00:00:00.000Z
CVE-2024-36604 
Tenda O3V2 v1.0.0.12(3880) was discovered to contain a Blind Command Injection via stpEn parameter in the SetStp function. This vulnerability allows attackers to execute arbitrary commands with root privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-06-04T17:14:08.675Z