rainbutterfly/cve_corpus huggingface dataset:
CVE-2024-6029 Tesla Model S Iris Modem Race Condition Firewall Bypass Vulnerability
Tesla Model S Iris Modem Race Condition Firewall Bypass Vulnerability. This vulnerability allows network-adjacent attackers to bypass the firewall on the Iris modem in affected Tesla Model S vehicles. Authentication is not required to exploit this vulnerability.
 
The specific flaw exists within the firewall service. The issue results from a failure to obtain the xtables lock. An attacker can leverage this vulnerability to bypass firewall rules. Was ZDI-CAN-23197.
Problem types: cwe_id: CWE-367
description: CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition
Affected products: vendor: Tesla
product: Model S
default_status: unknown
Published: 2025-04-30T20:00:25.966Z
CVE-2024-6030 Tesla Model S oFono Unnecessary Privileges Sandbox Escape Vulnerability
Tesla Model S oFono Unnecessary Privileges Sandbox Escape Vulnerability. This vulnerability allows local attackers to escape the sandbox on affected Tesla Model S vehicles. An attacker must first obtain the ability to execute code within the sandbox on the target system in order to exploit this vulnerability.
 
The specific flaw exists within the oFono process. The process allows an attacker to modify interfaces. An attacker can leverage this vulnerability to bypass the iptables network sandbox. Was ZDI-CAN-23200.
Problem types: cwe_id: CWE-250
description: CWE-250: Execution with Unnecessary Privileges
Affected products: vendor: Tesla
product: Model S
default_status: unknown
Published: 2025-04-30T20:00:36.899Z
CVE-2024-6031 Tesla Model S oFono AT Command Heap-based Buffer Overflow Code Execution Vulnerability
Tesla Model S oFono AT Command Heap-based Buffer Overflow Code Execution Vulnerability. This vulnerability allows local attackers to execute arbitrary code on affected Tesla Model S vehicles. An attacker must first obtain the ability to execute code on the target modem in order to exploit this vulnerability.
 
The specific flaw exists within the parsing of responses from AT commands. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the device. Was ZDI-CAN-23198.
Problem types: cwe_id: CWE-122
description: CWE-122: Heap-based Buffer Overflow
Affected products: vendor: Tesla
product: Model S
default_status: unknown
Published: 2025-04-30T20:00:29.921Z
CVE-2024-6032 Tesla Model S Iris Modem ql_atfwd Command Injection Code Execution Vulnerability
Tesla Model S Iris Modem ql_atfwd Command Injection Code Execution Vulnerability. This vulnerability allows local attackers to execute arbitrary code on affected Tesla Model S vehicles. An attacker must first obtain the ability to execute code on the target system in order to exploit this vulnerability.
 
The specific flaw exists within the ql_atfwd process. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code on the target modem in the context of root. Was ZDI-CAN-23201.
Problem types: cwe_id: CWE-78
description: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected products: vendor: Tesla
product: Model S
default_status: unknown
Published: 2025-04-30T20:00:40.719Z
CVE-2024-6033 Event Manager, Events Calendar, Tickets, Registrations – Eventin <= 4.0.4 - Missing Authorization to Authenticated (Contributor+) Event Data Import
The Event Manager, Events Calendar, Tickets, Registrations – Eventin plugin for WordPress is vulnerable to unauthorized data importation due to a missing capability check on the 'import_file' function in all versions up to, and including, 4.0.4. This makes it possible for authenticated attackers, with Contributor-level access and above, to import events, speakers, schedules and attendee data.
Problem types: cwe_id: CWE-862
description: CWE-862 Missing Authorization
Affected products: vendor: arraytics
product: Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered)
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
baseScore: 4.3
baseSeverity: MEDIUM
Credits: lang: en
value: Peter Thaleikis
Published: 2024-07-17T06:45:07.709Z
CVE-2024-6035 Stored XSS in gaizhenbiao/chuanhuchatgpt
A Stored Cross-Site Scripting (XSS) vulnerability exists in gaizhenbiao/chuanhuchatgpt version 20240410. This vulnerability allows an attacker to inject malicious JavaScript code into the chat history file. When a victim uploads this file, the malicious script is executed in the victim's browser. This can lead to user data theft, session hijacking, malware distribution, and phishing attacks.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: gaizhenbiao
product: gaizhenbiao/chuanhuchatgpt
Published: 2024-07-11T10:41:27.535Z
CVE-2024-6036 Denial of Service in gaizhenbiao/chuanhuchatgpt
A vulnerability in gaizhenbiao/chuanhuchatgpt version 20240410 allows any user to restart the server at will by sending a specific request to the `/queue/join?` endpoint with `"fn_index":66`. This unrestricted server restart capability can severely disrupt service availability, cause data loss or corruption, and potentially compromise system integrity.
Problem types: cwe_id: CWE-400
description: CWE-400 Uncontrolled Resource Consumption
Affected products: vendor: gaizhenbiao
product: gaizhenbiao/chuanhuchatgpt
Published: 2024-07-10T22:57:33.930Z
CVE-2024-6037 Arbitrary Folder Creation in gaizhenbiao/chuanhuchatgpt
A vulnerability in gaizhenbiao/chuanhuchatgpt version 20240410 allows an attacker to create arbitrary folders at any location on the server, including the root directory (C: dir). This can lead to uncontrolled resource consumption, resulting in resource exhaustion, denial of service (DoS), server unavailability, and potential data loss or corruption.
Problem types: cwe_id: CWE-770
description: CWE-770 Allocation of Resources Without Limits or Throttling
Affected products: vendor: gaizhenbiao
product: gaizhenbiao/chuanhuchatgpt
Published: 2024-07-10T22:43:22.785Z
CVE-2024-6038 ReDoS Vulnerability in gaizhenbiao/chuanhuchatgpt
A Regular Expression Denial of Service (ReDoS) vulnerability exists in the latest version of gaizhenbiao/chuanhuchatgpt. The vulnerability is located in the filter_history function within the utils.py module. This function takes a user-provided keyword and attempts to match it against chat history filenames using a regular expression search. Due to the lack of sanitization or validation of the keyword parameter, an attacker can inject a specially crafted regular expression, leading to a denial of service condition. This can cause severe degradation of service performance and potential system unavailability.
Problem types: cwe_id: CWE-1333
description: CWE-1333 Inefficient Regular Expression Complexity
Affected products: vendor: gaizhenbiao
product: gaizhenbiao/chuanhuchatgpt
Published: 2024-06-27T18:41:45.405Z
CVE-2024-6039 Feng Office Workspaces sql injection
A vulnerability, which was classified as critical, was found in Feng Office 3.11.1.2. Affected is an unknown function of the component Workspaces. The manipulation of the argument dim leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-268752.
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: n/a
product: Feng Office
CVSS v3.1: version: 3.1
baseScore: 6.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
baseSeverity: MEDIUM
Published: 2024-06-16T22:00:07.255Z
CVE-2024-6040 Missing client_id in parisneo/lollms-webui
In parisneo/lollms-webui version v9.8, the lollms_binding_infos is missing the client_id parameter, which leads to multiple security vulnerabilities. Specifically, the endpoints /reload_binding, /install_binding, /reinstall_binding, /unInstall_binding, /set_active_binding_settings, and /update_binding_settings are susceptible to CSRF attacks and local attacks. An attacker can exploit this vulnerability to perform unauthorized actions on the victim's machine.
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: parisneo
product: parisneo/lollms
Published: 2024-08-01T15:32:43.624Z
CVE-2024-6041 itsourcecode Gym Management System manage_user.php sql injection
A vulnerability was found in itsourcecode Gym Management System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file manage_user.php. The manipulation of the argument id leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-268765 was assigned to this vulnerability.
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: itsourcecode
product: Gym Management System
CVSS v3.1: version: 3.1
baseScore: 6.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
baseSeverity: MEDIUM
Credits: lang: en
value: siiiiiick (VulDB User)
Published: 2024-06-16T23:00:05.773Z
CVE-2024-6042 itsourcecode Real Estate Management System property-detail.php sql injection
A vulnerability was found in itsourcecode Real Estate Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file property-detail.php. The manipulation of the argument id leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-268766 is the identifier assigned to this vulnerability.
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: itsourcecode
product: Real Estate Management System
CVSS v3.1: version: 3.1
baseScore: 7.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
baseSeverity: HIGH
Credits: lang: en
value: Cormac (VulDB User)
Published: 2024-06-16T23:31:04.402Z
CVE-2024-6043 SourceCodester Best House Rental Management System admin_class.php login sql injection
A vulnerability classified as critical has been found in SourceCodester Best House Rental Management System 1.0. This affects the function login of the file admin_class.php. The manipulation of the argument username leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-268767.
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: SourceCodester
product: Best House Rental Management System
CVSS v3.1: version: 3.1
baseScore: 7.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
baseSeverity: HIGH
Credits: lang: en
value: y3z1f4n (VulDB User)
Published: 2024-06-17T00:00:05.428Z
CVE-2024-6044 D-Link router - Arbitrary File Reading
Certain models of D-Link wireless routers have a path traversal vulnerability. Unauthenticated attackers on the same local area network can read arbitrary system files by manipulating the URL.
Problem types: cwe_id: CWE-22
description: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products: vendor: D-Link
product: G403
default_status: unaffected
vendor: D-Link
product: G415
default_status: unaffected
vendor: D-Link
product: G416
default_status: unaffected
vendor: D-Link
product: M18
default_status: unaffected
vendor: D-Link
product: R03
default_status: unaffected
vendor: D-Link
product: R04
default_status: unaffected
vendor: D-Link
product: R12
default_status: unaffected
vendor: D-Link
product: R18
default_status: unaffected
vendor: D-Link
product: E30
default_status: unaffected
vendor: D-Link
product: M30
default_status: unaffected
vendor: D-Link
product: M32
default_status: unaffected
vendor: D-Link
product: M60
default_status: unaffected
vendor: D-Link
product: R32
default_status: unaffected
vendor: D-Link
product: E15
default_status: unaffected
vendor: D-Link
product: R15
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: ADJACENT_NETWORK
availabilityImpact: NONE
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
version: 3.1
Published: 2024-06-17T02:30:04.564Z
CVE-2024-6045 D-Link router - Hidden Backdoor
Certain models of D-Link wireless routers contain an undisclosed factory testing backdoor. Unauthenticated attackers on the local area network can force the device to enable Telnet service by accessing a specific URL and can log in by using the administrator credentials obtained from analyzing the firmware.
Problem types: cwe_id: CWE-912
description: CWE-912: Hidden Functionality
cwe_id: CWE-798
description: CWE-798: Use of Hard-coded Credentials
Affected products: vendor: D-Link
product: G403
default_status: unaffected
vendor: D-Link
product: G415
default_status: unaffected
vendor: D-Link
product: G416
default_status: unaffected
vendor: D-Link
product: M18
default_status: unaffected
vendor: D-Link
product: R03
default_status: unaffected
vendor: D-Link
product: R04
default_status: unaffected
vendor: D-Link
product: R12
default_status: unaffected
vendor: D-Link
product: R18
default_status: unaffected
vendor: D-Link
product: E30
default_status: unaffected
vendor: D-Link
product: M30
default_status: unaffected
vendor: D-Link
product: M32
default_status: unaffected
vendor: D-Link
product: M60
default_status: unaffected
vendor: D-Link
product: R32
default_status: unaffected
vendor: D-Link
product: E15
default_status: unaffected
vendor: D-Link
product: R15
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: ADJACENT_NETWORK
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2024-06-17T03:12:14.137Z
CVE-2024-6047 GeoVision EOL device - OS Command Injection
Certain EOL GeoVision devices fail to properly filter user input for the specific functionality. Unauthenticated remote attackers can exploit this vulnerability to inject and execute arbitrary system commands on the device.
Problem types: cwe_id: CWE-78
description: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected products: vendor: GeoVision
product: GV_DSP_LPR_V2
default_status: unaffected
vendor: GeoVision
product: GV_IPCAMD_GV_BX1500
default_status: unaffected
vendor: GeoVision
product: GV_IPCAMD_GV_CB220
default_status: unaffected
vendor: GeoVision
product: GV_IPCAMD_GV_EBL1100
default_status: unaffected
vendor: GeoVision
product: GV_IPCAMD_GV_EFD1100
default_status: unaffected
vendor: GeoVision
product: GV_IPCAMD_GV_FD2410
default_status: unaffected
vendor: GeoVision
product: GV_IPCAMD_GV_FD3400
default_status: unaffected
vendor: GeoVision
product: GV_IPCAMD_GV_FE3401
default_status: unaffected
vendor: GeoVision
product: GV_IPCAMD_GV_FE420
default_status: unaffected
vendor: GeoVision
product: GV-VS14_VS14
default_status: unaffected
vendor: GeoVision
product: GV_VS03
default_status: unaffected
vendor: GeoVision
product: GV_VS2410
default_status: unaffected
vendor: GeoVision
product: GV_VS28XX
default_status: unaffected
vendor: GeoVision
product: GV_VS216XX
default_status: unaffected
vendor: GeoVision
product: GV VS04A
default_status: unaffected
vendor: GeoVision
product: GV VS04H
default_status: unaffected
vendor: GeoVision
product: GVLX 4 V2
default_status: unaffected
vendor: GeoVision
product: GVLX 4 V3
default_status: unaffected
vendor: GeoVision
product: GV_IPCAMD_GV_BX130
default_status: unaffected
vendor: GeoVision
product: GV_GM8186_VS14
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2024-06-17T05:48:42.779Z
CVE-2024-6048 Openfind MailGates and MailAudit - OS Command Injection
Openfind's MailGates and MailAudit fail to properly filter user input when analyzing email attachments. An unauthenticated remote attacker can exploit this vulnerability to inject system commands and execute them on the remote server.
Problem types: cwe_id: CWE-78
description: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected products: vendor: Openfind
product: MailGates 5.0
default_status: unaffected
vendor: Openfind
product: MailAudit 5.0
default_status: unaffected
vendor: Openfind
product: MailGates 6.0
default_status: unaffected
vendor: Openfind
product: MailAudit 6.0
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2024-06-17T07:28:48.935Z
CVE-2024-6049 Unauthenticated Path Traversal
The web server of Lawo AG vsm LTC Time Sync (vTimeSync) is affected by a "..." (triple dot) path traversal vulnerability. By sending a specially crafted HTTP request, an unauthenticated remote attacker could download arbitrary files from the operating system. As a limitation, the exploitation is only possible if the requested file has some file extension, e. g. .exe or .txt.
Problem types: cwe_id: CWE-32
description: CWE-32: Path Traversal: '...' (Triple Dot)
Affected products: vendor: Lawo AG
product: vsm LTC Time Sync (vTimeSync)
default_status: affected
Credits: lang: en
value: Sandro Einfeldt, SEC Consult Vulnerability Lab
lang: en
value: Dennis Jung, SEC Consult Vulnerability Lab
lang: en
value: Johannes Greil, SEC Consult Vulnerability Lab
Published: 2024-10-24T07:47:40.320Z
CVE-2024-6050 Reflected XSS in SOWA OPAC
Improper Neutralization of Input During Web Page Generation vulnerability in SOKRATES-software SOWA OPAC allows a Reflected Cross-Site Scripting (XSS). An attacker might trick somebody into using a crafted URL, which will cause a script to be run in user's browser. This issue affects SOWA OPAC software in versions from 4.0 before 4.9.10, from 5.0 before 6.2.12.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Affected products: vendor: SOKRATES-software
product: SOWA OPAC
default_status: unaffected
Credits: lang: en
value: Kacper Rybczyński
Published: 2024-07-01T13:40:48.134Z
CVE-2024-6051 Cross Application Scripting in Redlink SDK
Cross Application Scripting vulnerability in Vercom S.A. Redlink SDK in specific situations allows local code injection and to manipulate the view of a vulnerable application.This issue affects Redlink SDK versions through 1.13.
Problem types: cwe_id: CWE-926
description: CWE-926 Improper Export of Android Application Components
Affected products: vendor: Vercom S.A.
product: Redlink SDK
default_status: unaffected
Credits: lang: en
value: Maksymilian Motyl (Immunity Systems)
Published: 2024-09-30T12:33:25.438Z
CVE-2024-6052 XSS in SQL check parameters
Stored XSS in Checkmk before versions 2.3.0p8, 2.2.0p29, 2.1.0p45, and 2.0.0 (EOL) allows users to execute arbitrary scripts by injecting HTML elements
Problem types: cwe_id: CWE-80
description: CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
Affected products: vendor: Checkmk GmbH
product: Checkmk
default_status: unaffected
CVSS v3.1: baseScore: 6.5
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
version: 3.1
Published: 2024-07-03T14:30:31.332Z
CVE-2024-6053 Improper access control in the clipboard synchronization feature
Improper access control in the clipboard synchronization feature in TeamViewer Full Client prior version 15.57 and TeamViewer Meeting prior version 15.55.3 can lead to unintentional sharing of the clipboard with the current presenter of a meeting.
Problem types: cwe_id: CWE-359
description: CWE-359 Exposure of Private Personal Information to an Unauthorized Actor
Affected products: vendor: TeamViewer
product: Meeting
default_status: unaffected
vendor: TeamViewer
product: Meeting
default_status: unaffected
vendor: TeamViewer
product: Meeting
default_status: unaffected
vendor: TeamViewer
product: Remote Full Client
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
version: 3.1
Published: 2024-08-28T16:30:58.925Z
CVE-2024-6054 Auto Featured Image <= 1.2 - Authenticated (Contributor+) Arbitrary File Upload
The Auto Featured Image plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'create_post_attachment_from_url' function in all versions up to, and including, 1.2. This makes it possible for authenticated attackers, with contributor-level and above permissions, to upload arbitrary files on the affected site's server which may make remote code execution possible.
Problem types: cwe_id: CWE-434
description: CWE-434 Unrestricted Upload of File with Dangerous Type
Affected products: vendor: ka-yue
product: Auto Featured Image
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
baseScore: 8.8
baseSeverity: HIGH
Credits: lang: en
value: István Márton
Published: 2024-06-27T02:03:00.212Z
CVE-2024-6055 
Improper removal of sensitive information in data source export feature in Devolutions Remote Desktop Manager 2024.1.32.0 and earlier on Windows allows an attacker that obtains the exported settings to recover powershell credentials configured on the data source via stealing the configuration file.
Affected products: vendor: Devolutions
product: Remote Desktop Manager
default_status: unaffected
Published: 2024-06-17T12:55:28.759Z
CVE-2024-6056 nasirkhan Laravel Starter Password Reset forgot-password observable response discrepancy
A vulnerability was found in nasirkhan Laravel Starter up to 11.8.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /forgot-password of the component Password Reset Handler. The manipulation of the argument Email leads to observable response discrepancy. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-268784. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Problem types: cwe_id: CWE-204
description: CWE-204 Observable Response Discrepancy
Affected products: vendor: nasirkhan
product: Laravel Starter
CVSS v3.1: version: 3.1
baseScore: 3.7
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
baseSeverity: LOW
Credits: lang: en
value: louay khammassi (VulDB User)
Published: 2024-06-17T17:31:04.907Z
CVE-2024-6057 
Improper authentication in the vault password feature in Devolutions Remote Desktop Manager 2024.1.31.0 and earlier allows an attacker that has compromised an access to an RDM instance to bypass the vault master password via the offline mode feature.
Affected products: vendor: Devolutions
product: Remote Desktop Manager
default_status: unaffected
Published: 2024-06-17T13:10:42.462Z