rainbutterfly/cve_corpus huggingface dataset:
CVE-2024-22808 
An issue in Tormach xsTECH CNC Router, PathPilot Controller v2.9.6 allows attackers to cause a Denial of Service (DoS) by disrupting the communication between the PathPilot controller and the CNC router via overwriting the card's name in the device memory.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-04-22T00:00:00.000Z
CVE-2024-22809 
Incorrect access control in Tormach xsTECH CNC Router, PathPilot Controller v2.9.6 allows attackers to access the G code's shared folder and view sensitive information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-04-22T00:00:00.000Z
CVE-2024-22811 
An issue in Tormach xsTECH CNC Router, PathPilot Controller v2.9.6 allows attackers to cause a Denial of Service (DoS) by disrupting the communication between the PathPilot controller and the CNC router via overwriting the Hostmot2 configuration cookie in the device memory.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-04-22T00:00:00.000Z
CVE-2024-22813 
An issue in Tormach xsTECH CNC Router, PathPilot Controller v2.9.6 allows attackers to overwrite the hardcoded IP address in the device memory, disrupting network connectivity between the router and the controller.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-04-22T00:00:00.000Z
CVE-2024-22815 
An issue in the communication protocol of Tormach xsTECH CNC Router, PathPilot Controller v2.9.6 allows attackers to cause a Denial of Service (DoS) via crafted commands.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-04-22T00:00:00.000Z
CVE-2024-22817 
FlyCms v1.0 contains a Cross-Site Request Forgery (CSRF) vulnerability via /system/email/email_conf_updagte
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-01-18T00:00:00.000Z
CVE-2024-22818 
FlyCms v1.0 contains a Cross-Site Request Forgery (CSRF) vulnerbility via /system/site/filterKeyword_save
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-01-18T00:00:00.000Z
CVE-2024-22819 
FlyCms v1.0 contains a Cross-Site Request Forgery (CSRF) vulnerability via /system/email/email_templets_update.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-01-18T00:00:00.000Z
CVE-2024-22824 
An issue in Timo v.2.0.3 allows a remote attacker to execute arbitrary code via the filetype restrictions in the UploadController.java component.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-02-20T00:00:00.000Z
CVE-2024-22830 
Anti-Cheat Expert's Windows kernel module "ACE-BASE.sys" version 1.0.2202.6217 does not perform proper access control when handling system resources. This allows a local attacker to escalate privileges from regular user to System or PPL level.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-05-01T00:00:00.000Z
CVE-2024-22836 
An OS command injection vulnerability exists in Akaunting v3.1.3 and earlier. An attacker can manipulate the company locale when installing an app to execute system commands on the hosting server.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-02-08T00:00:00.000Z
CVE-2024-22851 
Directory Traversal Vulnerability in LiveConfig before v.2.5.2 allows a remote attacker to obtain sensitive information via a crafted request to the /static/ endpoint.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-02-02T00:00:00.000Z
CVE-2024-22852 
D-Link Go-RT-AC750 GORTAC750_A1_FW_v101b03 contains a stack-based buffer overflow via the function genacgi_main. This vulnerability allows attackers to enable telnet service via a specially crafted payload.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-02-06T00:00:00.000Z
CVE-2024-22853 
D-LINK Go-RT-AC750 GORTAC750_A1_FW_v101b03 has a hardcoded password for the Alphanetworks account, which allows remote attackers to obtain root access via a telnet session.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-02-06T00:00:00.000Z
CVE-2024-22854 
DOM-based HTML injection vulnerability in the main page of Darktrace Threat Visualizer version 6.1.27 (bundle version 61050) and before has been identified. A URL, crafted by a remote attacker and visited by an authenticated user, allows open redirect and potential credential stealing using an injected HTML form.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-02-16T00:00:00.000Z
CVE-2024-22855 
A cross-site scripting (XSS) vulnerability in the User Maintenance section of ITSS iMLog v1.307 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Last Name parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-06-12T00:00:00.000Z
CVE-2024-22856 
A SQL injection vulnerability via the Save Favorite Search function in Axefinance Axe Credit Portal >= v.3.0 allows authenticated attackers to execute unintended queries and disclose sensitive information from DB tables via crafted requests.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-04-22T00:00:00.000Z
CVE-2024-22857 
Heap based buffer flow in zlog v1.1.0 to v1.2.17 in zlog_rule_new().The size of record_name is MAXLEN_PATH(1024) + 1 but file_path may have data upto MAXLEN_CFG_LINE(MAXLEN_PATH*4) + 1. So a check was missing in zlog_rule_new() while copying the record_name from file_path + 1 which caused the buffer overflow. An attacker can exploit this vulnerability to overwrite the zlog_record_fn record_func function pointer to get arbitrary code execution or potentially cause remote code execution (RCE).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-03-07T00:00:00.000Z
CVE-2024-22859 
Cross-Site Request Forgery (CSRF) vulnerability in livewire before v3.0.4, allows remote attackers to execute arbitrary code getCsrfToken function. NOTE: the vendor disputes this because the 5d88731 commit fixes a usability problem (HTTP 419 status codes for legitimate client activity), not a security problem.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-02-01T00:00:00.000Z
CVE-2024-22860 
Integer overflow vulnerability in FFmpeg before n6.1, allows remote attackers to execute arbitrary code via the jpegxl_anim_read_packet component in the JPEG XL Animation decoder.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-01-27T00:00:00.000Z
CVE-2024-22861 
Integer overflow vulnerability in FFmpeg before n6.1, allows attackers to cause a denial of service (DoS) via the avcodec/osq module.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-01-27T00:00:00.000Z
CVE-2024-22862 
Integer overflow vulnerability in FFmpeg before n6.1, allows remote attackers to execute arbitrary code via the JJPEG XL Parser.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-01-27T00:00:00.000Z
CVE-2024-22871 
An issue in Clojure versions 1.20 to 1.12.0-alpha5 allows an attacker to cause a denial of service (DoS) via the clojure.core$partial$fn__5920 function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-02-29T00:00:00.000Z
CVE-2024-22873 
Tencent Blueking CMDB v3.2.x to v3.9.x was discovered to contain a Server-Side Request Forgery (SSRF) via the event subscription function (/service/subscription.go). This vulnerability allows attackers to access internal requests via a crafted POST request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-02-26T00:00:00.000Z
CVE-2024-22876 
StrangeBee TheHive 5.1.0 to 5.1.9 and 5.2.0 to 5.2.8 is vulnerable to Cross Site Scripting (XSS) in the case attachment functionality which enables an attacker to upload a malicious HTML file with Javascript code that will be executed in the context of the The Hive application using a specific URL. The vulnerability can be used to coerce a victim account to perform specific actions on the application as helping an analyst becoming administrator.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-01-19T00:00:00.000Z
CVE-2024-22877 
StrangeBee TheHive 5.2.0 to 5.2.8 is vulnerable to Cross Site Scripting (XSS) in the case reporting functionality. This feature allows an attacker to insert malicious JavaScript code inside the template or its variables, that will be executed in the context of the TheHive application when the HTML report is opened.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-01-19T00:00:00.000Z
CVE-2024-22880 
Cross Site Scripting vulnerability in Zadarma Zadarma extension v.1.0.11 allows a remote attacker to execute a arbitrary code via a crafted script to the webchat component.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-03-13T00:00:00.000Z
CVE-2024-22889 
Due to incorrect access control in Plone version v6.0.9, remote attackers can view and list all files hosted on the website via sending a crafted request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-03-05T00:00:00.000Z
CVE-2024-22891 
Nteract v.0.28.0 was discovered to contain a remote code execution (RCE) vulnerability via the Markdown link.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-03-01T00:00:00.000Z
CVE-2024-22892 
OpenSlides 4.0.15 was discovered to be using a weak hashing algorithm to store passwords.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-09-25T00:00:00.000Z
CVE-2024-22893 
OpenSlides 4.0.15 verifies passwords by comparing password hashes using a function with content-dependent runtime. This can allow attackers to obtain information about the password hash using a timing attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-09-25T00:00:00.000Z
CVE-2024-22894 
An issue fixed in AIT-Deutschland Alpha Innotec Heatpumps V2.88.3 or later, V3.89.0 or later, V4.81.3 or later and Novelan Heatpumps V2.88.3 or later, V3.89.0 or later, V4.81.3 or later, allows remote attackers to execute arbitrary code via the password component in the shadow file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-01-30T00:00:00.000Z
CVE-2024-22895 
DedeCMS 5.7.112 has a File Upload vulnerability via uploads/dede/module_upload.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-01-22T00:00:00.000Z
CVE-2024-22899 
Vinchin Backup & Recovery v7.2 was discovered to contain an authenticated remote code execution (RCE) vulnerability via the syncNtpTime function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-02-02T00:00:00.000Z
CVE-2024-22900 
Vinchin Backup & Recovery v7.2 was discovered to contain an authenticated remote code execution (RCE) vulnerability via the setNetworkCardInfo function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-02-02T00:00:00.000Z
CVE-2024-22901 
Vinchin Backup & Recovery v7.2 was discovered to use default MYSQL credentials.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-02-02T00:00:00.000Z
CVE-2024-22902 
Vinchin Backup & Recovery v7.2 was discovered to be configured with default root credentials.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-02-02T00:00:00.000Z
CVE-2024-22903 
Vinchin Backup & Recovery v7.2 was discovered to contain an authenticated remote code execution (RCE) vulnerability via the deleteUpdateAPK function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-02-02T00:00:00.000Z
CVE-2024-22905 
Buffer Overflow vulnerability in ARM mbed-os v.6.17.0 allows a remote attacker to execute arbitrary code via a crafted script to the hciTrSerialRxIncoming function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-04-19T00:00:00.000Z
CVE-2024-22910 
Cross Site Scripting (XSS) vulnerability in CrushFTP v.10.6.0 and v.10.5.5 allows an attacker to execute arbitrary code via a crafted payload.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-05-09T18:29:05.380Z
CVE-2024-22911 
A stack-buffer-underflow vulnerability was found in SWFTools v0.9.2, in the function parseExpression at src/swfc.c:2602.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-01-19T00:00:00.000Z
CVE-2024-22912 
A global-buffer-overflow was found in SWFTools v0.9.2, in the function countline at swf5compiler.flex:327. It allows an attacker to cause code execution.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-01-19T00:00:00.000Z
CVE-2024-22913 
A heap-buffer-overflow was found in SWFTools v0.9.2, in the function swf5lex at lex.swf5.c:1321. It allows an attacker to cause code execution.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-01-19T00:00:00.000Z
CVE-2024-22914 
A heap-use-after-free was found in SWFTools v0.9.2, in the function input at lex.swf5.c:2620. It allows an attacker to cause denial of service.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-01-19T00:00:00.000Z
CVE-2024-22915 
A heap-use-after-free was found in SWFTools v0.9.2, in the function swf_DeleteTag at rfxswf.c:1193. It allows an attacker to cause code execution.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-01-19T00:00:00.000Z
CVE-2024-22916 
In D-LINK Go-RT-AC750 v101b03, the sprintf function in the sub_40E700 function within the cgibin is susceptible to stack overflow.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-01-16T00:00:00.000Z
CVE-2024-22917 
SQL injection vulnerability in Dynamic Lab Management System Project in PHP v.1.0 allows a remote attacker to execute arbitrary code via a crafted script.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-02-27T00:00:00.000Z
CVE-2024-22919 
swftools0.9.2 was discovered to contain a global-buffer-overflow vulnerability via the function parseExpression at swftools/src/swfc.c:2587.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-01-19T00:00:00.000Z
CVE-2024-22920 
swftools 0.9.2 was discovered to contain a heap-use-after-free via the function bufferWriteData in swftools/lib/action/compile.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-01-19T00:00:00.000Z
CVE-2024-22922 
An issue in Projectworlds Vistor Management Systemin PHP v.1.0 allows a remtoe attacker to escalate privileges via a crafted script to the login page in the POST/index.php
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-01-25T00:00:00.000Z
CVE-2024-22923 
SQL injection vulnerability in adv radius v.2.2.5 allows a local attacker to execute arbitrary code via a crafted script.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-02-13T00:00:00.000Z
CVE-2024-22927 
Cross Site Scripting (XSS) vulnerability in the func parameter in eyoucms v.1.6.5 allows a remote attacker to run arbitrary code via crafted URL.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-02-01T00:00:00.000Z
CVE-2024-22936 
Cross-site scripting (XSS) vulnerability in Parents & Student Portal in Genesis School Management Systems in Genesis AIMS Student Information Systems v.3053 allows remote attackers to inject arbitrary web script or HTML via the message parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-02-01T00:00:00.000Z
CVE-2024-22938 
Insecure Permissions vulnerability in BossCMS v.1.3.0 allows a local attacker to execute arbitrary code and escalate privileges via the init function in admin.class.php component.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-01-30T00:00:00.000Z
CVE-2024-22939 
Cross Site Request Forgery vulnerability in FlyCms v.1.0 allows a remote attacker to execute arbitrary code via the system/article/category_edit component.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-02-01T00:00:00.000Z
CVE-2024-22942 
TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the hostName parameter in the setWanCfg function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-01-11T00:00:00.000Z
CVE-2024-22949 
JFreeChart v1.5.4 was discovered to contain a NullPointerException via the component /chart/annotations/CategoryLineAnnotation. NOTE: this is disputed by multiple third parties who believe there was not reasonable evidence to determine the existence of a vulnerability. The submission may have been based on a tool that is not sufficiently robust for vulnerability identification.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-04-08T00:00:00.000Z
CVE-2024-22955 
swftools 0.9.2 was discovered to contain a stack-buffer-underflow vulnerability via the function parseExpression at swftools/src/swfc.c:2576.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-01-19T00:00:00.000Z
CVE-2024-22956 
swftools 0.9.2 was discovered to contain a heap-use-after-free vulnerability via the function removeFromTo at swftools/src/swfc.c:838
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-01-19T00:00:00.000Z
CVE-2024-22957 
swftools 0.9.2 was discovered to contain an Out-of-bounds Read vulnerability via the function dict_do_lookup in swftools/lib/q.c:1190.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-01-19T00:00:00.000Z
CVE-2024-22983 
SQL injection vulnerability in Projectworlds Visitor Management System in PHP v.1.0 allows a remote attacker to escalate privileges via the name parameter in the myform.php endpoint.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-02-28T00:00:00.000Z
CVE-2024-22988 
ZKteco ZKBio WDMS before 9.0.2 Build 20250526 allows an attacker to download a database backup via the /files/backup/ component because the filename is based on a predictable timestamp.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-02-23T00:00:00.000Z
CVE-2024-23031 
Cross Site Scripting (XSS) vulnerability in is_water parameter in eyoucms v.1.6.5 allows a remote attacker to run arbitrary code via crafted URL.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-02-01T00:00:00.000Z
CVE-2024-23032 
Cross Site Scripting vulnerability in num parameter in eyoucms v.1.6.5 allows a remote attacker to run arbitrary code via crafted URL.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-02-01T00:00:00.000Z
CVE-2024-23033 
Cross Site Scripting vulnerability in the path parameter in eyoucms v.1.6.5 allows a remote attacker to run arbitrary code via crafted URL.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-02-01T00:00:00.000Z
CVE-2024-23034 
Cross Site Scripting vulnerability in the input parameter in eyoucms v.1.6.5 allows a remote attacker to run arbitrary code via crafted URL.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-02-01T00:00:00.000Z
CVE-2024-23049 
An issue in symphony v.3.6.3 and before allows a remote attacker to execute arbitrary code via the log4j component.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-02-05T00:00:00.000Z
CVE-2024-23052 
An issue in WuKongOpenSource WukongCRM v.72crm_9.0.1_20191202 allows a remote attacker to execute arbitrary code via the parseObject() function in the fastjson component.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-02-01T00:00:00.000Z
CVE-2024-23054 
An issue in Plone Docker Official Image 5.2.13 (5221) open-source software that could allow for remote code execution due to a package listed in ++plone++static/components not existing in the public package index (npm).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-02-05T00:00:00.000Z
CVE-2024-23055 
An issue in Plone Docker Official Image 5.2.13 (5221) open-source software allows for remote code execution via improper validation of input by the HOST headers.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-01-25T00:00:00.000Z
CVE-2024-23057 
TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the tz parameter in the setNtpCfg function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-01-11T00:00:00.000Z
CVE-2024-23058 
TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the pass parameter in the setTr069Cfg function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-01-11T00:00:00.000Z
CVE-2024-23059 
TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the username parameter in the setDdnsCfg function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-01-11T00:00:00.000Z
CVE-2024-23060 
TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the ip parameter in the setDmzCfg function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-01-11T00:00:00.000Z
CVE-2024-23061 
TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the minute parameter in the setScheduleCfg function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-01-11T00:00:00.000Z
CVE-2024-23076 
JFreeChart v1.5.4 was discovered to contain a NullPointerException via the component /labels/BubbleXYItemLabelGenerator.java. NOTE: this is disputed by multiple third parties who believe there was not reasonable evidence to determine the existence of a vulnerability. The submission may have been based on a tool that is not sufficiently robust for vulnerability identification.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-04-10T00:00:00.000Z
CVE-2024-23077 
JFreeChart v1.5.4 was discovered to be vulnerable to ArrayIndexOutOfBounds via the component /chart/plot/CompassPlot.java. NOTE: this is disputed by multiple third parties who believe there was not reasonable evidence to determine the existence of a vulnerability. The submission may have been based on a tool that is not sufficiently robust for vulnerability identification.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-04-10T00:00:00.000Z