rainbutterfly/cve_corpus huggingface dataset:
CVE-2024-41675 CKAN has a Cross-site Scripting vector in the Datatables view plugin
CKAN is an open-source data management system for powering data hubs and data portals. The Datatables view plugin did not properly escape record data coming from the DataStore, leading to a potential XSS vector. Sites running CKAN >= 2.7.0 with the datatables_view plugin activated. This is a plugin included in CKAN core, that not activated by default but it is widely used to preview tabular data. This vulnerability has been fixed in CKAN 2.10.5 and 2.11.0.
Problem types: cwe_id: CWE-79
description: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: ckan
product: ckan
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.8
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: LOW
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N
version: 3.1
Published: 2024-08-21T14:34:31.424Z
CVE-2024-41676 Magento LTS vulnerable to stored Cross-site Scripting (XSS) in admin system configs
Magento-lts is a long-term support alternative to Magento Community Edition (CE). This XSS vulnerability affects the design/header/welcome, design/header/logo_src, design/header/logo_src_small, and design/header/logo_alt system configs.They are intended to enable admins to set a text in the two cases, and to define an image url for the other two cases.
But because of previously missing escaping allowed to input arbitrary html and as a consequence also arbitrary JavaScript. The problem is patched with Version 20.10.1 or higher.
Problem types: cwe_id: CWE-79
description: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: OpenMage
product: magento-lts
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.1
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: HIGH
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:L/A:N
version: 3.1
Published: 2024-07-29T14:46:26.806Z
CVE-2024-41677 Cross-site Scripting (XSS) vulnerability due to improper HTML escaping in qwik
Qwik is a performance focused javascript framework. A potential mutation XSS vulnerability exists in Qwik for versions up to but not including 1.6.0. Qwik improperly escapes HTML on server-side rendering. It converts strings according to the rules found in the `render-ssr.ts` file. It sometimes causes the situation that the final DOM tree rendered on browsers is different from what Qwik expects on server-side rendering. This may be leveraged to perform XSS attacks, and a type of the XSS is known as mXSS (mutation XSS). This has been resolved in qwik version 1.6.0 and @builder.io/qwik version 1.7.3. All users are advised to upgrade. There are no known workarounds for this vulnerability.
Problem types: cwe_id: CWE-79
description: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: QwikDev
product: qwik
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 6.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
version: 3.1
Published: 2024-08-06T17:52:14.648Z
CVE-2024-41678 GLPI has multiple reflected XSS
GLPI is a free asset and IT management software package. An unauthenticated user can provide a malicious link to a GLPI technician in order to exploit a reflected XSS vulnerability. Upgrade to 10.0.17.
Problem types: cwe_id: CWE-79
description: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: glpi-project
product: glpi
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
version: 3.1
Published: 2024-11-15T18:08:46.836Z
CVE-2024-41679 Authenticated SQL injection in ticket form
GLPI is a free asset and IT management software package. An authenticated user can exploit a SQL injection vulnerability from the ticket form. Upgrade to 10.0.17.
Problem types: cwe_id: CWE-89
description: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: glpi-project
product: glpi
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
version: 3.1
Published: 2024-11-15T18:20:44.135Z
CVE-2024-41681 
A vulnerability has been identified in Location Intelligence family (All versions < V4.4). The web server of affected products is configured to support weak ciphers  by default. This could allow an unauthenticated attacker in an on-path position to to read and modify any data passed over the connection between legitimate clients and the affected device.
Problem types: cwe_id: CWE-326
description: CWE-326: Inadequate Encryption Strength
Affected products: vendor: Siemens
product: Location Intelligence family
default_status: unknown
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:H/E:P/RL:O/RC:C
baseScore: 6.7
baseSeverity: MEDIUM
Published: 2024-08-13T07:54:18.686Z
CVE-2024-41682 
A vulnerability has been identified in Location Intelligence family (All versions < V4.4). Affected products do not properly enforce restriction of  excessive authentication attempts. This could allow an unauthenticated remote attacker to conduct brute force attacks against legitimate user passwords.
Problem types: cwe_id: CWE-307
description: CWE-307: Improper Restriction of Excessive Authentication Attempts
Affected products: vendor: Siemens
product: Location Intelligence family
default_status: unknown
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C
baseScore: 5.3
baseSeverity: MEDIUM
Published: 2024-08-13T07:54:19.932Z
CVE-2024-41683 
A vulnerability has been identified in Location Intelligence family (All versions < V4.4). Affected products do not properly enforce a strong user password policy. This could facilitate a brute force attack against legitimate user passwords.
Problem types: cwe_id: CWE-521
description: CWE-521: Weak Password Requirements
Affected products: vendor: Siemens
product: Location Intelligence family
default_status: unknown
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C
baseScore: 5.3
baseSeverity: MEDIUM
Published: 2024-08-13T07:54:21.192Z
CVE-2024-41684 Cookie Without Secure Flag Set Vulnerability
This vulnerability exists in SyroTech SY-GPON-1110-WDONT Router due to missing secure flag for the session cookies associated with the router's web management interface. An attacker with remote access could exploit this by intercepting transmission within an HTTP session on the vulnerable system.

Successful exploitation of this vulnerability could allow the attacker to capture cookies and compromise the targeted system.
Problem types: cwe_id: CWE-614
description: CWE-614: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute
Affected products: vendor: SyroTech
product: SyroTech SY-GPON-1110-WDONT router
default_status: unaffected
Credits: lang: en
value: These vulnerabilities are discovered by Shravan Singh, Rahul Giri, & Karan Patel from Redfox Cyber Security Inc, Toronto, Canada.
Published: 2024-07-26T11:34:53.978Z
CVE-2024-41685 Cookie Without HTTPOnly Flag Set Vulnerability
This vulnerability exists in SyroTech SY-GPON-1110-WDONT Router due to missing HTTPOnly flag for the session cookies associated with the router's web management interface. An attacker with remote access could exploit this by intercepting transmission within an HTTP session on the vulnerable system.

Successful exploitation of this vulnerability could allow the attacker to capture cookies and obtain sensitive information on the targeted system.
Problem types: cwe_id: CWE-1004
description: CWE-1004: Sensitive Cookie Without 'HttpOnly' Flag
Affected products: vendor: SyroTech
product: SyroTech SY-GPON-1110-WDONT router
default_status: unaffected
Credits: lang: en
value: These vulnerabilities are discovered by Shravan Singh, Rahul Giri, & Karan Patel from Redfox Cyber Security Inc, Toronto, Canada.
Published: 2024-07-26T11:41:53.968Z
CVE-2024-41686 Password Policy Bypass Vulnerability
This vulnerability exists in SyroTech SY-GPON-1110-WDONT Router due to improper implementation of password policies. A local attacker could exploit this by creating password that do not adhere to the defined security standards/policy on the vulnerable system.

Successful exploitation of this vulnerability could allow the attacker to expose the router to potential security threats.
Problem types: cwe_id: CWE-179
description: CWE-179: Incorrect Behavior Order: Early Validation
Affected products: vendor: SyroTech
product: SyroTech SY-GPON-1110-WDONT router
default_status: unaffected
Credits: lang: en
value: These vulnerabilities are discovered by Shravan Singh, Rahul Giri, & Karan Patel from Redfox Cyber Security Inc, Toronto, Canada.
Published: 2024-07-26T11:45:18.109Z
CVE-2024-41687 Cleartext Transmission of Sensitive Information Vulnerability
This vulnerability exists in SyroTech SY-GPON-1110-WDONT Router due to transmission of password in plain text. A remote attacker could exploit this vulnerability by intercepting transmission within an HTTP session on the vulnerable system.

Successful exploitation of this vulnerability could allow the attacker to gain unauthorized access to the targeted system.
Problem types: cwe_id: CWE-319
description: CWE-319: Cleartext Transmission of Sensitive Information
Affected products: vendor: SyroTech
product: SyroTech SY-GPON-1110-WDONT router
default_status: unaffected
Credits: lang: en
value: These vulnerabilities are discovered by Shravan Singh, Rahul Giri, & Karan Patel from Redfox Cyber Security Inc, Toronto, Canada.
Published: 2024-07-26T11:50:30.359Z
CVE-2024-41688 Cleartext Storage of Sensitive Information Vulnerability
This vulnerability exists in SyroTech SY-GPON-1110-WDONT Router due lack of encryption in storing of usernames and passwords within the router's firmware/ database. An attacker with physical access could exploit this by extracting the firmware and reverse engineer the binary data to access the plaintext credentials on the vulnerable system.

Successful exploitation of this vulnerability could allow the attacker to gain unauthorized access to the targeted system.
Problem types: cwe_id: CWE-312
description: CWE-312: Cleartext Storage of Sensitive Information
Affected products: vendor: SyroTech
product: SyroTech SY-GPON-1110-WDONT router
default_status: unaffected
Credits: lang: en
value: These vulnerabilities are discovered by Shravan Singh, Rahul Giri, & Karan Patel from Redfox Cyber Security Inc, Toronto, Canada.
Published: 2024-07-26T11:56:03.174Z
CVE-2024-41689 Hard-coded Credentials Vulnerability
This vulnerability exists in SyroTech SY-GPON-1110-WDONT Router due to unencrypted storing of WPA/ WPS credentials within the router's firmware/ database. An attacker with physical access could exploit this by extracting the firmware and reverse engineer the binary data to access the plaintext WPA/ WPS credentials on the vulnerable system.

Successful exploitation of this vulnerability could allow the attacker to bypass WPA/ WPS and gain access to the Wi-Fi network of the targeted system.
Problem types: cwe_id: CWE-798
description: CWE-798: Use of Hard-coded Credentials
Affected products: vendor: SyroTech
product: SyroTech SY-GPON-1110-WDONT router
default_status: unaffected
Credits: lang: en
value: These vulnerabilities are discovered by Shravan Singh, Rahul Giri, & Karan Patel from Redfox Cyber Security Inc, Toronto, Canada.
Published: 2024-07-26T11:59:38.725Z
CVE-2024-41690 Default Credential Storage in Plaintext Vulnerability
This vulnerability exists in SyroTech SY-GPON-1110-WDONT Router due to storing of default username and password credentials in plaintext within the router's firmware/ database. An attacker with physical access could exploit this by extracting the firmware and reverse engineer the binary data to access the plaintext default credentials on the vulnerable system.

Successful exploitation of this vulnerability could allow the attacker to gain unauthorized access to the targeted system.
Problem types: cwe_id: CWE-312
description: CWE-312: Cleartext Storage of Sensitive Information
Affected products: vendor: SyroTech
product: SyroTech SY-GPON-1110-WDONT router
default_status: unaffected
Credits: lang: en
value: These vulnerabilities are discovered by Shravan Singh, Rahul Giri, & Karan Patel from Redfox Cyber Security Inc, Toronto, Canada.
Published: 2024-07-26T12:02:29.466Z
CVE-2024-41691 Insecure Storage of Sensitive Information Vulnerability
This vulnerability exists in SyroTech SY-GPON-1110-WDONT Router due to storing of FTP credentials in plaintext within the SquashFS-root filesystem associated with the router's firmware. An attacker with physical access could exploit this by extracting the firmware and reverse engineer the binary data to access the plaintext FTP credentials from the vulnerable system.

Successful exploitation of this vulnerability could allow the attacker to gain unauthorized access to the FTP server associated with the targeted system.
Problem types: cwe_id: CWE-312
description: CWE-312: Cleartext Storage of Sensitive Information
Affected products: vendor: SyroTech
product: SyroTech SY-GPON-1110-WDONT router
default_status: unaffected
Credits: lang: en
value: These vulnerabilities are discovered by Shravan Singh, Rahul Giri, & Karan Patel from Redfox Cyber Security Inc, Toronto, Canada.
Published: 2024-07-26T12:06:39.053Z
CVE-2024-41692 Incorrect Access Control Vulnerability
This vulnerability exists in SyroTech SY-GPON-1110-WDONT Router due to presence of root terminal access on a serial interface without proper access control. An attacker with physical access could exploit this by accessing the root shell on the vulnerable system.

Successful exploitation of this vulnerability could allow the attacker to execute arbitrary commands with root privileges on the targeted system.
Problem types: cwe_id: CWE-1191
description: CWE-1191: On-Chip Debug and Test Interface With Improper Access Control
Affected products: vendor: SyroTech
product: SyroTech SY-GPON-1110-WDONT router
default_status: unaffected
Credits: lang: en
value: These vulnerabilities are discovered by Shravan Singh, Rahul Giri, & Karan Patel from Redfox Cyber Security Inc, Toronto, Canada.
Published: 2024-07-26T12:11:27.774Z
CVE-2024-41693 Mashov - CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
Mashov - CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
Problem types: cwe_id: CWE-80
description: CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
Affected products: vendor: Mashov
product: Mashov
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.1
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
version: 3.1
Credits: lang: en
value: Guy Shoklander
Published: 2024-07-30T08:28:22.959Z
CVE-2024-41694 Cybonet – CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
Cybonet - CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
Problem types: cwe_id: CWE-200
description: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
Affected products: vendor: Cybonet
product: PineApp Mail Relay
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
version: 3.1
Credits: lang: en
value: Dudu Moyal ,Moriel Harush
Published: 2024-07-30T09:01:27.183Z
CVE-2024-41695 Cybonet - CWE-22: Improper Limitation of a Pathname to a Restricted Directory
Cybonet - CWE-22: Improper Limitation of a Pathname to a Restricted Directory
Problem types: cwe_id: CWE-22
description: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products: vendor: Cybonet
product: PineApp Mail Relay
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
version: 3.1
Credits: lang: en
value: Dudu Moyal ,Moriel Harush
Published: 2024-07-30T09:02:21.051Z
CVE-2024-41696 Priority PRI WEB Portal Add-On for Priority ERP on prem – CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
Priority 

PRI WEB Portal Add-On for Priority ERP on prem

- CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
Problem types: cwe_id: CWE-200
description: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
Affected products: vendor: Priority
product: PRI WEB Portal Add-On for Priority ERP on prem
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
version: 3.1
Credits: lang: en
value: Oded Weissman - MADSEC Security Ltd.
Published: 2024-07-30T09:09:11.086Z
CVE-2024-41697 Priority – CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
Priority - CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
Problem types: cwe_id: CWE-80
description: CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
Affected products: vendor: Priority
product: Priority
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.1
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
version: 3.1
Credits: lang: en
value: Gad Abuhatziera, Nimrod Bickels, Itay Cherdman - Sophtix Security LTD
Published: 2024-08-20T11:48:28.442Z
CVE-2024-41698 Priority – CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
Priority – CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
Problem types: cwe_id: CWE-200
description: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
Affected products: vendor: Priority
product: Priority
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
version: 3.1
Credits: lang: en
value: Gad Abuhatziera, Nimrod Bickels, Itay Cherdman - Sophtix Security LTD
Published: 2024-08-20T11:55:17.700Z
CVE-2024-41699 Priority – CWE-552: Files or Directories Accessible to External Parties
Priority – CWE-552: Files or Directories Accessible to External Parties
Problem types: cwe_id: CWE-552
description: CWE-552 Files or Directories Accessible to External Parties
Affected products: vendor: Priority
product: Priority
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.4
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N
version: 3.1
Credits: lang: en
value: Gad Abuhatziera, Nimrod Bickels, Itay Cherdman - Sophtix Security LTD
Published: 2024-08-20T12:00:22.274Z
CVE-2024-41700 Barix – CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
Barix – CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
Problem types: cwe_id: CWE-200
description: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
Affected products: vendor: Barix
product: Barix SIP Client Web Management Interface UI
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
version: 3.1
Credits: lang: en
value: Gad Abuhatziera, Nimrod Bickels, Itay Cherdman - Sophtix Security LTD
Published: 2024-08-20T12:05:10.315Z
CVE-2024-41701 AccuPOS – CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
AccuPOS - CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
Problem types: cwe_id: CWE-200
description: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
Affected products: vendor: AccuPOS
product: AccuPOS
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
version: 3.1
Credits: lang: en
value: Gad Abuhatzeira, Nimrod Bickels, Itay Cheredman - Sophtix Security LTD
Published: 2024-07-30T09:12:53.158Z
CVE-2024-41702 SiberianCMS – CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
SiberianCMS - CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Problem types: cwe_id: CWE-89
description: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: SiberianCMS
product: SiberianCMS v5.0.8
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Yotam Zaltsman
Published: 2024-07-30T09:18:04.027Z
CVE-2024-41703 
LibreChat through 0.7.4-rc1 has incorrect access control for message updates.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-07-22T00:00:00.000Z
CVE-2024-41704 
LibreChat through 0.7.4-rc1 does not validate the normalized pathnames of images.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-07-22T00:00:00.000Z