rainbutterfly/cve_corpus huggingface dataset:
CVE-2024-25436 
A cross-site scripting (XSS) vulnerability in the Production module of Pkp Ojs v3.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Input subject field under the Add Discussion function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-03-01T00:00:00.000Z
CVE-2024-25438 
A cross-site scripting (XSS) vulnerability in the Submission module of Pkp Ojs v3.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Input subject field under the Add Discussion function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-03-01T00:00:00.000Z
CVE-2024-25442 
An issue in the HuginBase::PanoramaMemento::loadPTScript function of Hugin v2022.0.0 allows attackers to cause a heap buffer overflow via parsing a crafted image.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-02-09T00:00:00.000Z
CVE-2024-25443 
An issue in the HuginBase::ImageVariable<double>::linkWith function of Hugin v2022.0.0 allows attackers to cause a heap-use-after-free via parsing a crafted image.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-02-09T00:00:00.000Z
CVE-2024-25445 
Improper handling of values in HuginBase::PTools::Transform::transform of Hugin 2022.0.0 leads to an assertion failure.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-02-09T00:00:00.000Z
CVE-2024-25446 
An issue in the HuginBase::PTools::setDestImage function of Hugin v2022.0.0 allows attackers to cause a heap buffer overflow via parsing a crafted image.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-02-09T00:00:00.000Z
CVE-2024-25447 
An issue in the imlib_load_image_with_error_return function of imlib2 v1.9.1 allows attackers to cause a heap buffer overflow via parsing a crafted image.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-02-09T00:00:00.000Z
CVE-2024-25448 
An issue in the imlib_free_image_and_decache function of imlib2 v1.9.1 allows attackers to cause a heap buffer overflow via parsing a crafted image.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-02-09T00:00:00.000Z
CVE-2024-25450 
imlib2 v1.9.1 was discovered to mishandle memory allocation in the function init_imlib_fonts().
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-02-09T00:00:00.000Z
CVE-2024-25451 
Bento4 v1.6.0-640 was discovered to contain an out-of-memory bug via the AP4_DataBuffer::ReallocateBuffer() function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-02-09T00:00:00.000Z
CVE-2024-25452 
Bento4 v1.6.0-640 was discovered to contain an out-of-memory bug via the AP4_UrlAtom::AP4_UrlAtom() function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-02-09T00:00:00.000Z
CVE-2024-25453 
Bento4 v1.6.0-640 was discovered to contain a NULL pointer dereference via the AP4_StszAtom::GetSampleSize() function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-02-09T00:00:00.000Z
CVE-2024-25454 
Bento4 v1.6.0-640 was discovered to contain a NULL pointer dereference via the AP4_DescriptorFinder::Test() function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-02-09T00:00:00.000Z
CVE-2024-25458 
An issue in CYCZCAM, SHIX ZHAO, SHIXCAM A9 Camera (circuit board identifier A9-48B-V1.0) firmware v.CYCAM_48B_BC01_v87_0903 allows a remote attacker to obtain sensitive information via a crafted request to a UDP port.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-05-01T00:00:00.000Z
CVE-2024-25461 
Directory Traversal vulnerability in Terrasoft, Creatio Terrasoft CRM v.7.18.4.1532 allows a remote attacker to obtain sensitive information via a crafted request to the terrasoft.axd component.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-02-21T00:00:00.000Z
CVE-2024-25466 
Directory Traversal vulnerability in React Native Document Picker before v.9.1.1 and fixed in v.9.1.1 allows a local attacker to execute arbitrary code via a crafted script to the Android library component.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-02-16T00:00:00.000Z
CVE-2024-25468 
An issue in TOTOLINK X5000R V.9.1.0u.6369_B20230113 allows a remote attacker to cause a denial of service via the host_time parameter of the NTPSyncWithHost component.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-02-17T00:00:00.000Z
CVE-2024-25469 
SQL Injection vulnerability in CRMEB crmeb_java v.1.3.4 and before allows a remote attacker to obtain sensitive information via the latitude and longitude parameters in the api/front/store/list component.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-02-23T00:00:00.000Z
CVE-2024-25501 
An issue WinMail v.7.1 and v.5.1 and before allows a remote attacker to execute arbitrary code via a crafted script to the email parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-03-09T00:00:00.000Z
CVE-2024-25502 
Directory Traversal vulnerability in flusity CMS v.2.4 allows a remote attacker to execute arbitrary code and obtain sensitive information via the download_backup.php component.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-02-15T00:00:00.000Z
CVE-2024-25503 
Cross Site Scripting (XSS) vulnerability in Advanced REST Client v.17.0.9 allows a remote attacker to execute arbitrary code and obtain sensitive information via a crafted script to the edit details parameter of the New Project function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-04-04T00:00:00.000Z
CVE-2024-25506 
Cross Site Scripting vulnerability in Process Maker, Inc ProcessMaker before 4.0 allows a remote attacker to run arbitrary code via control of the pm_sys_sys cookie.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-03-28T00:00:00.000Z
CVE-2024-25507 
RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the email_attach_id parameter at /LHMail/AttachDown.aspx.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-05-07T00:00:00.000Z
CVE-2024-25508 
RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the id parameter at /bulletin/bulletin_template_show.aspx.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-05-07T00:00:00.000Z
CVE-2024-25509 
RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the sys_file_storage_id parameter at /WorkFlow/wf_file_download.aspx.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-05-07T00:00:00.000Z
CVE-2024-25510 
RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the id parameter at /AddressBook/address_public_show.aspx.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-05-07T00:00:00.000Z
CVE-2024-25511 
RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the id parameter at /AddressBook/address_public_new.aspx.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-05-07T00:00:00.000Z
CVE-2024-25512 
RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the attach_id parameter at /Bulletin/AttachDownLoad.aspx.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-05-07T00:00:00.000Z
CVE-2024-25513 
RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the file_id parameter at /CorporateCulture/kaizen_download.aspx.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-05-07T00:00:00.000Z
CVE-2024-25514 
RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the template_id parameter at /SysManage/wf_template_child_field_list.aspx.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-05-07T00:00:00.000Z
CVE-2024-25515 
RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the sys_file_storage_id parameter at /WorkFlow/wf_work_finish_file_down.aspx.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-05-08T00:00:00.000Z
CVE-2024-25517 
RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the tbTable argument at /WebUtility/MF.aspx.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-05-08T00:00:00.000Z
CVE-2024-25518 
RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the template_id parameter at /WorkFlow/wf_get_fields_approve.aspx.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-05-08T00:00:00.000Z
CVE-2024-25519 
RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the idlist parameter at /WorkFlow/wf_work_print.aspx.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-05-08T00:00:00.000Z
CVE-2024-25520 
RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the id parameter at /SysManage/sys_blogtemplate_new.aspx.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-05-08T00:00:00.000Z
CVE-2024-25521 
RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the txt_keyword parameter at get_company.aspx.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-05-08T00:00:00.000Z
CVE-2024-25522 
RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the office_missive_id parameter at /WorkFlow/wf_work_form_save.aspx.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-05-08T00:00:00.000Z
CVE-2024-25523 
RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the file_id parameter at /filemanage/file_memo.aspx.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-05-08T00:00:00.000Z
CVE-2024-25524 
RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the sys_file_storage_id parameter at /WorkPlan/WorkPlanAttachDownLoad.aspx.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-05-08T00:00:00.000Z
CVE-2024-25525 
RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the filename parameter at /WorkFlow/OfficeFileDownload.aspx.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-05-08T00:00:00.000Z
CVE-2024-25526 
RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the project_id parameter at /ProjectManage/pm_gatt_inc.aspx.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-05-08T00:00:00.000Z
CVE-2024-25527 
RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the id parameter at /PersonalAffair/worklog_template_show.aspx.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-05-08T00:00:00.000Z
CVE-2024-25528 
RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the id parameter at /PersonalAffair/worklog_template_show.aspx.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-05-08T00:00:00.000Z
CVE-2024-25529 
RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the id parameter at /WorkFlow/wf_office_file_history_show.aspx.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-05-08T00:00:00.000Z
CVE-2024-25530 
RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the PageID parameter at /WebUtility/get_find_condiction.aspx.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-05-08T00:00:00.000Z
CVE-2024-25531 
RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the PageID parameter at /WebUtility/SearchCondiction.aspx.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-05-08T00:00:00.000Z
CVE-2024-25532 
RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the bt_id parameter at /include/get_dict.aspx.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-05-08T00:00:00.000Z
CVE-2024-25533 
Error messages in RuvarOA v6.01 and v12.01 were discovered to leak the physical path of the website (/WorkFlow/OfficeFileUpdate.aspx). This vulnerability can allow attackers to write files to the server or execute arbitrary commands via crafted SQL statements.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-05-08T00:00:00.000Z
CVE-2024-25545 
An issue in Weave Weave Desktop v.7.78.10 allows a local attacker to execute arbitrary code via a crafted script to the nwjs framework component.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-04-12T00:00:00.000Z
CVE-2024-25551 
Cross Site Scripting (XSS) vulnerability in sourcecodester Simple Student Attendance System v1.0 allows attackers to execute arbitrary code via crafted GET request to web application URL.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-03-03T00:00:00.000Z
CVE-2024-25552 Wiesemann & Theis: Multiple products prone to unquoted search path
A local attacker can gain administrative privileges by inserting an executable file in the path of the affected product.
Problem types: cwe_id: CWE-428
description: CWE-428 Unquoted Search Path or Element
Affected products: vendor: W&T
product: Com Redirector PnP
default_status: unaffected
vendor: W&T
product: Com Redirector Legacy
default_status: unaffected
vendor: W&T
product: OPC-Server
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2024-03-01T07:49:41.683Z
CVE-2024-25559 
URL spoofing vulnerability exists in a-blog cms Ver.3.1.0 to Ver.3.1.8. If an attacker sends a specially crafted request, the administrator of the product may be forced to access an arbitrary website when clicking a link in the audit log.
Problem types: description: User Interface (UI) Misrepresentation of Critical Information
Affected products: vendor: appleple inc.
product: a-blog cms
Published: 2024-02-15T04:32:37.608Z
CVE-2024-25560 TMM Vulnerability

When BIG-IP AFM is licensed and provisioned, undisclosed DNS traffic can cause the Traffic Management Microkernel (TMM) to terminate.

 


Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Problem types: cwe_id: CWE-476
description: CWE-476 NULL Pointer Dereference
Affected products: vendor: F5
product: BIG-IP
default_status: unknown
vendor: F5
product: BIG-IP Next CNF
default_status: unknown
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Credits: lang: en
value: F5
Published: 2024-05-08T15:01:25.651Z
CVE-2024-25561 
Insecure inherited permissions in some Intel(R) HID Event Filter software installers before version 2.2.2.1 may allow an authenticated user to potentially enable escalation of privilege via local access.
Problem types: description: escalation of privilege
cwe_id: CWE-277
description: Insecure inherited permissions
Affected products: vendor: n/a
product: Intel(R) HID Event Filter software installers
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 6.7
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: HIGH
privilegesRequired: LOW
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
Published: 2024-08-14T13:45:29.925Z
CVE-2024-25562 
Improper buffer restrictions in some Intel(R) Distribution for GDB software before version 2024.0.1 may allow an authenticated user to potentially enable denial of service via local access.
Problem types: description: denial of service
cwe_id: CWE-92
description: Improper buffer restrictions
Affected products: vendor: n/a
product: Intel(R) Distribution for GDB software
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 5.8
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H
attackVector: LOCAL
attackComplexity: HIGH
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: HIGH
Published: 2024-08-14T13:45:33.238Z
CVE-2024-25563 
Improper initialization in firmware for some Intel(R) PROSet/Wireless Software and Intel(R) Killer(TM) Wi-Fi before version 23.40 may allow a privileged user to potentially enable information disclosure via local access.
Problem types: description: information disclosure
cwe_id: CWE-665
description: Improper initialization
Affected products: vendor: n/a
product: Intel(R) PROSet/Wireless Software and Intel(R) Killer(TM) Wi-Fi
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 3.4
baseSeverity: LOW
vectorString: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: HIGH
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: NONE
Published: 2024-11-13T21:02:46.527Z
CVE-2024-25565 
Insufficient control flow management in UEFI firmware for some Intel(R) Xeon(R) Processors may allow an authenticated user to enable denial of service via local access.
Problem types: description: denial of service
cwe_id: CWE-691
description: Insufficient control flow management
Affected products: vendor: n/a
product: Intel(R) Xeon(R) Processors
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 3.8
baseSeverity: LOW
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:L
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: CHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: LOW
Published: 2024-11-13T20:36:06.900Z
CVE-2024-25566 Open Redirect in PingAM
An Open-Redirect vulnerability exists in PingAM where well-crafted requests may cause improper validation of redirect URLs. This could allow an attacker to redirect end-users to malicious sites under their control, simplifying phishing attacks
Problem types: cwe_id: CWE-601
description: CWE-601 URL Redirection to Untrusted Site ('Open Redirect')
Affected products: vendor: Ping Identity
product: PingAM
default_status: affected
Published: 2024-10-29T15:34:53.358Z
CVE-2024-25567 Delta Electronics DIAEnergie Path traversal

Path traversal attack is possible and write outside of the intended directory and may access sensitive information. If a file name is specified that already exists on the file system, then the original file will be overwritten.


Problem types: cwe_id: CWE-22
description: CWE-22: Improper limitation of a pathname to a restricted directory ('Path traversal')
Affected products: vendor: Delta Electronics
product: DIAEnergie
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.1
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
version: 3.1
Credits: lang: en
value: Michael Heinzl reported these vulnerabilities to CISA.
Published: 2024-03-21T22:22:17.780Z
CVE-2024-25568 
OS command injection vulnerability in ELECOM wireless LAN routers allows a network-adjacent unauthenticated attacker to execute arbitrary OS commands by sending a specially crafted request to the product. Affected products and versions are as follows: WRC-X3200GST3-B v1.25 and earlier, WRC-G01-W v1.24 and earlier, and WMC-X1800GST-B v1.41 and earlier. Note that WMC-X1800GST-B is also included in e-Mesh Starter Kit "WMC-2LX-B".
Problem types: description: OS command injection
Affected products: vendor: ELECOM CO.,LTD.
product: WRC-X3200GST3-B
vendor: ELECOM CO.,LTD.
product: WRC-G01-W
vendor: ELECOM CO.,LTD.
product: WMC-X1800GST-B
Published: 2024-04-04T00:02:32.323Z
CVE-2024-25569 
An out-of-bounds read vulnerability exists in the RAWCodec::DecodeBytes functionality of Mathieu Malaterre Grassroot DICOM 3.0.23. A specially crafted DICOM file can lead to an out-of-bounds read. An attacker can provide a malicious file to trigger this vulnerability.
Problem types: cwe_id: CWE-125
description: CWE-125: Out-of-bounds Read
Affected products: vendor: Grassroot DICOM
product: Grassroot DICOM
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: NONE
availabilityImpact: LOW
baseScore: 6.5
baseSeverity: MEDIUM
Credits: lang: en
value: Discovered by Emmanuel Tacheau of Cisco Talos.
Published: 2024-04-25T14:33:06.539Z
CVE-2024-25571 
Improper input validation in some Intel(R) SPS firmware before SPS_E5_06.01.04.059.0 may allow a privileged user to potentially enable denial of service via local access.
Problem types: description: Denial of Service
cwe_id: CWE-20
description: Improper Input Validation
Affected products: vendor: n/a
product: Intel(R) SPS firmware before SPS_E5_06.01.04.059.0
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 2.3
baseSeverity: LOW
vectorString: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: HIGH
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: LOW
Published: 2025-02-12T21:19:37.820Z
CVE-2024-25572 
Cross-site request forgery (CSRF) vulnerability exists in Ninja Forms prior to 3.4.31. If a website administrator views a malicious page while logging in, unintended operations may be performed.
Problem types: description: Cross-site request forgery (CSRF)
Affected products: vendor: Saturday Drive
product: Ninja Forms
Published: 2024-04-11T02:29:38.560Z
CVE-2024-25573 Stored Cross-Site Scripting in Administrative Console Context
Unsanitized user-supplied data saved in the PingFederate Administrative Console could trigger the execution of JavaScript code in subsequent user processing.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Affected products: vendor: Ping Identity
product: PingFederate
default_status: unaffected
Published: 2025-06-15T15:25:38.540Z