rainbutterfly/cve_corpus huggingface dataset:
CVE-2024-49996 cifs: Fix buffer overflow when parsing NFS reparse points
In the Linux kernel, the following vulnerability has been resolved:

cifs: Fix buffer overflow when parsing NFS reparse points

ReparseDataLength is sum of the InodeType size and DataBuffer size.
So to get DataBuffer size it is needed to subtract InodeType's size from
ReparseDataLength.

Function cifs_strndup_from_utf16() is currentlly accessing buf->DataBuffer
at position after the end of the buffer because it does not subtract
InodeType size from the length. Fix this problem and correctly subtract
variable len.

Member InodeType is present only when reparse buffer is large enough. Check
for ReparseDataLength before accessing InodeType to prevent another invalid
memory access.

Major and minor rdev values are present also only when reparse buffer is
large enough. Check for reparse buffer size before calling reparse_mkdev().
Affected products: vendor: Linux
product: Linux
default_status: unaffected
vendor: Linux
product: Linux
default_status: affected
Published: 2024-10-21T18:02:37.046Z
CVE-2024-49997 net: ethernet: lantiq_etop: fix memory disclosure
In the Linux kernel, the following vulnerability has been resolved:

net: ethernet: lantiq_etop: fix memory disclosure

When applying padding, the buffer is not zeroed, which results in memory
disclosure. The mentioned data is observed on the wire. This patch uses
skb_put_padto() to pad Ethernet frames properly. The mentioned function
zeroes the expanded buffer.

In case the packet cannot be padded it is silently dropped. Statistics
are also not incremented. This driver does not support statistics in the
old 32-bit format or the new 64-bit format. These will be added in the
future. In its current form, the patch should be easily backported to
stable versions.

Ethernet MACs on Amazon-SE and Danube cannot do padding of the packets
in hardware, so software padding must be applied.
Affected products: vendor: Linux
product: Linux
default_status: unaffected
vendor: Linux
product: Linux
default_status: affected
Published: 2024-10-21T18:02:37.681Z
CVE-2024-49998 net: dsa: improve shutdown sequence
In the Linux kernel, the following vulnerability has been resolved:

net: dsa: improve shutdown sequence

Alexander Sverdlin presents 2 problems during shutdown with the
lan9303 driver. One is specific to lan9303 and the other just happens
to reproduce there.

The first problem is that lan9303 is unique among DSA drivers in that it
calls dev_get_drvdata() at "arbitrary runtime" (not probe, not shutdown,
not remove):

phy_state_machine()
-> ...
   -> dsa_user_phy_read()
      -> ds->ops->phy_read()
         -> lan9303_phy_read()
            -> chip->ops->phy_read()
               -> lan9303_mdio_phy_read()
                  -> dev_get_drvdata()

But we never stop the phy_state_machine(), so it may continue to run
after dsa_switch_shutdown(). Our common pattern in all DSA drivers is
to set drvdata to NULL to suppress the remove() method that may come
afterwards. But in this case it will result in an NPD.

The second problem is that the way in which we set
dp->conduit->dsa_ptr = NULL; is concurrent with receive packet
processing. dsa_switch_rcv() checks once whether dev->dsa_ptr is NULL,
but afterwards, rather than continuing to use that non-NULL value,
dev->dsa_ptr is dereferenced again and again without NULL checks:
dsa_conduit_find_user() and many other places. In between dereferences,
there is no locking to ensure that what was valid once continues to be
valid.

Both problems have the common aspect that closing the conduit interface
solves them.

In the first case, dev_close(conduit) triggers the NETDEV_GOING_DOWN
event in dsa_user_netdevice_event() which closes user ports as well.
dsa_port_disable_rt() calls phylink_stop(), which synchronously stops
the phylink state machine, and ds->ops->phy_read() will thus no longer
call into the driver after this point.

In the second case, dev_close(conduit) should do this, as per
Documentation/networking/driver.rst:

| Quiescence
| ----------
|
| After the ndo_stop routine has been called, the hardware must
| not receive or transmit any data.  All in flight packets must
| be aborted. If necessary, poll or wait for completion of
| any reset commands.

So it should be sufficient to ensure that later, when we zeroize
conduit->dsa_ptr, there will be no concurrent dsa_switch_rcv() call
on this conduit.

The addition of the netif_device_detach() function is to ensure that
ioctls, rtnetlinks and ethtool requests on the user ports no longer
propagate down to the driver - we're no longer prepared to handle them.

The race condition actually did not exist when commit 0650bf52b31f
("net: dsa: be compatible with masters which unregister on shutdown")
first introduced dsa_switch_shutdown(). It was created later, when we
stopped unregistering the user interfaces from a bad spot, and we just
replaced that sequence with a racy zeroization of conduit->dsa_ptr
(one which doesn't ensure that the interfaces aren't up).
Affected products: vendor: Linux
product: Linux
default_status: unaffected
vendor: Linux
product: Linux
default_status: affected
Published: 2024-10-21T18:02:38.316Z
CVE-2024-49999 afs: Fix the setting of the server responding flag
In the Linux kernel, the following vulnerability has been resolved:

afs: Fix the setting of the server responding flag

In afs_wait_for_operation(), we set transcribe the call responded flag to
the server record that we used after doing the fileserver iteration loop -
but it's possible to exit the loop having had a response from the server
that we've discarded (e.g. it returned an abort or we started receiving
data, but the call didn't complete).

This means that op->server might be NULL, but we don't check that before
attempting to set the server flag.
Affected products: vendor: Linux
product: Linux
default_status: unaffected
vendor: Linux
product: Linux
default_status: affected
Published: 2024-10-21T18:02:38.958Z
CVE-2024-4000 WordPress Header Builder Plugin – Pearl <= 1.3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
The WordPress Header Builder Plugin – Pearl plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'stm_hb' shortcode in all versions up to, and including, 1.3.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: stylemix
product: Pearl – Header Builder
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
baseScore: 6.4
baseSeverity: MEDIUM
Credits: lang: en
value: Krzysztof Zając
Published: 2024-05-02T16:52:34.856Z
CVE-2024-4001 Download Manager <= 3.2.93 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpdm_modal_login_form Shortcode
The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wpdm_modal_login_form' shortcode in all versions up to, and including, 3.2.93 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: codename065
product: Download Manager
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
baseScore: 6.4
baseSeverity: MEDIUM
Credits: lang: en
value: Thanh Nam Tran
Published: 2024-06-05T11:01:58.831Z
CVE-2024-4002 Carousel, Slider, Gallery by WP Carousel < 2.6.9 - Editor+ Stored XSS
The Carousel, Slider, Gallery by WP Carousel  WordPress plugin before 2.6.9 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Problem types: description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: Carousel, Slider, Gallery by WP Carousel
default_status: unaffected
Credits: lang: en
value: Dmitrii Ignatyev
lang: en
value: WPScan
Published: 2025-05-15T20:09:45.188Z
CVE-2024-4003 Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.15 - Authenticated (Contributor+) Stored Cross-Site Scripting
The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the eael_team_members_image_rounded parameter in the Team Members widget in all versions up to, and including, 5.9.15 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor access and higher, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Problem types: cwe_id: CWE-20
description: CWE-20 Improper Input Validation
Affected products: vendor: wpdevteam
product: Essential Addons for Elementor – Popular Elementor Templates & Widgets
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
baseScore: 6.4
baseSeverity: MEDIUM
Credits: lang: en
value: Ngô Thiên An
Published: 2024-05-02T16:51:51.058Z
CVE-2024-4004 Advanced Cron Manager < 2.5.7 - Admin+ Stored XSS
The Advanced Cron Manager  WordPress plugin before 2.5.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Problem types: description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: Advanced Cron Manager
default_status: unaffected
Credits: lang: en
value: Krugov Artyom
lang: en
value: WPScan
Published: 2025-05-15T20:09:45.426Z
CVE-2024-4005 Social Pixel <= 2.1 - Admin+ Stored XSS
The Social Pixel WordPress plugin through 2.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Problem types: description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: Social Pixel
default_status: affected
Credits: lang: en
value: Bob Matyas
lang: en
value: WPScan
Published: 2024-06-14T06:00:04.285Z
CVE-2024-4006 Incorrect Authorization in GitLab
An issue has been discovered in GitLab CE/EE affecting all versions starting from 16.7 before 16.9.6, all versions starting from 16.10 before 16.10.4, all versions starting from 16.11 before 16.11.1 where personal access scopes were not honored by GraphQL subscriptions
Problem types: cwe_id: CWE-863
description: CWE-863: Incorrect Authorization
Affected products: vendor: GitLab
product: GitLab
cpes: cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: NONE
availabilityImpact: NONE
baseScore: 4.3
baseSeverity: MEDIUM
Credits: lang: en
value: This vulnerability was internally discovered and reported by a GitLab team member, [Dylan Griffith](https://gitlab.com/DylanGriffith)
Published: 2024-04-25T13:30:36.721Z
CVE-2024-4007 Hard coded default credential contained in install package
Default credential in install package in ABB ASPECT; NEXUS Series; MATRIX Series version 3.07 allows attacker to login to product instances wrongly configured.
Problem types: cwe_id: CWE-1392
description: CWE-1392: Use of Default Credentials
Affected products: vendor: ABB
product: ASPECT Enterprise (ASP-ENT-x)
default_status: unaffected
vendor: ABB
product: NEXUS Series (NEX-2x, NEXUS-3-x)
default_status: unaffected
vendor: ABB
product: MATRIX Series(MAT-x)
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: ADJACENT_NETWORK
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: ABB likes to thank https://divd.nl for reporting the vulnerability in responsible disclosure.
Published: 2024-07-01T12:06:53.048Z
CVE-2024-4008 FDSK Leak in KNX Secure Devices
FDSK Leak in ABB, Busch-Jaeger, FTS Display (version 1.00) and BCU (version 1.3.0.33) allows attacker to take control via access to local KNX Bus-System
Problem types: cwe_id: CWE-497
description: CWE-497 [LLM] Exposure of Sensitive System Information to an Unauthorized Control Sphere
Affected products: vendor: ABB, Busch-Jaeger
product: 2.4! Display 55, SD/U12.55.11-825
default_status: unaffected
vendor: ABB, Busch-Jaeger
product: 2.4! Display 55, SD/SD/U12.55.1-825
default_status: unaffected
vendor: ABB, Busch-Jaeger
product: 2.4! Display 63, SD/U12.63.11-825
default_status: unaffected
vendor: ABB, Busch-Jaeger
product: RoomTouch 4", RT/U12.86.1-825
default_status: unaffected
vendor: ABB, Busch-Jaeger
product: RoomTouch 4", RT/U12.86.11-825
default_status: unaffected
vendor: ABB, Busch-Jaeger
product: 2,4'' Display 70, SD/U12.70.11-4015
default_status: unaffected
vendor: ABB, Busch-Jaeger
product: 2,4'' Display 70, SD-U12-70-1-4015
default_status: unaffected
vendor: ABB, Busch-Jaeger
product: RoomTouch 4", RT/U12.86.11-811
default_status: unaffected
vendor: ABB, Busch-Jaeger
product: RoomTouch 4", RT-U12-86-1-811
default_status: unaffected
vendor: ABB, Busch-Jaeger
product: BCU KNX, BA-U1.0.11
default_status: unaffected
vendor: ABB, Busch-Jaeger
product: BCU KNX, BA-U1.0.1
default_status: unaffected
vendor: ABB, Busch-Jaeger
product: BCU KNX, BA-U1.0.21
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: ADJACENT_NETWORK
availabilityImpact: HIGH
baseScore: 9.6
baseSeverity: CRITICAL
confidentialityImpact: LOW
integrityImpact: HIGH
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:H
version: 3.1
Published: 2024-06-05T17:15:56.523Z
CVE-2024-4009 Replay Attack in KNX Secure Devices
Replay Attack

in ABB, Busch-Jaeger, FTS Display (version 1.00) and BCU (version 1.3.0.33) allows attacker to capture/replay KNX telegram to local KNX Bus-System
Affected products: vendor: ABB, Busch-Jaeger
product: 2.4! Display 55, SD/U12.55.11-825
default_status: unaffected
vendor: ABB, Busch-Jaeger
product: 2.4! Display 55, SD/SD/U12.55.1-825
default_status: unaffected
vendor: ABB, Busch-Jaeger
product: 2.4! Display 63, SD/U12.63.11-825
default_status: unaffected
vendor: ABB, Busch-Jaeger
product: RoomTouch 4", RT/U12.86.1-825
default_status: unaffected
vendor: ABB, Busch-Jaeger
product: RoomTouch 4", RT/U12.86.11-825
default_status: unaffected
vendor: ABB, Busch-Jaeger
product: 2,4'' Display 70, SD/U12.70.11-4015
default_status: unaffected
vendor: ABB, Busch-Jaeger
product: 2,4'' Display 70, SD-U12-70-1-4015
default_status: unaffected
vendor: ABB, Busch-Jaeger
product: RoomTouch 4", RT/U12.86.11-811
default_status: unaffected
vendor: ABB, Busch-Jaeger
product: RoomTouch 4", RT-U12-86-1-811
default_status: unaffected
vendor: ABB, Busch-Jaeger
product: BCU KNX, BA-U1.0.11
default_status: unaffected
vendor: ABB, Busch-Jaeger
product: BCU KNX, BA-U1.0.1
default_status: unaffected
vendor: ABB, Busch-Jaeger
product: BCU KNX, BA-U1.0.21
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 9.2
baseSeverity: CRITICAL
confidentialityImpact: LOW
integrityImpact: HIGH
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:H
version: 3.1
Published: 2024-06-05T17:19:07.010Z
CVE-2024-4010 Email Subscribers by Icegram Express <= 5.7.19 - Missing Authorization in handle_ajax_request
The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to unauthorized access of data, modification of data, and loss of data due to a missing capability check on the handle_ajax_request function in all versions up to, and including, 5.7.19. This makes it possible for authenticated attackers, with subscriber-level access and above, to cause a loss of confidentiality, integrity, and availability, by performing multiple unauthorized actions. Some of these actions could also be leveraged to conduct PHP Object Injection and SQL Injection attacks.
Problem types: cwe_id: CWE-862
description: CWE-862 Missing Authorization
Affected products: vendor: icegram
product: Email Subscribers & Newsletters – Email Marketing, Post Notifications & Newsletter Plugin for WordPress
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
baseScore: 8.8
baseSeverity: HIGH
Credits: lang: en
value: Arkadiusz Hydzik
Published: 2024-05-15T08:34:12.914Z
CVE-2024-4011 Improper Access Control in GitLab
An issue was discovered in GitLab CE/EE affecting all versions starting from 16.1 prior to 16.11.5, starting from 17.0 prior to 17.0.3, and starting from 17.1 prior to 17.1.1, which allows non-project member to promote key results to objectives.
Problem types: cwe_id: CWE-863
description: CWE-863: Incorrect Authorization
Affected products: vendor: GitLab
product: GitLab
cpes: cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 3.1
baseSeverity: LOW
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N
version: 3.1
Credits: lang: en
value: Thanks [ashish_r_padelkar](https://hackerone.com/ashish_r_padelkar) for reporting this vulnerability through our HackerOne bug bounty program
Published: 2024-06-26T23:31:20.436Z
CVE-2024-4013 Failure to update BT Mesh Replay Protection List
A bug exists in the API, mesh_node_power_off(), which fails to copy the contents of the Replay Protection 
List (RPL) from RAM to NVM before powering down, resulting in the ability to replay unsaved messages. Note that as of June 2024, the Gecko SDK was renamed to the Simplicity SDK, and the versioning scheme 
was changed from Gecko SDK vX.Y.Z to Simplicity SDK YYYY.MM.Patch#.
Problem types: cwe_id: CWE-404
description: CWE-404 Improper Resource Shutdown or Release
Affected products: vendor: silabs.com
product: Gecko SDK
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 5.6
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
version: 3.1
Published: 2024-06-06T21:31:53.472Z
CVE-2024-4014 hCaptcha for WordPress <= 4.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via cf7-hcaptcha Shortcode
The hCaptcha for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's cf7-hcaptcha shortcode in all versions up to, and including, 4.0.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: hcaptcha
product: hCaptcha for WP
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
baseScore: 6.4
baseSeverity: MEDIUM
Credits: lang: en
value: haidv35
Published: 2024-04-20T09:38:16.702Z
CVE-2024-4017 Privilege Escalation in U-Series Appliance
Improper Privilege Management vulnerability in BeyondTrust U-Series Appliance on Windows, 64 bit (filesystem modules) allows DLL Side-Loading.This issue affects U-Series Appliance: from 3.4 before 4.0.3.


Problem types: cwe_id: CWE-269
description: CWE-269 Improper Privilege Management
Affected products: vendor: BeyondTrust
product: U-Series Appliance
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Paolo Caminati
lang: en
value: Daniele Montanaro
Published: 2024-04-19T20:40:25.256Z
CVE-2024-4018 Privilege Escalation in U-Series Appliance
Improper Privilege Management vulnerability in BeyondTrust U-Series Appliance on Windows, 64 bit (local appliance api modules) allows Privilege Escalation.This issue affects U-Series Appliance: from 3.4 before 4.0.3.


Problem types: cwe_id: CWE-269
description: CWE-269 Improper Privilege Management
Affected products: vendor: BeyondTrust
product: U-Series Appliance
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Paolo Caminati
lang: en
value: Daniele Montanaro
Published: 2024-04-19T20:29:19.626Z
CVE-2024-4019 Byzoro Smart S80 Management Platform importhtml.php deserialization
A vulnerability classified as critical has been found in Byzoro Smart S80 Management Platform up to 20240411. Affected is an unknown function of the file /importhtml.php. The manipulation of the argument sql leads to deserialization. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-261666 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Problem types: cwe_id: CWE-502
description: CWE-502 Deserialization
Affected products: vendor: Byzoro
product: Smart S80 Management Platform
CVSS v3.1: version: 3.1
baseScore: 6.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
baseSeverity: MEDIUM
Credits: lang: en
value: scausoft (VulDB User)
Published: 2024-04-20T13:31:04.135Z
CVE-2024-4020 Tenda FH1206 addressNat fromAddressNat buffer overflow
A vulnerability was found in Tenda FH1206 1.2.0.8(8155) and classified as critical. This issue affects the function fromAddressNat of the file /goform/addressNat. The manipulation of the argument entrys leads to buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-261671. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Problem types: cwe_id: CWE-120
description: CWE-120 Buffer Overflow
Affected products: vendor: Tenda
product: FH1206
CVSS v3.1: version: 3.1
baseScore: 8.8
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
baseSeverity: HIGH
Credits: lang: en
value: ta0lve (VulDB User)
Published: 2024-04-20T23:00:06.043Z