rainbutterfly/cve_corpus huggingface dataset:
CVE-2024-6380 Reflected Cross-site Scripting (XSS) vulnerability affecting ENOVIA Collaborative Industry Innovator from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024x
A reflected Cross-site Scripting (XSS) vulnerability affecting ENOVIA Collaborative Industry Innovator from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024x allows an attacker to execute arbitrary script code in user's browser session.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Affected products: vendor: Dassault Systèmes
product: ENOVIA Collaborative Industry Innovator
default_status: unaffected
CVSS v3.1: version: 3.1
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: REQUIRED
scope: CHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: NONE
baseSeverity: HIGH
baseScore: 8.7
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
Published: 2024-10-16T11:28:28.769Z
CVE-2024-6382 Adversarial unsanitized input may cause MongoDB Rust Driver to issue unintended commands.
Incorrect handling of certain string inputs may result in MongoDB Rust driver constructing unintended server commands. This may cause unexpected application behavior including data modification. This issue affects MongoDB Rust Driver 2.0 versions prior to 2.8.2
Problem types: cwe_id: CWE-228
description: CWE-228: Improper Handling of Syntactically Invalid Structure
Affected products: vendor: MongoDB Inc
product: MongoDB Rust Driver
cpes: cpe:2.3:a:mongodb:rust-driver:2.0.0:alpha:*:*:*:mongodb:*:*
cpe:2.3:a:mongodb:rust-driver:2.0.0:alpha1:*:*:*:mongodb:*:*
cpe:2.3:a:mongodb:rust-driver:2.0.0:beta:*:*:*:mongodb:*:*
cpe:2.3:a:mongodb:rust-driver:2.0.0:beta1:*:*:*:mongodb:*:*
cpe:2.3:a:mongodb:rust-driver:2.0.0:beta2:*:*:*:mongodb:*:*
cpe:2.3:a:mongodb:rust-driver:2.0.0:beta3:*:*:*:mongodb:*:*
cpe:2.3:a:mongodb:rust-driver:2.0.0:*:*:*:*:mongodb:*:*
cpe:2.3:a:mongodb:rust-driver:2.0.1:*:*:*:*:mongodb:*:*
cpe:2.3:a:mongodb:rust-driver:2.0.2:*:*:*:*:mongodb:*:*
cpe:2.3:a:mongodb:rust-driver:2.1.0:beta:*:*:*:mongodb:*:*
cpe:2.3:a:mongodb:rust-driver:2.1.0:*:*:*:*:mongodb:*:*
cpe:2.3:a:mongodb:rust-driver:2.2.0:beta:*:*:*:mongodb:*:*
cpe:2.3:a:mongodb:rust-driver:2.2.0:*:*:*:*:mongodb:*:*
cpe:2.3:a:mongodb:rust-driver:2.2.1:*:*:*:*:mongodb:*:*
cpe:2.3:a:mongodb:rust-driver:2.2.2:*:*:*:*:mongodb:*:*
cpe:2.3:a:mongodb:rust-driver:2.2.3:beta:*:*:*:mongodb:*:*
cpe:2.3:a:mongodb:rust-driver:2.3.0:*:*:*:*:mongodb:*:*
cpe:2.3:a:mongodb:rust-driver:2.3.1:*:*:*:*:mongodb:*:*
cpe:2.3:a:mongodb:rust-driver:2.4.0:beta:*:*:*:mongodb:*:*
cpe:2.3:a:mongodb:rust-driver:2.4.0:beta2:*:*:*:mongodb:*:*
cpe:2.3:a:mongodb:rust-driver:2.4.0:*:*:*:*:mongodb:*:*
cpe:2.3:a:mongodb:rust-driver:2.5.0:*:*:*:*:mongodb:*:*
cpe:2.3:a:mongodb:rust-driver:2.6.0:*:*:*:*:mongodb:*:*
cpe:2.3:a:mongodb:rust-driver:2.6.1:*:*:*:*:mongodb:*:*
cpe:2.3:a:mongodb:rust-driver:2.7.0:beta:*:*:*:mongodb:*:*
cpe:2.3:a:mongodb:rust-driver:2.7.0:beta1:*:*:*:mongodb:*:*
cpe:2.3:a:mongodb:rust-driver:2.7.0:*:*:*:*:mongodb:*:*
cpe:2.3:a:mongodb:rust-driver:2.7.1:*:*:*:*:mongodb:*:*
cpe:2.3:a:mongodb:rust-driver:2.8.0:*:*:*:*:mongodb:*:*
cpe:2.3:a:mongodb:rust-driver:2.8.1:*:*:*:*:mongodb:*:*
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 6.4
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: LOW
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:L
version: 3.1
Published: 2024-07-02T17:17:50.237Z
CVE-2024-6384 Backup files may be downloaded by underprivileged users in MongoDB Enterprise Server
"Hot" backup files may be downloaded by underprivileged users, if they are capable of acquiring a unique backup identifier. This issue affects MongoDB Enterprise Server v6.0 versions prior to 6.0.16, MongoDB Enterprise Server v7.0 versions prior to 7.0.11 and MongoDB Enterprise Server v7.3 versions prior to 7.3.3
Problem types: cwe_id: CWE-285
description: CWE-285: Improper Authorization
Affected products: vendor: MongoDB Inc
product: MongoDB Server
cpes: cpe:2.3:a:mongodb:mongodb:6.0.0:*:*:*:enterprise:*:*:*
cpe:2.3:a:mongodb:mongodb:6.0.1:*:*:*:enterprise:*:*:*
cpe:2.3:a:mongodb:mongodb:6.0.2:*:*:*:enterprise:*:*:*
cpe:2.3:a:mongodb:mongodb:6.0.3:*:*:*:enterprise:*:*:*
cpe:2.3:a:mongodb:mongodb:6.0.4:*:*:*:enterprise:*:*:*
cpe:2.3:a:mongodb:mongodb:6.0.5:*:*:*:enterprise:*:*:*
cpe:2.3:a:mongodb:mongodb:6.0.6:*:*:*:enterprise:*:*:*
cpe:2.3:a:mongodb:mongodb:6.0.7:*:*:*:enterprise:*:*:*
cpe:2.3:a:mongodb:mongodb:6.0.8:*:*:*:enterprise:*:*:*
cpe:2.3:a:mongodb:mongodb:6.0.9:*:*:*:enterprise:*:*:*
cpe:2.3:a:mongodb:mongodb:6.0.10:*:*:*:enterprise:*:*:*
cpe:2.3:a:mongodb:mongodb:6.0.11:*:*:*:enterprise:*:*:*
cpe:2.3:a:mongodb:mongodb:6.0.12:*:*:*:enterprise:*:*:*
cpe:2.3:a:mongodb:mongodb:6.0.13:*:*:*:enterprise:*:*:*
cpe:2.3:a:mongodb:mongodb:6.0.14:*:*:*:enterprise:*:*:*
cpe:2.3:a:mongodb:mongodb:6.0.15:*:*:*:enterprise:*:*:*
cpe:2.3:a:mongodb:mongodb:7.0.0:*:*:*:enterprise:*:*:*
cpe:2.3:a:mongodb:mongodb:7.0.1:*:*:*:enterprise:*:*:*
cpe:2.3:a:mongodb:mongodb:7.0.2:*:*:*:enterprise:*:*:*
cpe:2.3:a:mongodb:mongodb:7.0.3:*:*:*:enterprise:*:*:*
cpe:2.3:a:mongodb:mongodb:7.0.4:*:*:*:enterprise:*:*:*
cpe:2.3:a:mongodb:mongodb:7.0.5:*:*:*:enterprise:*:*:*
cpe:2.3:a:mongodb:mongodb:7.0.6:*:*:*:enterprise:*:*:*
cpe:2.3:a:mongodb:mongodb:7.0.7:*:*:*:enterprise:*:*:*
cpe:2.3:a:mongodb:mongodb:7.0.8:*:*:*:enterprise:*:*:*
cpe:2.3:a:mongodb:mongodb:7.0.9:*:*:*:enterprise:*:*:*
cpe:2.3:a:mongodb:mongodb:7.3.1:*:*:*:enterprise:*:*:*
cpe:2.3:a:mongodb:mongodb:7.3.2:*:*:*:enterprise:*:*:*
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
version: 3.1
Published: 2024-08-13T14:22:22.847Z
CVE-2024-6385 Improper Access Control in GitLab
An issue was discovered in GitLab CE/EE affecting all versions starting from 15.8 prior to 16.11.6, starting from 17.0 prior to 17.0.4, and starting from 17.1 prior to 17.1.2, which allows an attacker to trigger a pipeline as another user under certain circumstances.
Problem types: cwe_id: CWE-284
description: CWE-284: Improper Access Control
Affected products: vendor: GitLab
product: GitLab
cpes: cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 9.6
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
version: 3.1
Credits: lang: en
value: Thanks [yvvdwf](https://hackerone.com/yvvdwf) for reporting this vulnerability through our HackerOne bug bounty program
Published: 2024-07-11T06:56:54.515Z
CVE-2024-6386 WPML Multilingual CMS <= 4.6.12 - Authenticated (Contributor+) Remote Code Execution via Twig Server-Side Template Injection
The WPML plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.6.12 via Twig Server-Side Template Injection. This is due to missing input validation and sanitization on the render function. This makes it possible for authenticated attackers, with Contributor-level access and above, to execute code on the server.
Problem types: cwe_id: CWE-1336
description: CWE-1336 Improper Neutralization of Special Elements Used in a Template Engine
Affected products: vendor: WPML
product: WPML
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
baseScore: 9.9
baseSeverity: CRITICAL
Credits: lang: en
value: Matthew Rollings
Published: 2024-08-21T20:29:23.090Z
CVE-2024-6387 Openssh: regresshion - race condition in ssh allows rce/dos
A security regression (CVE-2006-5051) was discovered in OpenSSH's server (sshd). There is a race condition which can lead sshd to handle some signals in an unsafe manner. An unauthenticated, remote attacker may be able to trigger it by failing to authenticate within a set time period.
Problem types: cwe_id: CWE-364
description: Signal Handler Race Condition
Affected products: default_status: unaffected
vendor: Red Hat
product: Red Hat Enterprise Linux 9
cpes: cpe:/a:redhat:enterprise_linux:9::appstream
cpe:/o:redhat:enterprise_linux:9::baseos
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 9
cpes: cpe:/a:redhat:enterprise_linux:9::appstream
cpe:/o:redhat:enterprise_linux:9::baseos
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions
cpes: cpe:/a:redhat:rhel_e4s:9.0::appstream
cpe:/o:redhat:rhel_e4s:9.0::baseos
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 9.2 Extended Update Support
cpes: cpe:/o:redhat:rhel_eus:9.2::baseos
cpe:/a:redhat:rhel_eus:9.2::appstream
default_status: affected
vendor: Red Hat
product: Red Hat OpenShift Container Platform 4.13
cpes: cpe:/a:redhat:openshift:4.13::el9
cpe:/a:redhat:openshift:4.13::el8
default_status: affected
vendor: Red Hat
product: Red Hat OpenShift Container Platform 4.14
cpes: cpe:/a:redhat:openshift:4.14::el8
cpe:/a:redhat:openshift:4.14::el9
default_status: affected
vendor: Red Hat
product: Red Hat OpenShift Container Platform 4.15
cpes: cpe:/a:redhat:openshift:4.15::el8
cpe:/a:redhat:openshift:4.15::el9
default_status: affected
vendor: Red Hat
product: Red Hat OpenShift Container Platform 4.16
cpes: cpe:/a:redhat:openshift:4.16::el9
default_status: affected
vendor: Red Hat
product: Red Hat Ceph Storage 5
cpes: cpe:/a:redhat:ceph_storage:5
default_status: unaffected
vendor: Red Hat
product: Red Hat Ceph Storage 6
cpes: cpe:/a:redhat:ceph_storage:6
default_status: unaffected
vendor: Red Hat
product: Red Hat Ceph Storage 7
cpes: cpe:/a:redhat:ceph_storage:7
default_status: unaffected
vendor: Red Hat
product: Red Hat Enterprise Linux 10
cpes: cpe:/o:redhat:enterprise_linux:10
default_status: unaffected
vendor: Red Hat
product: Red Hat Enterprise Linux 6
cpes: cpe:/o:redhat:enterprise_linux:6
default_status: unaffected
vendor: Red Hat
product: Red Hat Enterprise Linux 7
cpes: cpe:/o:redhat:enterprise_linux:7
default_status: unaffected
vendor: Red Hat
product: Red Hat Enterprise Linux 8
cpes: cpe:/o:redhat:enterprise_linux:8
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.1
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Red Hat would like to thank Qualys Threat Research Unit (TRU) (Qualys) for reporting this issue.
Published: 2024-07-01T12:37:25.431Z
CVE-2024-6388 
Marco Trevisan discovered that the Ubuntu Advantage Desktop Daemon, before version 1.12, leaks the Pro token to unprivileged users by passing the token as an argument in plaintext.
Problem types: cwe_id: CWE-497
description: CWE-497
Affected products: vendor: Canonical Ltd.
product: Ubuntu Advantage Desktop Pro
CVSS v3.1: version: 3.1
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: REQUIRED
scope: CHANGED
confidentialityImpact: HIGH
integrityImpact: NONE
availabilityImpact: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N
baseScore: 5.9
baseSeverity: MEDIUM
Credits: lang: en
value: Marco Trevisan
Published: 2024-06-27T15:39:04.168Z
CVE-2024-6389 Exposure of Sensitive System Information to an Unauthorized Control Sphere in GitLab
An issue was discovered in GitLab-CE/EE affecting all versions starting with 17.0 before 17.1.7, 17.2 before 17.2.5, and 17.3 before 17.3.2. An attacker as a guest user was able to access commit information via the release Atom endpoint, contrary to permissions.
Problem types: cwe_id: CWE-497
description: CWE-497: Exposure of Sensitive System Information to an Unauthorized Control Sphere
Affected products: vendor: GitLab
product: GitLab
cpes: cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: NONE
availabilityImpact: NONE
baseScore: 4.3
baseSeverity: MEDIUM
Credits: lang: en
value: Thanks [ashish_r_padelkar](https://hackerone.com/ashish_r_padelkar) for reporting this vulnerability through our HackerOne bug bounty program
Published: 2024-09-12T16:56:48.267Z
CVE-2024-6390 Quiz and Survey Master (QSM) < 9.1.0 - Contributor+ Stored XSS
The Quiz and Survey Master (QSM)  WordPress plugin before 9.1.0 does not properly sanitise and escape some of its Quizz settings, which could allow high privilege users such as contributor to perform Stored Cross-Site Scripting attacks
Problem types: description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: Quiz and Survey Master (QSM)
default_status: unaffected
Credits: lang: en
value: Dmitrii Ignatyev
lang: en
value: WPScan
Published: 2024-08-03T06:00:05.411Z
CVE-2024-6391 oik <= 4.10.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via bw_button Shortcode
The oik plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's bw_button shortcode in all versions up to, and including, 4.10.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: bobbingwide
product: oik
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
baseScore: 6.4
baseSeverity: MEDIUM
Credits: lang: en
value: Rafshanzani Suhada
Published: 2024-07-09T11:33:21.554Z
CVE-2024-6392 Image Optimizer, Resizer and CDN – Sirv <= 7.2.7 - Authenticated(Subscriber+) Missing Authorization to Plugin Settings Update
The Image Optimizer, Resizer and CDN – Sirv plugin for WordPress is vulnerable to unauthorized plugin settings modification due to missing capability checks on the plugin functions in all versions up to, and including, 7.2.7. This makes it possible for authenticated attackers, with Subscriber-level access and above, to change the connected Sirv account to an attacker-controlled one.
Problem types: cwe_id: CWE-862
description: CWE-862 Missing Authorization
Affected products: vendor: sirv
product: Image Optimizer, Resizer and CDN – Sirv
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
baseScore: 5.4
baseSeverity: MEDIUM
Credits: lang: en
value: Rafshanzani Suhada
Published: 2024-07-11T21:31:34.282Z
CVE-2024-6393 NextGEN Gallery < 3.59.5 - Admin+ Stored XSS
The Photo Gallery, Sliders, Proofing and   WordPress plugin before 3.59.5 does not sanitise and escape some of its Images settings, which could allow high privilege users such as Admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Problem types: description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: Photo Gallery, Sliders, Proofing and Themes
default_status: unaffected
Credits: lang: en
value: Dmitrii Ignatyev
lang: en
value: WPScan
Published: 2024-11-25T06:00:06.473Z
CVE-2024-6394 Local File Inclusion in parisneo/lollms-webui
A Local File Inclusion vulnerability exists in parisneo/lollms-webui versions below v9.8. The vulnerability is due to unverified path concatenation in the `serve_js` function in `app.py`, which allows attackers to perform path traversal attacks. This can lead to unauthorized access to arbitrary files on the server, potentially exposing sensitive information such as private SSH keys, configuration files, and source code.
Problem types: cwe_id: CWE-29
description: CWE-29 Path Traversal: '\..\filename'
Affected products: vendor: parisneo
product: parisneo/lollms-webui
Published: 2024-09-30T08:09:10.169Z
CVE-2024-6395 GitHub Enterprise Server Information Disclosure Vulnerability Exposes Private Repository Names via Deploy Keys
An exposure of sensitive information vulnerability in GitHub Enterprise Server would allow an attacker to enumerate the names of private repositories that utilize deploy keys. This vulnerability did not allow unauthorized access to any repository content besides the name. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.14 and was fixed in versions 3.13.1, 3.12.6, 3.11.12, 3.10.14, and 3.9.17. This vulnerability was reported via the GitHub Bug Bounty program.
Problem types: cwe_id: CWE-200
description: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
Affected products: vendor: GitHub
product: GitHub Enterprise Server
default_status: affected
Credits: lang: en
value: ahacker1
Published: 2024-07-16T21:27:10.901Z
CVE-2024-6396 Arbitrary File Overwrite and Data Exfiltration in aimhubio/aim
A vulnerability in the `_backup_run` function in aimhubio/aim version 3.19.3 allows remote attackers to overwrite any file on the host server and exfiltrate arbitrary data. The vulnerability arises due to improper handling of the `run_hash` and `repo.path` parameters, which can be manipulated to create and write to arbitrary file paths. This can lead to denial of service by overwriting critical system files, loss of private data, and potential remote code execution. 
Problem types: cwe_id: CWE-29
description: CWE-29 Path Traversal: '\..\filename'
Affected products: vendor: aimhubio
product: aimhubio/aim
Published: 2024-07-12T00:00:14.599Z
CVE-2024-6397 InstaWP Connect – 1-click WP Staging & Migration <= 0.1.0.44 - Authentication Bypass to Admin
The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 0.1.0.44. This is due to insufficient verification of the API key. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the username, and to perform a variety of other administrative tasks. NOTE: This vulnerability was partially fixed in 0.1.0.44, but was still exploitable via Cross-Site Request Forgery.
Problem types: cwe_id: CWE-288
description: CWE-288 Authentication Bypass Using an Alternate Path or Channel
Affected products: vendor: instawp
product: InstaWP Connect – 1-click WP Staging & Migration
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
baseScore: 9.8
baseSeverity: CRITICAL
Credits: lang: en
value: Truoc Phan
Published: 2024-07-11T03:33:19.573Z
CVE-2024-6398 
An information disclosure vulnerability in SWG in versions 12.x prior to 12.2.10 and 11.x prior to 11.2.24 allows information stored in a customizable block page to be disclosed to third-party websites due to Same Origin Policy Bypass of browsers in certain scenarios. The risk is low, because other recommended default security policies such as URL categorization and GTI are in place in most policies to block access to uncategorized/high risk websites. Any information disclosed depends on how the customers have customized the block pages.
Problem types: cwe_id: CWE-200
description: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
Affected products: vendor: Skyhigh
product: Secure Web Gateway
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
version: 3.1
Credits: lang: en
value: RedTeam Pentesting GmbH
Published: 2024-07-15T08:52:24.973Z
CVE-2024-6400 Cleartext Storage of Username and Password in Finrota's Netahsilat
Cleartext Storage of Sensitive Information, Exposure of Sensitive Information Through Data Queries vulnerability in Finrota Netahsilat allows Retrieve Embedded Sensitive Data, Authentication Bypass, IMAP/SMTP Command Injection, Collect Data from Common Resource Locations.


This issue solved in versions 1.21.10, 1.23.01, 1.23.08, 1.23.11 and 1.24.03.
Problem types: cwe_id: CWE-312
description: CWE-312 Cleartext Storage of Sensitive Information
cwe_id: CWE-202
description: CWE-202 Exposure of Sensitive Information Through Data Queries
Affected products: vendor: Finrota
product: Netahsilat
default_status: unaffected
Credits: lang: en
value: Kaan ATMACA
lang: en
value: Secure Future Inc.
Published: 2024-10-04T11:12:30.441Z
CVE-2024-6401 SQLi in SFS Consulting's InsureE GL
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in SFS Consulting InsureE GL allows SQL Injection.

This issue affects InsureE GL: before 4.6.2.
Problem types: cwe_id: CWE-89
description: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: SFS Consulting
product: InsureE GL
default_status: unaffected
Credits: lang: en
value: Yağız KOÇER
lang: en
value: Secure Future Inc.
Published: 2024-09-16T14:55:26.359Z
CVE-2024-6402 Tenda A301 SetOnlineDevName fromSetWirelessRepeat stack-based overflow
A vulnerability classified as critical was found in Tenda A301 15.13.08.12. Affected by this vulnerability is the function fromSetWirelessRepeat of the file /goform/SetOnlineDevName. The manipulation of the argument devName leads to stack-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-269947. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Problem types: cwe_id: CWE-121
description: CWE-121 Stack-based Buffer Overflow
Affected products: vendor: Tenda
product: A301
CVSS v3.1: version: 3.1
baseScore: 6.5
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
baseSeverity: MEDIUM
Credits: lang: en
value: dexter_zg (VulDB User)
Published: 2024-06-28T17:00:05.443Z
CVE-2024-6403 Tenda A301 SetOnlineDevName formWifiBasicSet stack-based overflow
A vulnerability, which was classified as critical, has been found in Tenda A301 15.13.08.12. Affected by this issue is the function formWifiBasicSet of the file /goform/SetOnlineDevName. The manipulation of the argument devName leads to stack-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-269948. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Problem types: cwe_id: CWE-121
description: CWE-121 Stack-based Buffer Overflow
Affected products: vendor: Tenda
product: A301
CVSS v3.1: version: 3.1
baseScore: 6.5
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
baseSeverity: MEDIUM
Credits: lang: en
value: C9Y_57 (VulDB User)
Published: 2024-06-28T17:00:07.083Z