rainbutterfly/cve_corpus huggingface dataset:
CVE-2024-6352 Malformed packet leads to denial of service in APS layer
A malformed packet can cause a buffer overflow in the APS layer of the Ember ZNet stack and lead to an assert
Problem types: cwe_id: CWE-120
description: CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
Affected products: vendor: silabs.com
product: SiSDK
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: ADJACENT_NETWORK
availabilityImpact: LOW
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
version: 3.1
Published: 2025-01-13T16:39:43.897Z
CVE-2024-6353 Wallet for WooCommerce <= 1.5.4 - Authenticated (Subscriber+) SQL Injection via 'search[value]'
The Wallet for WooCommerce plugin for WordPress is vulnerable to SQL Injection via the 'search[value]' parameter in all versions up to, and including, 1.5.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Problem types: cwe_id: CWE-89
description: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: subratamal
product: Wallet for WooCommerce
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
baseScore: 8.8
baseSeverity: HIGH
Credits: lang: en
value: AmrAwad
Published: 2024-07-12T08:32:13.089Z
CVE-2024-6354 
Improper access control in PAM dashboard in Devolutions Remote Desktop Manager 2024.2.11 and earlier on Windows allows an authenticated user to bypass the execute permission via the use of the PAM dashboard.
Affected products: vendor: Devolutions
product: Remote Desktop Manager
default_status: unaffected
Published: 2024-06-26T16:20:42.264Z
CVE-2024-6355 Genexis Tilgin Fiber Home Gateway HG1522 cross site scripting
A vulnerability was found in Genexis Tilgin Fiber Home Gateway HG1522 CSx000-01_09_01_12. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /status/product_info/. The manipulation of the argument product_info leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-269755. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross Site Scripting
Affected products: vendor: Genexis
product: Tilgin Fiber Home Gateway HG1522
CVSS v3.1: version: 3.1
baseScore: 4.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
baseSeverity: MEDIUM
Credits: lang: en
value: The_Druk (VulDB User)
Published: 2024-06-26T21:00:05.252Z
CVE-2024-6356 Incorrect User Management in GitLab
An issue was discovered in GitLab EE affecting all versions starting from 16.0 prior to 17.0.6, starting from 17.1 prior to 17.1.4, and starting from 17.2 prior to 17.2.2, which allowed cross project access for Security policy bot.
Problem types: cwe_id: CWE-286
description: CWE-286: Incorrect User Management
Affected products: vendor: GitLab
product: GitLab
cpes: cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N
attackVector: NETWORK
attackComplexity: HIGH
privilegesRequired: LOW
userInteraction: REQUIRED
scope: CHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: NONE
baseScore: 4.4
baseSeverity: MEDIUM
Credits: lang: en
value: Thanks [yvvdwf](https://hackerone.com/yvvdwf) for reporting this vulnerability through our HackerOne bug bounty program
Published: 2025-02-05T10:02:22.677Z
CVE-2024-6357 Insecure Direct Object Reference vulnerability
Insecure Direct Object Reference vulnerability identified in OpenText ArcSight Intelligence.
Problem types: cwe_id: CWE-639
description: CWE-639 Authorization Bypass Through User-Controlled Key
Affected products: vendor: OpenText
product: ArcSight Intelligence
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 6.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
version: 3.1
Published: 2024-08-06T13:08:46.927Z
CVE-2024-6358 Incorrect Authorization vulnerability
Incorrect Authorization vulnerability identified in OpenText ArcSight Intelligence.
Problem types: cwe_id: CWE-863
description: CWE-863 Incorrect Authorization
Affected products: vendor: OpenText
product: ArcSight Intelligence
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:N
version: 3.1
Published: 2024-08-06T13:08:42.954Z
CVE-2024-6359 Privilege escalation vulnerability
Privilege escalation vulnerability identified in OpenText ArcSight Intelligence.
Problem types: cwe_id: CWE-269
description: CWE-269 Improper Privilege Management
Affected products: vendor: OpenText
product: ArcSight Intelligence
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 6.4
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:L
version: 3.1
Published: 2024-08-06T13:08:45.219Z
CVE-2024-6360 Incorrect Permission Assignment for Critical Resource vulnerability has been discovered in OpenText™ Vertica.
Incorrect Permission Assignment for Critical Resource vulnerability in OpenText™ Vertica could allow Privilege Abuse and result in unauthorized access or privileges to Vertica agent apikey.
This issue affects Vertica: from 10.0 through 10.X, from 11.0 through 11.X, from 12.0 through 12.X, from 23.0 through 23.X, from 24.0 through 24.X.
Problem types: cwe_id: CWE-732
description: CWE-732 Incorrect Permission Assignment for Critical Resource
Affected products: vendor: OpenText™
product: Vertica
default_status: unaffected
Credits: lang: en
value: Davide Brian Di Campi, TIM Security Red Team Research
lang: en
value: Massimiliano Brolli, TIM Security Red Team Research
Published: 2024-10-02T15:19:15.457Z
CVE-2024-6361 Improper Neutralization vulnerability (XSS) has been discovered in OpenText™ ALM Octane product.
Improper Neutralization vulnerability (XSS) has been discovered in OpenText™ ALM Octane. The vulnerability affects all version prior to version 23.4. The vulnerability could cause remote code execution attack.
Problem types: cwe_id: CWE-79
description: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: OpenText™
product: ALM Octane.
default_status: unaffected
Credits: lang: en
value: Vaibhav Kumar Srivastava (Esecforte Technologies Pvt. Ltd.)
Published: 2024-08-05T18:22:14.283Z
CVE-2024-6362 Ultimate Blocks < 3.2.0 - Contributor+ Stored XSS
The Ultimate Blocks  WordPress plugin before 3.2.0 does not validate and escape some of its post-grid block attributes before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
Problem types: description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: Ultimate Blocks
default_status: unaffected
Credits: lang: en
value: Dmitrii Ignatyev
lang: en
value: WPScan
Published: 2024-07-29T06:00:07.759Z
CVE-2024-6363 Stock Ticker <= 3.24.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via stock_ticker Shortcode
The Stock Ticker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's stock_ticker shortcode in all versions up to, and including, 3.24.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: urkekg
product: Stock Ticker
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
baseScore: 6.4
baseSeverity: MEDIUM
Credits: lang: en
value: vgo0
Published: 2024-06-29T07:05:34.703Z
CVE-2024-6364 Server Identity Validation Bypass in Absolute Persistence®
A vulnerability in Absolute Persistence® versions before 2.8 exists when it is not activated. This may allow a skilled attacker with both physical access to the device, and full hostile network control, to initiate OS commands on the device.  To remediate this vulnerability, update the device firmware to the latest available version. Please contact the device manufacturer for upgrade instructions or contact Absolute Security, see reference below.
Affected products: vendor: Absolute Security
product: Absolute Persistence
default_status: unaffected
Credits: lang: en
value: Denis Faiustov, GMO Cybersecurity by Ierae
Published: 2025-05-13T17:00:07.443Z
CVE-2024-6365 Product Table by WBW <= 2.0.1 - Unauthenticated Remote Code Execution
The Product Table by WBW plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.0.1 via the 'saveCustomTitle' function. This is due to missing authorization and lack of sanitization of appended data in the languages/customTitle.php file. This makes it possible for unauthenticated attackers to execute code on the server.
Problem types: cwe_id: CWE-94
description: CWE-94 Improper Control of Generation of Code ('Code Injection')
Affected products: vendor: woobewoo
product: Product Table for WooCommerce by WBW
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
baseScore: 9.8
baseSeverity: CRITICAL
Credits: lang: en
value: Friderika Baranyai
Published: 2024-07-09T03:33:03.786Z
CVE-2024-6366 User Profile Builder < 3.11.8 - Unauthenticated Media Upload
The User Profile Builder  WordPress plugin before 3.11.8 does not have proper authorisation, allowing unauthenticated users to upload media files via the async upload functionality of WP.
Problem types: description: CWE-862 Missing Authorization
Affected products: vendor: Unknown
product: User Profile Builder
default_status: unaffected
Credits: lang: en
value: Michel Prunet
lang: en
value: WPScan
Published: 2024-07-29T06:00:08.248Z
CVE-2024-6367 LabVantage LIMS POST Request cross site scripting
A vulnerability was found in LabVantage LIMS 2017. It has been declared as problematic. This vulnerability affects unknown code of the file /labvantage/rc?command=file&file=WEB-CORE/elements/files/filesembedded.jsp of the component POST Request Handler. The manipulation of the argument sdcid/keyid1/keyid2/keyid3 leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-269800. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross Site Scripting
Affected products: vendor: LabVantage
product: LIMS
CVSS v3.1: version: 3.1
baseScore: 3.5
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
baseSeverity: LOW
Credits: lang: en
value: Farouk (VulDB User)
Published: 2024-06-27T11:31:04.154Z
CVE-2024-6368 LabVantage LIMS POST Request cross site scripting
A vulnerability was found in LabVantage LIMS 2017. It has been rated as problematic. This issue affects some unknown processing of the file /labvantage/rc?command=page of the component POST Request Handler. The manipulation of the argument param1 leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-269801 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross Site Scripting
Affected products: vendor: LabVantage
product: LIMS
CVSS v3.1: version: 3.1
baseScore: 3.5
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
baseSeverity: LOW
Credits: lang: en
value: Farouk (VulDB User)
Published: 2024-06-27T11:31:06.731Z
CVE-2024-6369 LabVantage LIMS POST Request cross site scripting
A vulnerability classified as problematic has been found in LabVantage LIMS 2017. Affected is an unknown function of the file /labvantage/rc?command=page&sdcid=LV_ReagentLot of the component POST Request Handler. The manipulation of the argument mode leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-269802 is the identifier assigned to this vulnerability.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross Site Scripting
Affected products: vendor: LabVantage
product: LIMS
CVSS v3.1: version: 3.1
baseScore: 3.5
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
baseSeverity: LOW
Credits: lang: en
value: Farouk (VulDB User)
Published: 2024-06-27T12:00:06.595Z
CVE-2024-6370 LabVantage LIMS POST Request cross site scripting
A vulnerability classified as problematic was found in LabVantage LIMS 2017. Affected by this vulnerability is an unknown functionality of the file /labvantage/rc?command=file&file=WEB-OPAL/pagetypes/bulletins/sendbulletin.jsp of the component POST Request Handler. The manipulation of the argument bulletinbody leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-269803.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross Site Scripting
Affected products: vendor: LabVantage
product: LIMS
CVSS v3.1: version: 3.1
baseScore: 3.5
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
baseSeverity: LOW
Credits: lang: en
value: Farouk (VulDB User)
Published: 2024-06-27T12:00:09.407Z
CVE-2024-6371 itsourcecode Pool of Bethesda Online Reservation System controller.php sql injection
A vulnerability, which was classified as critical, has been found in itsourcecode Pool of Bethesda Online Reservation System 1.0. Affected by this issue is some unknown functionality of the file controller.php. The manipulation of the argument rmtype_id leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-269804.
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: itsourcecode
product: Pool of Bethesda Online Reservation System
CVSS v3.1: version: 3.1
baseScore: 7.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
baseSeverity: HIGH
Credits: lang: en
value: N3xu5Cr4ck37 (VulDB User)
Published: 2024-06-27T12:31:04.019Z
CVE-2024-6372 itsourcecode Tailoring Management System customeradd.php sql injection
A vulnerability, which was classified as critical, was found in itsourcecode Tailoring Management System 1.0. This affects an unknown part of the file customeradd.php. The manipulation of the argument fullname/address/phonenumber/sex/email/city/comment leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-269805 was assigned to this vulnerability.
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: itsourcecode
product: Tailoring Management System
CVSS v3.1: version: 3.1
baseScore: 6.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
baseSeverity: MEDIUM
Credits: lang: en
value: galaxy (VulDB User)
Published: 2024-06-27T13:00:06.217Z
CVE-2024-6373 itsourcecode Online Food Ordering System addproduct.php unrestricted upload
A vulnerability has been found in itsourcecode Online Food Ordering System up to 1.0 and classified as critical. This vulnerability affects unknown code of the file /addproduct.php. The manipulation of the argument photo leads to unrestricted upload. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-269806 is the identifier assigned to this vulnerability.
Problem types: cwe_id: CWE-434
description: CWE-434 Unrestricted Upload
Affected products: vendor: itsourcecode
product: Online Food Ordering System
CVSS v3.1: version: 3.1
baseScore: 7.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
baseSeverity: HIGH
Credits: lang: en
value: abyssun (VulDB User)
Published: 2024-06-27T13:00:08.480Z
CVE-2024-6374 lahirudanushka School Management System Subject Page subject.php cross site scripting
A vulnerability was found in lahirudanushka School Management System 1.0.0/1.0.1 and classified as problematic. This issue affects some unknown processing of the file /subject.php of the component Subject Page. The manipulation of the argument Subject Title/Sybillus Details leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-269807.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross Site Scripting
Affected products: vendor: lahirudanushka
product: School Management System
CVSS v3.1: version: 3.1
baseScore: 3.5
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
baseSeverity: LOW
Credits: lang: en
value: Taher Aboud (VulDB User)
Published: 2024-06-27T13:31:05.025Z
CVE-2024-6375 Missing authorization check may lead to shard key refinement
A command for refining a collection shard key is missing an authorization check. This may cause the command to run directly on a shard, leading to either degradation of query performance, or to revealing chunk boundaries through timing side channels. This affects MongoDB Server v5.0 versions, prior to 5.0.22, MongoDB Server v6.0 versions, prior to 6.0.11 and MongoDB Server v7.0 versions prior to 7.0.3.
Problem types: cwe_id: CWE-285
description: CWE-285: Improper Authorization
Affected products: vendor: MongoDB Inc
product: MongoDB Server
cpes: cpe:2.3:a:mongodb:mongodb:5.0.0:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongodb:5.0.1:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongodb:5.0.2:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongodb:5.0.3:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongodb:5.0.4:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongodb:5.0.5:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongodb:5.0.6:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongodb:5.0.7:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongodb:5.0.8:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongodb:5.0.9:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongodb:5.0.10:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongodb:5.0.11:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongodb:5.0.12:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongodb:5.0.13:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongodb:5.0.14:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongodb:5.0.15:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongodb:5.0.16:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongodb:5.0.17:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongodb:5.0.18:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongodb:5.0.19:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongodb:5.0.20:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongodb:5.0.21:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongodb:6.0.0:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongodb:6.0.1:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongodb:6.0.2:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongodb:6.0.3:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongodb:6.0.4:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongodb:6.0.5:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongodb:6.0.6:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongodb:6.0.7:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongodb:6.0.8:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongodb:6.0.9:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongodb:6.0.10:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongodb:7.0.0:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongodb:7.0.1:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongodb:7.0.2:*:*:*:*:*:*:*
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 5.4
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L
version: 3.1
Published: 2024-07-01T14:40:32.566Z
CVE-2024-6377 URL redirection to untrusted site (open redirect) vulnerability affecting 3DPassport in 3DSwymer from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024x
An URL redirection to untrusted site (open redirect) vulnerability affecting 3DPassport in 3DSwymer from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024x allows an attacker to redirect users to an arbitrary website via a crafted URL.
Problem types: cwe_id: CWE-601
description: CWE-601 URL Redirection to Untrusted Site ('Open Redirect')
Affected products: vendor: Dassault Systèmes
product: 3DSwymer
default_status: unaffected
CVSS v3.1: version: 3.1
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: NONE
baseSeverity: HIGH
baseScore: 8.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Published: 2024-08-20T13:45:35.407Z
CVE-2024-6378 Reflected Cross-site Scripting (XSS) vulnerability affecting ENOVIA Collaborative Industry Innovator from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024x
A reflected Cross-site Scripting (XSS) vulnerability affecting ENOVIA Collaborative Industry Innovator from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024x allows an attacker to execute arbitrary script code in user's browser session.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Affected products: vendor: Dassault Systèmes
product: ENOVIA Collaborative Industry Innovator
default_status: unaffected
CVSS v3.1: version: 3.1
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: REQUIRED
scope: CHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: NONE
baseSeverity: HIGH
baseScore: 8.7
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
Published: 2024-08-20T13:45:10.521Z
CVE-2024-6379 Reflected Cross-site Scripting (XSS) vulnerability affecting 3DSwymer from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024x
A reflected Cross-site Scripting (XSS) vulnerability affecting 3DSwymer from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024x allows an attacker to execute arbitrary script code in user's browser session.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Affected products: vendor: Dassault Systèmes
product: 3DSwymer
default_status: unaffected
CVSS v3.1: version: 3.1
attackVector: NETWORK
attackComplexity: HIGH
privilegesRequired: LOW
userInteraction: REQUIRED
scope: CHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: NONE
baseSeverity: HIGH
baseScore: 7.7
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N
Published: 2024-08-20T13:44:53.360Z