rainbutterfly/cve_corpus huggingface dataset:
CVE-2023-24414 WordPress Robo Gallery Plugin <= 3.2.11 is vulnerable to Cross Site Request Forgery (CSRF)
Cross-Site Request Forgery (CSRF) vulnerability in RoboSoft Photo Gallery, Images, Slider in Rbs Image Gallery plugin <= 3.2.11 versions.
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: RoboSoft
product: Photo Gallery, Images, Slider in Rbs Image Gallery
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
version: 3.1
Credits: lang: en
value: thiennv (Patchstack Alliance)
Published: 2023-05-20T22:08:55.700Z
CVE-2023-24415 WordPress AI ChatBot plugin <= 4.2.8 is vulnerable to Cross Site Request Forgery (CSRF)
Cross-Site Request Forgery (CSRF) vulnerability in QuantumCloud AI ChatBot plugin <= 4.2.8 versions.
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: QuantumCloud
product: AI ChatBot
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 5.4
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L
version: 3.1
Credits: lang: en
value: Rafshanzani Suhada (Patchstack Alliance)
Published: 2023-02-23T15:03:24.804Z
CVE-2023-24416 WordPress All In One Favicon Plugin <= 4.7 is vulnerable to Arbitrary File Deletion
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Arne Franken All In One Favicon.This issue affects All In One Favicon: from n/a through 4.7.
Problem types: cwe_id: CWE-22
description: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products: vendor: Arne Franken
product: All In One Favicon
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 6.8
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: HIGH
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H
version: 3.1
Credits: lang: en
value: Mika (Patchstack Alliance)
Published: 2024-02-23T11:32:58.824Z
CVE-2023-24417 WordPress Worthy – VG WORT Integration für WordPress Plugin <= 1.6.5-6497609 is vulnerable to Cross Site Request Forgery (CSRF)
Cross-Site Request Forgery (CSRF) vulnerability in tiggersWelt.Net Worthy plugin <= 1.6.5-6497609 versions.
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: tiggersWelt.net
product: Worthy
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
version: 3.1
Credits: lang: en
value: yuyudhn (Patchstack Alliance)
Published: 2023-07-11T12:38:29.231Z
CVE-2023-24418 WordPress Tiny carousel horizontal slider plus Plugin <= 3.2 is vulnerable to Cross Site Scripting (XSS)
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Gopi Ramasamy Tiny carousel horizontal slider plus plugin <= 3.2 versions.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: Gopi Ramasamy
product: Tiny carousel horizontal slider plus
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 5.9
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: HIGH
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L
version: 3.1
Credits: lang: en
value: yuyudhn (Patchstack Alliance)
Published: 2023-05-10T07:43:07.768Z
CVE-2023-24419 WordPress Formidable Forms Plugin <= 5.5.6 is vulnerable to Cross Site Request Forgery (CSRF)
Cross-Site Request Forgery (CSRF) vulnerability in Strategy11 Form Builder Team Formidable Forms plugin <= 5.5.6 versions.
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: Strategy11 Form Builder Team
product: Formidable Forms
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.1
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H
version: 3.1
Credits: lang: en
value: Rafshanzani Suhada (Patchstack Alliance)
Published: 2023-02-28T13:35:36.994Z
CVE-2023-24420 WordPress Admin side data storage for Contact Form 7 Plugin <= 1.1.1 is vulnerable to Cross Site Scripting (XSS)
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Zestard Technologies Admin side data storage for Contact Form 7 plugin <= 1.1.1 versions.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: Zestard Technologies
product: Admin side data storage for Contact Form 7
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 7.1
baseSeverity: HIGH
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
version: 3.1
Credits: lang: en
value: Bhuvanesh Jayaprakash (Patchstack Alliance)
Published: 2023-06-15T13:32:09.022Z
CVE-2023-24421 WordPress PHP Compatibility Checker Plugin <= 1.5.2 is vulnerable to Cross Site Request Forgery (CSRF)
Cross-Site Request Forgery (CSRF) vulnerability in WP Engine PHP Compatibility Checker plugin <= 1.5.2 versions.
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: WP Engine
product: PHP Compatibility Checker
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 5.4
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L
version: 3.1
Credits: lang: en
value: Mika (Patchstack Alliance)
Published: 2023-07-11T07:22:25.812Z
CVE-2023-24422 
A sandbox bypass vulnerability involving map constructors in Jenkins Script Security Plugin 1228.vd93135a_2fb_25 and earlier allows attackers with permission to define and run sandboxed scripts, including Pipelines, to bypass the sandbox protection and execute arbitrary code in the context of the Jenkins controller JVM.
Affected products: vendor: Jenkins Project
product: Jenkins Script Security Plugin
Published: 2023-01-24T00:00:00.000Z
CVE-2023-24423 
A cross-site request forgery (CSRF) vulnerability in Jenkins Gerrit Trigger Plugin 2.38.0 and earlier allows attackers to rebuild previous builds triggered by Gerrit.
Affected products: vendor: Jenkins Project
product: Jenkins Gerrit Trigger Plugin
Published: 2023-01-24T00:00:00.000Z
CVE-2023-24424 
Jenkins OpenId Connect Authentication Plugin 2.4 and earlier does not invalidate the previous session on login.
Affected products: vendor: Jenkins Project
product: Jenkins OpenId Connect Authentication Plugin
Published: 2023-01-24T00:00:00.000Z
CVE-2023-24425 
Jenkins Kubernetes Credentials Provider Plugin 1.208.v128ee9800c04 and earlier does not set the appropriate context for Kubernetes credentials lookup, allowing attackers with Item/Configure permission to access and potentially capture Kubernetes credentials they are not entitled to.
Affected products: vendor: Jenkins Project
product: Jenkins Kubernetes Credentials Provider Plugin
Published: 2023-01-24T00:00:00.000Z
CVE-2023-24426 
Jenkins Azure AD Plugin 303.va_91ef20ee49f and earlier does not invalidate the previous session on login.
Affected products: vendor: Jenkins Project
product: Jenkins Azure AD Plugin
Published: 2023-01-24T00:00:00.000Z
CVE-2023-24427 
Jenkins Bitbucket OAuth Plugin 0.12 and earlier does not invalidate the previous session on login.
Affected products: vendor: Jenkins Project
product: Jenkins Bitbucket OAuth Plugin
Published: 2023-01-24T00:00:00.000Z
CVE-2023-24428 
A cross-site request forgery (CSRF) vulnerability in Jenkins Bitbucket OAuth Plugin 0.12 and earlier allows attackers to trick users into logging in to the attacker's account.
Affected products: vendor: Jenkins Project
product: Jenkins Bitbucket OAuth Plugin
Published: 2023-01-24T00:00:00.000Z
CVE-2023-24429 
Jenkins Semantic Versioning Plugin 1.14 and earlier does not restrict execution of an controller/agent message to agents, and implements no limitations about the file path that can be parsed, allowing attackers able to control agent processes to have Jenkins parse a crafted file that uses external entities for extraction of secrets from the Jenkins controller or server-side request forgery.
Affected products: vendor: Jenkins Project
product: Jenkins Semantic Versioning Plugin
Published: 2023-01-24T00:00:00.000Z
CVE-2023-24430 
Jenkins Semantic Versioning Plugin 1.14 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
Affected products: vendor: Jenkins Project
product: Jenkins Semantic Versioning Plugin
Published: 2023-01-24T00:00:00.000Z
CVE-2023-24431 
A missing permission check in Jenkins Orka by MacStadium Plugin 1.31 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.
Affected products: vendor: Jenkins Project
product: Jenkins Orka by MacStadium Plugin
Published: 2023-01-24T00:00:00.000Z
CVE-2023-24432 
A cross-site request forgery (CSRF) vulnerability in Jenkins Orka by MacStadium Plugin 1.31 and earlier allows attackers to connect to an attacker-specified HTTP server using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
Affected products: vendor: Jenkins Project
product: Jenkins Orka by MacStadium Plugin
Published: 2023-01-24T00:00:00.000Z
CVE-2023-24433 
Missing permission checks in Jenkins Orka by MacStadium Plugin 1.31 and earlier allow attackers with Overall/Read permission to connect to an attacker-specified HTTP server using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
Affected products: vendor: Jenkins Project
product: Jenkins Orka by MacStadium Plugin
Published: 2023-01-24T00:00:00.000Z
CVE-2023-24434 
A cross-site request forgery (CSRF) vulnerability in Jenkins GitHub Pull Request Builder Plugin 1.42.2 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
Affected products: vendor: Jenkins Project
product: Jenkins GitHub Pull Request Builder Plugin
Published: 2023-01-24T00:00:00.000Z
CVE-2023-24435 
A missing permission check in Jenkins GitHub Pull Request Builder Plugin 1.42.2 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
Affected products: vendor: Jenkins Project
product: Jenkins GitHub Pull Request Builder Plugin
Published: 2023-01-24T00:00:00.000Z
CVE-2023-24436 
A missing permission check in Jenkins GitHub Pull Request Builder Plugin 1.42.2 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.
Affected products: vendor: Jenkins Project
product: Jenkins GitHub Pull Request Builder Plugin
Published: 2023-01-24T00:00:00.000Z
CVE-2023-24437 
A cross-site request forgery (CSRF) vulnerability in Jenkins JIRA Pipeline Steps Plugin 2.0.165.v8846cf59f3db and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
Affected products: vendor: Jenkins Project
product: Jenkins JIRA Pipeline Steps Plugin
Published: 2023-01-24T00:00:00.000Z
CVE-2023-24438 
A missing permission check in Jenkins JIRA Pipeline Steps Plugin 2.0.165.v8846cf59f3db and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
Affected products: vendor: Jenkins Project
product: Jenkins JIRA Pipeline Steps Plugin
Published: 2023-01-24T00:00:00.000Z
CVE-2023-24439 
Jenkins JIRA Pipeline Steps Plugin 2.0.165.v8846cf59f3db and earlier stores the private keys unencrypted in its global configuration file on the Jenkins controller where it can be viewed by users with access to the Jenkins controller file system.
Affected products: vendor: Jenkins Project
product: Jenkins JIRA Pipeline Steps Plugin
Published: 2023-01-24T00:00:00.000Z
CVE-2023-24440 
Jenkins JIRA Pipeline Steps Plugin 2.0.165.v8846cf59f3db and earlier transmits the private key in plain text as part of the global Jenkins configuration form, potentially resulting in their exposure.
Affected products: vendor: Jenkins Project
product: Jenkins JIRA Pipeline Steps Plugin
Published: 2023-01-24T00:00:00.000Z
CVE-2023-24441 
Jenkins MSTest Plugin 1.0.0 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
Affected products: vendor: Jenkins Project
product: Jenkins MSTest Plugin
Published: 2023-01-24T00:00:00.000Z
CVE-2023-24442 
Jenkins GitHub Pull Request Coverage Status Plugin 2.2.0 and earlier stores the GitHub Personal Access Token, Sonar access token and Sonar password unencrypted in its global configuration file on the Jenkins controller where they can be viewed by users with access to the Jenkins controller file system.
Affected products: vendor: Jenkins Project
product: Jenkins GitHub Pull Request Coverage Status Plugin
Published: 2023-01-24T00:00:00.000Z
CVE-2023-24443 
Jenkins TestComplete support Plugin 2.8.1 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
Affected products: vendor: Jenkins Project
product: Jenkins TestComplete support Plugin
Published: 2023-01-24T00:00:00.000Z
CVE-2023-24444 
Jenkins OpenID Plugin 2.4 and earlier does not invalidate the previous session on login.
Affected products: vendor: Jenkins Project
product: Jenkins OpenID Plugin
Published: 2023-01-24T00:00:00.000Z
CVE-2023-24445 
Jenkins OpenID Plugin 2.4 and earlier improperly determines that a redirect URL after login is legitimately pointing to Jenkins.
Affected products: vendor: Jenkins Project
product: Jenkins OpenID Plugin
Published: 2023-01-24T00:00:00.000Z
CVE-2023-24446 
A cross-site request forgery (CSRF) vulnerability in Jenkins OpenID Plugin 2.4 and earlier allows attackers to trick users into logging in to the attacker's account.
Affected products: vendor: Jenkins Project
product: Jenkins OpenID Plugin
Published: 2023-01-24T00:00:00.000Z
CVE-2023-24447 
A cross-site request forgery (CSRF) vulnerability in Jenkins RabbitMQ Consumer Plugin 2.8 and earlier allows attackers to connect to an attacker-specified AMQP(S) URL using attacker-specified username and password.
Affected products: vendor: Jenkins Project
product: Jenkins RabbitMQ Consumer Plugin
Published: 2023-01-24T00:00:00.000Z
CVE-2023-24448 
A missing permission check in Jenkins RabbitMQ Consumer Plugin 2.8 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified AMQP(S) URL using attacker-specified username and password.
Affected products: vendor: Jenkins Project
product: Jenkins RabbitMQ Consumer Plugin
Published: 2023-01-24T00:00:00.000Z
CVE-2023-24449 
Jenkins PWauth Security Realm Plugin 0.4 and earlier does not restrict the names of files in methods implementing form validation, allowing attackers with Overall/Read permission to check for the existence of an attacker-specified file path on the Jenkins controller file system.
Affected products: vendor: Jenkins Project
product: Jenkins PWauth Security Realm Plugin
Published: 2023-01-24T00:00:00.000Z
CVE-2023-24450 
Jenkins view-cloner Plugin 1.1 and earlier stores passwords unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Extended Read permission, or access to the Jenkins controller file system.
Affected products: vendor: Jenkins Project
product: Jenkins view-cloner Plugin
Published: 2023-01-24T00:00:00.000Z
CVE-2023-24451 
A missing permission check in Jenkins Cisco Spark Notifier Plugin 1.1.1 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.
Affected products: vendor: Jenkins Project
product: Jenkins Cisco Spark Notifier Plugin
Published: 2023-01-24T00:00:00.000Z
CVE-2023-24452 
A cross-site request forgery (CSRF) vulnerability in Jenkins TestQuality Updater Plugin 1.3 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified username and password.
Affected products: vendor: Jenkins Project
product: Jenkins TestQuality Updater Plugin
Published: 2023-01-24T00:00:00.000Z
CVE-2023-24453 
A missing check in Jenkins TestQuality Updater Plugin 1.3 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified username and password.
Affected products: vendor: Jenkins Project
product: Jenkins TestQuality Updater Plugin
Published: 2023-01-24T00:00:00.000Z
CVE-2023-24454 
Jenkins TestQuality Updater Plugin 1.3 and earlier stores the TestQuality Updater password unencrypted in its global configuration file on the Jenkins controller where it can be viewed by users with access to the Jenkins controller file system.
Affected products: vendor: Jenkins Project
product: Jenkins TestQuality Updater Plugin
Published: 2023-01-24T00:00:00.000Z
CVE-2023-24455 
Jenkins visualexpert Plugin 1.3 and earlier does not restrict the names of files in methods implementing form validation, allowing attackers with Item/Configure permission to check for the existence of an attacker-specified file path on the Jenkins controller file system.
Affected products: vendor: Jenkins Project
product: Jenkins visualexpert Plugin
Published: 2023-01-24T00:00:00.000Z
CVE-2023-24456 
Jenkins Keycloak Authentication Plugin 2.3.0 and earlier does not invalidate the previous session on login.
Affected products: vendor: Jenkins Project
product: Jenkins Keycloak Authentication Plugin
Published: 2023-01-24T00:00:00.000Z
CVE-2023-24457 
A cross-site request forgery (CSRF) vulnerability in Jenkins Keycloak Authentication Plugin 2.3.0 and earlier allows attackers to trick users into logging in to the attacker's account.
Affected products: vendor: Jenkins Project
product: Jenkins Keycloak Authentication Plugin
Published: 2023-01-24T00:00:00.000Z
CVE-2023-24458 
A cross-site request forgery (CSRF) vulnerability in Jenkins BearyChat Plugin 3.0.2 and earlier allows attackers to connect to an attacker-specified URL.
Affected products: vendor: Jenkins Project
product: Jenkins BearyChat Plugin
Published: 2023-01-24T00:00:00.000Z
CVE-2023-24459 
A missing permission check in Jenkins BearyChat Plugin 3.0.2 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL.
Affected products: vendor: Jenkins Project
product: Jenkins BearyChat Plugin
Published: 2023-01-24T00:00:00.000Z
CVE-2023-24460 
Incorrect default permissions in some Intel(R) GPA software installers before version 2023.3 may allow an authenticated user to potentially enable escalation of privilege via local access.
Problem types: description: escalation of privilege
cwe_id: CWE-276
description: Incorrect default permissions
Affected products: vendor: n/a
product: Intel(R) GPA software installers
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 8.2
baseSeverity: HIGH
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: REQUIRED
scope: CHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
Published: 2024-05-16T20:47:44.292Z
CVE-2023-24461 BIG-IP Edge Client for Windows and macOS vulnerability

An improper certificate validation vulnerability exists in the BIG-IP Edge Client for Windows and macOS and may allow an attacker to impersonate a BIG-IP APM system.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Problem types: cwe_id: CWE-295
description: CWE-295 Improper Certificate Validation
Affected products: vendor: F5
product: BIG-IP Edge Client
default_status: unknown
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 7.4
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
version: 3.1
Credits: lang: en
value: F5 acknowledges Gianluca Palma of Engineering Ingegneria Informatica S.p.A. for bringing this issue to our attention and following the highest standards of coordinated disclosure.
Published: 2023-05-03T14:31:08.249Z
CVE-2023-24463 
Improper input validation in some Intel(R) Thunderbolt(TM) DCH drivers for Windows before version 88 may allow an unauthenticated user to potentially enable information disclosure via adjacent access.
Problem types: description: information disclosure
cwe_id: CWE-20
description: Improper input validation
Affected products: vendor: n/a
product: Intel(R) Thunderbolt(TM) DCH drivers for Windows
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 4.3
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
attackVector: ADJACENT_NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: NONE
availabilityImpact: NONE
Published: 2024-02-14T13:37:45.613Z
CVE-2023-24464 
Stored-cross-site scripting vulnerability in Buffalo network devices allows an attacker with access to the web management console of the product to execute arbitrary JavaScript on a legitimate user's web browser. The affected products and versions are as follows: BS-GS2008 firmware Ver. 1.0.10.01 and earlier, BS-GS2016 firmware Ver. 1.0.10.01 and earlier, BS-GS2024 firmware Ver. 1.0.10.01 and earlier, BS-GS2048 firmware Ver. 1.0.10.01 and earlier, BS-GS2008P firmware Ver. 1.0.10.01 and earlier, BS-GS2016P firmware Ver. 1.0.10.01 and earlier, and BS-GS2024P firmware Ver. 1.0.10.01 and earlier
Problem types: description: Stored cross-site scripting
Affected products: vendor: BUFFALO INC.
product: BS-GS series
Published: 2023-04-11T00:00:00.000Z
CVE-2023-24465 Communication Wi-Fi  subsystem has a null pointer reference vulnerability when receving external data.
Communication Wi-Fi subsystem within OpenHarmony-v3.1.4 and prior versions, OpenHarmony-v3.0.7 and prior versions

has a null pointer reference vulnerability which local attackers can exploit this vulnerability to cause the current application to crash.

Problem types: cwe_id: CWE-20
description: CWE-20 Improper Input Validation
Affected products: vendor: OpenHarmony
product: OpenHarmony
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 5.5
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
version: 3.1
Published: 2023-03-10T10:45:12.940Z