rainbutterfly/cve_corpus huggingface dataset:
CVE-2023-24589 
Improper buffer restrictions in some Intel(R) Thunderbolt(TM) DCH drivers for Windows before version 88 may allow a privileged user to potentially enable escalation of privilege via local access.
Problem types: description: escalation of privilege
cwe_id: CWE-92
description: Improper buffer restrictions
Affected products: vendor: n/a
product: Intel(R) Thunderbolt(TM) DCH drivers for Windows
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 6.1
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:N/I:H/A:L
attackVector: LOCAL
attackComplexity: HIGH
privilegesRequired: HIGH
userInteraction: NONE
scope: CHANGED
confidentialityImpact: NONE
integrityImpact: HIGH
availabilityImpact: LOW
Published: 2024-02-14T13:37:42.926Z
CVE-2023-24590 



A format string issue in the Controller 6000's optional diagnostic web interface can be used to write/read from memory, and in some instances crash the Controller 6000 leading to a Denial of Service.

This issue affects: Gallagher Controller 6000 8.60 prior to vCR8.60.231116a (distributed in 8.60.2550 (MR7)), all versions of 8.50 and prior.




Problem types: cwe_id: CWE-134
description: CWE-134 Use of Externally-Controlled Format String
Affected products: vendor: Gallagher
product: Controller 6000
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Sebastian Toscano of Amazon Security
lang: en
value: Kevin Schaller of Amazon Security
Published: 2023-12-18T22:00:17.083Z
CVE-2023-24591 
Uncontrolled search path in some Intel(R) Binary Configuration Tool software before version 3.4.4 may allow an authenticated user to potentially enable escalation of privilege via local access.
Problem types: description: escalation of privilege
cwe_id: CWE-427
description: Uncontrolled search path
Affected products: vendor: n/a
product: Intel(R) Binary Configuration Tool software
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 6.7
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: HIGH
privilegesRequired: LOW
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
Published: 2024-02-14T13:38:10.995Z
CVE-2023-24592 
Path traversal in the some Intel(R) oneAPI Toolkits and Component software before version 2023.1 may allow authenticated user to potentially enable escalation of privilege via local access.
Problem types: description: escalation of privilege
cwe_id: CWE-22
description: Path traversal
Affected products: vendor: n/a
product: Intel(R) oneAPI Toolkits and Component software
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 7.3
baseSeverity: HIGH
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
Published: 2023-11-14T19:05:04.547Z
CVE-2023-24594 BIG-IP TMM SSL vulnerability

When an SSL profile is configured on a Virtual Server, undisclosed traffic can cause an increase in CPU or SSL accelerator resource utilization.  

Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Problem types: cwe_id: CWE-400
description: CWE-400 Uncontrolled Resource Consumption
Affected products: vendor: F5
product: BIG-IP
default_status: unknown
vendor: F5
product: BIG-IP SPK
default_status: unknown
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
version: 3.1
Credits: lang: en
value: F5
Published: 2023-05-03T14:31:16.883Z
CVE-2023-24595 
An OS command injection vulnerability exists in the ys_thirdparty system_user_script functionality of Milesight UR32L v32.3.0.5. A specially crafted series of network requests can lead to command execution. An attacker can send a sequence of requests to trigger this vulnerability.
Problem types: cwe_id: CWE-78
description: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected products: vendor: Milesight
product: UR32L
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: HIGH
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
baseScore: 7.2
baseSeverity: HIGH
Credits: lang: en
value: Discovered by Francesco Benvenuto of Cisco Talos.
Published: 2023-07-06T14:53:28.636Z
CVE-2023-24597 
OX App Suite before frontend 7.10.6-rev24 allows the loading (without user consent) of an e-mail message's remote resources during printing.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-05-29T00:00:00.000Z
CVE-2023-24598 
OX App Suite before backend 7.10.6-rev37 has an information leak in the handling of distribution lists, e.g., partial disclosure of the private contacts of another user.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-05-29T00:00:00.000Z
CVE-2023-24599 
OX App Suite before backend 7.10.6-rev37 allows authenticated users to change the appointments of arbitrary users via conflicting ID numbers, aka "ID confusion."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-05-29T00:00:00.000Z
CVE-2023-24600 
OX App Suite before backend 7.10.6-rev37 allows authenticated users to bypass access controls (for reading contacts) via a move to their own address book.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-05-29T00:00:00.000Z
CVE-2023-24601 
OX App Suite before frontend 7.10.6-rev24 allows XSS via a non-app deeplink such as the jslob API's registry sub-tree.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-05-29T00:00:00.000Z
CVE-2023-24602 
OX App Suite before frontend 7.10.6-rev24 allows XSS via data to the Tumblr portal widget, such as a post title.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-05-29T00:00:00.000Z
CVE-2023-24603 
OX App Suite before backend 7.10.6-rev37 does not check size limits when downloading, e.g., potentially allowing a crafted iCal feed to provide an unlimited amount of data.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-05-29T00:00:00.000Z
CVE-2023-24604 
OX App Suite before backend 7.10.6-rev37 does not check HTTP header lengths when downloading, e.g., potentially allowing a crafted iCal feed to provide an unlimited amount of header data.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-05-29T00:00:00.000Z
CVE-2023-24605 
OX App Suite before backend 7.10.6-rev37 does not enforce 2FA for all endpoints, e.g., reading from a drive, reading contact data, and renaming tokens.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-05-29T00:00:00.000Z
CVE-2023-24607 
Qt before 6.4.3 allows a denial of service via a crafted string when the SQL ODBC driver plugin is used and the size of SQLTCHAR is 4. The affected versions are 5.x before 5.15.13, 6.x before 6.2.8, and 6.3.x before 6.4.3.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-04-15T00:00:00.000Z
CVE-2023-24609 
Matrix SSL 4.x through 4.6.0 and Rambus TLS Toolkit have a length-subtraction integer overflow for Client Hello Pre-Shared Key extension parsing in the TLS 1.3 server. An attacked device calculates an SHA-2 hash over at least 65 KB (in RAM). With a large number of crafted TLS messages, the CPU becomes heavily loaded. This occurs in tls13VerifyBinder and tls13TranscriptHashUpdate.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-12-22T00:00:00.000Z
CVE-2023-24610 
NOSH 4a5cfdb allows remote authenticated users to execute PHP arbitrary code via the "practice logo" upload feature. The client-side checks can be bypassed. This may allow attackers to steal Protected Health Information because the product is for health charting.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-02-01T00:00:00.000Z
CVE-2023-24612 
The PdfBook extension through 2.0.5 before b07b6a64 for MediaWiki allows command injection via an option.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-01-30T00:00:00.000Z
CVE-2023-24613 
The user interface of Array Networks AG Series and vxAG through 9.4.0.470 could allow a remote attacker to use the gdb tool to overwrite the backend function call stack after accessing the system with administrator privileges. A successful exploit could leverage this vulnerability in the backend binary file that handles the user interface to a cause denial of service attack. This is fixed in AG 9.4.0.481.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-02-03T00:00:00.000Z
CVE-2023-24619 
Redpanda before 22.3.12 discloses cleartext AWS credentials. The import functionality in the rpk binary logs an AWS Access Key ID and Secret in cleartext to standard output, allowing a local user to view the key in the console, or in Kubernetes logs if stdout output is collected. The fixed versions are 22.3.12, 22.2.10, and 22.1.12.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-02-13T00:00:00.000Z
CVE-2023-24620 
An issue was discovered in Esoteric YamlBeans through 1.15. A crafted YAML document is able perform am XML Entity Expansion attack against YamlBeans YamlReader. By exploiting the Anchor feature in YAML, it is possible to generate a small YAML document that, when read, is expanded to a large size, causing CPU and memory consumption, such as a Java Out-of-Memory exception.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-08-25T00:00:00.000Z
CVE-2023-24621 
An issue was discovered in Esoteric YamlBeans through 1.15. It allows untrusted deserialisation to Java classes by default, where the data and class are controlled by the author of the YAML document being processed.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-08-25T00:00:00.000Z
CVE-2023-24622 
isInList in the safeurl-python package before 1.2 for Python has an insufficiently restrictive regular expression for external domains, leading to SSRF.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-01-30T00:00:00.000Z
CVE-2023-24623 
Paranoidhttp before 0.3.0 allows SSRF because [::] is equivalent to the 127.0.0.1 address, but does not match the filter for private addresses.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-01-30T00:00:00.000Z
CVE-2023-24625 
Faveo 5.0.1 allows remote attackers to obtain sensitive information via a modified user ID in an Insecure Direct Object Reference (IDOR) attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-03-24T00:00:00.000Z
CVE-2023-24626 
socket.c in GNU Screen through 4.9.0, when installed setuid or setgid (the default on platforms such as Arch Linux and FreeBSD), allows local users to send a privileged SIGHUP signal to any PID, causing a denial of service or disruption of the target process.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-04-08T00:00:00.000Z
CVE-2023-24641 
Judging Management System v1.0 was discovered to contain a SQL injection vulnerability via the sid parameter at /php-jms/updateview.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-03-03T00:00:00.000Z
CVE-2023-24642 
Judging Management System v1.0 was discovered to contain a SQL injection vulnerability via the sid parameter at /php-jms/updateTxtview.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-03-03T00:00:00.000Z
CVE-2023-24643 
Judging Management System v1.0 was discovered to contain a SQL injection vulnerability via the sid parameter at /php-jms/updateBlankTxtview.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-03-03T00:00:00.000Z
CVE-2023-24646 
An arbitrary file upload vulnerability in the component /fos/admin/ajax.php of Food Ordering System v2.0 allows attackers to execute arbitrary code via a crafted PHP file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-02-13T00:00:00.000Z
CVE-2023-24647 
Food Ordering System v2.0 was discovered to contain a SQL injection vulnerability via the email parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-02-13T00:00:00.000Z
CVE-2023-24648 
Zstore v6.6.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the component /index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-02-13T00:00:00.000Z
CVE-2023-24651 
Simple Customer Relationship Management System v1.0 was discovered to contain a SQL injection vulnerability via the name parameter on the registration page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-02-27T00:00:00.000Z
CVE-2023-24652 
Simple Customer Relationship Management System v1.0 was discovered to contain a SQL injection vulnerability via the Description parameter under the Create ticket function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-02-27T00:00:00.000Z
CVE-2023-24653 
Simple Customer Relationship Management System v1.0 was discovered to contain a SQL injection vulnerability via the oldpass parameter under the Change Password function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-02-27T00:00:00.000Z
CVE-2023-24654 
Simple Customer Relationship Management System v1.0 was discovered to contain a SQL injection vulnerability via the name parameter under the Request a Quote function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-02-27T00:00:00.000Z
CVE-2023-24655 
Simple Customer Relationship Management System v1.0 was discovered to contain a SQL injection vulnerability via the name parameter under the Profile Update function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-03-23T00:00:00.000Z
CVE-2023-24656 
Simple Customer Relationship Management System v1.0 was discovered to contain a SQL injection vulnerability via the subject parameter under the Create Ticket function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-02-27T00:00:00.000Z
CVE-2023-24657 
phpipam v1.6 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the closeClass parameter at /subnet-masks/popup.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-03-08T00:00:00.000Z
CVE-2023-24671 
VX Search v13.8 and v14.7 was discovered to contain an unquoted service path vulnerability which allows attackers to execute arbitrary commands at elevated privileges via a crafted executable file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-03-16T00:00:00.000Z
CVE-2023-24674 
Permissions vulnerability found in Bludit CMS v.4.0.0 allows local attackers to escalate privileges via the role:admin parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-09-01T00:00:00.000Z
CVE-2023-24675 
Cross Site Scripting Vulnerability in BluditCMS v.3.14.1 allows attackers to execute arbitrary code via the Categories Friendly URL.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-09-01T00:00:00.000Z
CVE-2023-24676 
An issue found in ProcessWire 3.0.210 allows attackers to execute arbitrary code and install a reverse shell via the download_zip_url parameter when installing a new module. NOTE: this is disputed because exploitation requires that the attacker is able to enter requests as an admin; however, a ProcessWire admin is intentionally allowed to install any module that contains any arbitrary code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-01-24T00:00:00.000Z
CVE-2023-24678 
A vulnerability in Centralite Pearl Thermostat 0x04075010 allows attackers to cause a Denial of Service (DoS) via a crafted Zigbee message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-03-17T00:00:00.000Z
CVE-2023-24684 
ChurchCRM v4.5.3 and below was discovered to contain a SQL injection vulnerability via the EID parameter at GetText.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-02-09T00:00:00.000Z
CVE-2023-24685 
ChurchCRM v4.5.3 and below was discovered to contain a SQL injection vulnerability via the Event parameter under the Event Attendance reports module.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-02-09T00:00:00.000Z
CVE-2023-24686 
An issue in the CSV Import function of ChurchCRM v4.5.3 and below allows attackers to execute arbitrary code via importing a crafted CSV file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-02-09T00:00:00.000Z
CVE-2023-24687 
Mojoportal v2.7.0.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the Company Info Settings component. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the txtCompanyName parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-02-09T00:00:00.000Z
CVE-2023-24688 
An issue in Mojoportal v2.7.0.0 allows an unauthenticated attacker to register a new user even if the Allow User Registrations feature is disabled.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-02-09T00:00:00.000Z
CVE-2023-24689 
An issue in Mojoportal v2.7.0.0 and below allows an authenticated attacker to list all css files inside the root path of the webserver via manipulation of the "s" parameter in /DesignTools/ManageSkin.aspx
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-02-09T00:00:00.000Z
CVE-2023-24690 
ChurchCRM 4.5.3 and below was discovered to contain a stored cross-site scripting (XSS) vulnerability at /api/public/register/family.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-02-09T00:00:00.000Z
CVE-2023-24698 
Insufficient parameter validation in the Foswiki::Sandbox component of Foswiki v2.1.7 and below allows attackers to perform a directory traversal via supplying a crafted web request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-08-08T00:00:00.000Z
CVE-2023-24709 
An issue found in Paradox Security Systems IPR512 allows attackers to cause a denial of service via the login.html and login.xml parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-03-21T00:00:00.000Z
CVE-2023-24720 
An arbitrary file upload vulnerability in readium-js v0.32.0 allows attackers to execute arbitrary code via uploading a crafted EPUB file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-04-05T00:00:00.000Z
CVE-2023-24721 
A cross-site scripting (XSS) vulnerability in LiveAction LiveSP v21.1.2 allows attackers to execute arbitrary web scripts or HTML.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-04-10T00:00:00.000Z
CVE-2023-24724 
A stored cross site scripting (XSS) vulnerability was discovered in the user management module of the SAS 9.4 Admin Console, due to insufficient validation and sanitization of data input into the user creation and editing form fields. The product name is SAS Web Administration interface (SASAdmin). For the product release, the reported version is 9.4_M2 and the fixed version is 9.4_M3. For the SAS release, the reported version is 9.4 TS1M2 and the fixed version is 9.4 TS1M3.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-04-03T00:00:00.000Z
CVE-2023-24726 
Art Gallery Management System v1.0 was discovered to contain a SQL injection vulnerability via the viewid parameter on the enquiry page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-03-15T00:00:00.000Z
CVE-2023-24728 
Simple Customer Relationship Management System v1.0 as discovered to contain a SQL injection vulnerability via the contact parameter in the user profile update function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-03-15T00:00:00.000Z
CVE-2023-24729 
Simple Customer Relationship Management System v1.0 as discovered to contain a SQL injection vulnerability via the address parameter in the user profile update function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-03-15T00:00:00.000Z
CVE-2023-24730 
Simple Customer Relationship Management System v1.0 as discovered to contain a SQL injection vulnerability via the company parameter in the user profile update function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-03-15T00:00:00.000Z
CVE-2023-24731 
Simple Customer Relationship Management System v1.0 as discovered to contain a SQL injection vulnerability via the query parameter in the user profile update function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-03-15T00:00:00.000Z
CVE-2023-24732 
Simple Customer Relationship Management System v1.0 as discovered to contain a SQL injection vulnerability via the gender parameter in the user profile update function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-03-15T00:00:00.000Z
CVE-2023-24733 
PMB v7.4.6 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the query parameter at /admin/convert/export_z3950_new.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-03-06T00:00:00.000Z
CVE-2023-24734 
An arbitrary file upload vulnerability in the camera_upload.php component of PMB v7.4.6 allows attackers to execute arbitrary code via a crafted image file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-03-06T00:00:00.000Z
CVE-2023-24735 
PMB v7.4.6 was discovered to contain an open redirect vulnerability via the component /opac_css/pmb.php. This vulnerability allows attackers to redirect victim users to an external domain via a crafted URL.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-03-06T00:00:00.000Z
CVE-2023-24736 
PMB v7.4.6 was discovered to contain a remote code execution (RCE) vulnerability via the component /sauvegarde/restaure_act.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-03-06T00:00:00.000Z
CVE-2023-24737 
PMB v7.4.6 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the query parameter at /admin/convert/export_z3950.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-03-06T00:00:00.000Z