rainbutterfly/cve_corpus huggingface dataset:
CVE-2024-38865 Livestatus command injection in RestAPI
Improper neutralization of livestatus command delimiters in a specific endpoint within RestAPI of Checkmk prior to 2.2.0p39, 2.3.0p25, and 2.1.0p51 (EOL) allows arbitrary livestatus command execution. Exploitation requires the attacker to have a contact group assigned to their user account and for an event to originate from a host with the same contact group or from an event generated with an unknown host.
Problem types: cwe_id: CWE-140
description: CWE-140: Improper Neutralization of Delimiters
Affected products: vendor: Checkmk GmbH
product: Checkmk
default_status: unaffected
Published: 2025-04-10T07:35:35.143Z
CVE-2024-38866 Livestatus Injection in dynmaps
Improper neutralization of input in Nagvis before version 1.9.47 which can lead to livestatus injection
Problem types: cwe_id: CWE-140
description: CWE-140: Improper Neutralization of Delimiters
Affected products: vendor: Nagvis
product: Nagvis
default_status: unaffected
Published: 2025-05-27T07:01:35.160Z
CVE-2024-38868 Incorrect Authorization
Zohocorp ManageEngine Endpoint Central affected by Incorrect authorization vulnerability while isolating the devices.This issue affects Endpoint Central: before 11.3.2406.08 and before 11.3.2400.15
Problem types: cwe_id: CWE-863
description: CWE-863 Incorrect Authorization
Affected products: vendor: ManageEngine
product: Endpoint Central
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 7.6
baseSeverity: HIGH
confidentialityImpact: LOW
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L
version: 3.1
Published: 2024-08-30T17:44:38.932Z
CVE-2024-38869 Incorrect Authorization
Zohocorp ManageEngine Endpoint Central affected by Incorrect authorization vulnerability in remote office deploy configurations.This issue affects Endpoint Central: before 11.3.2416.04 and before 11.3.2400.25.
Problem types: cwe_id: CWE-863
description: CWE-863 Incorrect Authorization
Affected products: vendor: ManageEngine
product: Endpoint Central
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 8.3
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L
version: 3.1
Published: 2024-08-23T14:07:46.792Z
CVE-2024-38870 Stored XSS
Zohocorp ManageEngine OpManager, OpManager Plus, OpManager MSP and OpManager Enterprise Edition versions before 128104, from 128151 before 128238, from 128247 before 128250 are vulnerable to Stored XSS vulnerability in reports module.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Affected products: vendor: ManageEngine
product: OpManager, OpManager Plus, OpManager MSP, OpManager Enterprise Edition
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 3.5
baseSeverity: LOW
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N
version: 3.1
Published: 2024-07-17T16:48:58.815Z
CVE-2024-38871 SQL Injection
Zohocorp ManageEngine Exchange Reporter Plus versions 5717 and below are vulnerable to the authenticated SQL injection in the reports module.
Problem types: cwe_id: CWE-89
description: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: ManageEngine
product: Exchange Reporter Plus
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 8.3
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L
version: 3.1
Published: 2024-07-26T17:29:42.911Z
CVE-2024-38872 SQL Injection
Zohocorp ManageEngine Exchange Reporter Plus versions 5717 and below are vulnerable to the authenticated SQL injection in the monitoring module.
Problem types: cwe_id: CWE-89
description: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: ManageEngine
product: Exchange Reporter Plus
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 8.3
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L
version: 3.1
Published: 2024-07-26T17:30:23.932Z
CVE-2024-38873 
An issue was discovered in the friendlycaptcha_official (aka Integration of Friendly Captcha) extension before 0.1.4 for TYPO3. The extension fails to check the requirement of the captcha field in submitted form data, allowing a remote user to bypass the captcha check. This only affects the captcha integration for the ext:form extension.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AC:L/AV:N/A:L/C:N/I:N/PR:N/S:U/UI:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: LOW
baseScore: 5.3
baseSeverity: MEDIUM
Published: 2024-06-21T00:00:00.000Z
CVE-2024-38874 
An issue was discovered in the events2 (aka Events 2) extension before 8.3.8 and 9.x before 9.0.6 for TYPO3. Missing access checks in the management plugin lead to an insecure direct object reference (IDOR) vulnerability with the potential to activate or delete various events for unauthenticated users.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AC:L/AV:N/A:N/C:L/I:L/PR:L/S:U/UI:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: NONE
baseScore: 5.4
baseSeverity: MEDIUM
Published: 2024-06-21T00:00:00.000Z
CVE-2024-38875 
An issue was discovered in Django 4.2 before 4.2.14 and 5.0 before 5.0.7. urlize and urlizetrunc were subject to a potential denial of service attack via certain inputs with a very large number of brackets.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-07-10T00:00:00.000Z
CVE-2024-38876 
A vulnerability has been identified in Omnivise T3000 Application Server R9.2 (All versions), Omnivise T3000 Domain Controller R9.2 (All versions), Omnivise T3000 Product Data Management (PDM) R9.2 (All versions), Omnivise T3000 R8.2 SP3 (All versions), Omnivise T3000 R8.2 SP4 (All versions), Omnivise T3000 Terminal Server R9.2 (All versions), Omnivise T3000 Thin Client R9.2 (All versions), Omnivise T3000 Whitelisting Server R9.2 (All versions). The affected application regularly executes user modifiable code as a privileged user. This could allow a local authenticated attacker to execute arbitrary code with elevated privileges.
Problem types: cwe_id: CWE-552
description: CWE-552: Files or Directories Accessible to External Parties
Affected products: vendor: Siemens
product: Omnivise T3000 Application Server R9.2
default_status: unknown
vendor: Siemens
product: Omnivise T3000 Domain Controller R9.2
default_status: unknown
vendor: Siemens
product: Omnivise T3000 Product Data Management (PDM) R9.2
default_status: unknown
vendor: Siemens
product: Omnivise T3000 R8.2 SP3
default_status: unknown
vendor: Siemens
product: Omnivise T3000 R8.2 SP4
default_status: unknown
vendor: Siemens
product: Omnivise T3000 Terminal Server R9.2
default_status: unknown
vendor: Siemens
product: Omnivise T3000 Thin Client R9.2
default_status: unknown
vendor: Siemens
product: Omnivise T3000 Whitelisting Server R9.2
default_status: unknown
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:T/RC:C
baseScore: 7.8
baseSeverity: HIGH
Published: 2024-08-02T10:36:16.928Z
CVE-2024-38877 
A vulnerability has been identified in Omnivise T3000 Application Server R9.2 (All versions), Omnivise T3000 Domain Controller R9.2 (All versions), Omnivise T3000 Network Intrusion Detection System (NIDS) R9.2 (All versions), Omnivise T3000 Product Data Management (PDM) R9.2 (All versions), Omnivise T3000 R8.2 SP3 (All versions), Omnivise T3000 R8.2 SP4 (All versions), Omnivise T3000 Security Server R9.2 (All versions), Omnivise T3000 Terminal Server R9.2 (All versions), Omnivise T3000 Thin Client R9.2 (All versions), Omnivise T3000 Whitelisting Server R9.2 (All versions). The affected devices stores initial system credentials without sufficient protection.  An attacker with remote shell access or physical access could retrieve the credentials leading to confidentiality loss allowing the attacker to laterally move within the affected network.
Problem types: cwe_id: CWE-312
description: CWE-312: Cleartext Storage of Sensitive Information
Affected products: vendor: Siemens
product: Omnivise T3000 Application Server R9.2
default_status: unknown
vendor: Siemens
product: Omnivise T3000 Domain Controller R9.2
default_status: unknown
vendor: Siemens
product: Omnivise T3000 Network Intrusion Detection System (NIDS) R9.2
default_status: unknown
vendor: Siemens
product: Omnivise T3000 Product Data Management (PDM) R9.2
default_status: unknown
vendor: Siemens
product: Omnivise T3000 R8.2 SP3
default_status: unknown
vendor: Siemens
product: Omnivise T3000 R8.2 SP4
default_status: unknown
vendor: Siemens
product: Omnivise T3000 Security Server R9.2
default_status: unknown
vendor: Siemens
product: Omnivise T3000 Terminal Server R9.2
default_status: unknown
vendor: Siemens
product: Omnivise T3000 Thin Client R9.2
default_status: unknown
vendor: Siemens
product: Omnivise T3000 Whitelisting Server R9.2
default_status: unknown
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H/E:P/RL:O/RC:C
baseScore: 8.2
baseSeverity: HIGH
Published: 2024-08-02T10:36:18.219Z
CVE-2024-38878 
A vulnerability has been identified in Omnivise T3000 Application Server R9.2 (All versions), Omnivise T3000 R8.2 SP3 (All versions), Omnivise T3000 R8.2 SP4 (All versions). Affected devices allow authenticated users to export diagnostics data. The corresponding API endpoint is susceptible to path traversal and could allow an authenticated attacker to download arbitrary files from the file system.
Problem types: cwe_id: CWE-22
description: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products: vendor: Siemens
product: Omnivise T3000 Application Server R9.2
default_status: unknown
vendor: Siemens
product: Omnivise T3000 R8.2 SP3
default_status: unknown
vendor: Siemens
product: Omnivise T3000 R8.2 SP4
default_status: unknown
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
baseScore: 7.2
baseSeverity: HIGH
Published: 2024-08-02T10:36:19.439Z
CVE-2024-38879 
A vulnerability has been identified in Omnivise T3000 Application Server R9.2 (All versions), Omnivise T3000 R8.2 SP3 (All versions), Omnivise T3000 R8.2 SP4 (All versions). The affected system exposes the port of an internal application on the public network interface allowing an attacker to circumvent authentication and directly access the exposed application.
Problem types: cwe_id: CWE-20
description: CWE-20: Improper Input Validation
Affected products: vendor: Siemens
product: Omnivise T3000 Application Server R9.2
default_status: unknown
vendor: Siemens
product: Omnivise T3000 R8.2 SP3
default_status: unknown
vendor: Siemens
product: Omnivise T3000 R8.2 SP4
default_status: unknown
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C
baseScore: 7.5
baseSeverity: HIGH
Published: 2024-08-02T10:36:20.639Z
CVE-2024-38881 
An issue in Horizon Business Services Inc. Caterease 16.0.1.1663 through 24.0.1.2405 and possibly later versions, allows a remote attacker to perform a Rainbow Table Password cracking attack due to the use of one-way hashes without salts when storing user passwords.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-02T00:00:00.000Z
CVE-2024-38882 
An issue in Horizon Business Services Inc. Caterease 16.0.1.1663 through 24.0.1.2405 and possibly later versions, allows a remote attacker to perform command line execution through SQL Injection due to improper neutralization of special elements used in an OS command.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-02T00:00:00.000Z
CVE-2024-38883 
An issue in Horizon Business Services Inc. Caterease 16.0.1.1663 through 24.0.1.2405 and possibly later versions, allows a remote attacker to perform a Drop Encryption Level attack due to the selection of a less-secure algorithm during negotiation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-02T00:00:00.000Z
CVE-2024-38884 
An issue in Horizon Business Services Inc. Caterease 16.0.1.1663 through 24.0.1.2405 and possibly later versions, allows a local attacker to perform an Authentication Bypass attack due to improperly implemented security checks for standard authentication mechanisms
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-02T00:00:00.000Z
CVE-2024-38885 
An issue in Horizon Business Services Inc. Caterease 16.0.1.1663 through 24.0.1.2405 and possibly later versions, allows a remote attacker to perform unauthorized access using known operating system credentials due to hardcoded SQL user credentials in the client application.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-02T00:00:00.000Z
CVE-2024-38886 
An issue in Horizon Business Services Inc. Caterease 16.0.1.1663 through 24.0.1.2405 and possibly later versions, allows a remote attacker to perform a Traffic Injection attack due to improper verification of the source of a communication channel.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-02T00:00:00.000Z
CVE-2024-38887 
An issue in Horizon Business Services Inc. Caterease 16.0.1.1663 through 24.0.1.2405 and possibly later versions, allows a remote attacker to expand control over the operating system from the database due to the execution of commands with unnecessary privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-02T00:00:00.000Z
CVE-2024-38888 
An issue in Horizon Business Services Inc. Caterease 16.0.1.1663 through 24.0.1.2405 and possibly later versions, allows a local attacker to perform a Password Brute Forcing attack due to improper restriction of excessive authentication attempts.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-02T00:00:00.000Z
CVE-2024-38889 
An issue in Horizon Business Services Inc. Caterease 16.0.1.1663 through 24.0.1.2405 and possibly later versions, allows a remote attacker to perform SQL Injection due to improper neutralization of special elements used in an SQL command.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-02T00:00:00.000Z
CVE-2024-38890 
An issue in Horizon Business Services Inc. Caterease Software 16.0.1.1663 through 24.0.1.2405 and possibly later versions allows a local attacker to perform an Authentication Bypass by Capture-replay attack due to insufficient protection against capture-replay attacks.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-02T00:00:00.000Z
CVE-2024-38891 
An issue in Horizon Business Services Inc. Caterease 16.0.1.1663 through 24.0.1.2405 and possibly later versions, allows a remote attacker to perform a Sniffing Network Traffic attack due to the cleartext transmission of sensitive information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-02T00:00:00.000Z
CVE-2024-38892 
An issue in Wavlink WN551K1 allows a remote attacker to obtain sensitive information via the ExportAllSettings.sh component.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-06-24T00:00:00.000Z
CVE-2024-38894 
WAVLINK WN551K1 found a command injection vulnerability through the IP parameter of /cgi-bin/touchlist_sync.cgi.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-06-24T00:00:00.000Z
CVE-2024-38895 
WAVLINK WN551K1'live_mfg.shtml enables attackers to obtain sensitive router information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-06-24T00:00:00.000Z
CVE-2024-38896 
WAVLINK WN551K1 found a command injection vulnerability through the start_hour parameter of /cgi-bin/nightled.cgi.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-06-24T00:00:00.000Z
CVE-2024-38897 
WAVLINK WN551K1'live_check.shtml enables attackers to obtain sensitive router information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-06-24T00:00:00.000Z
CVE-2024-38902 
H3C Magic R230 V100R002 was discovered to contain a hardcoded password vulnerability in /etc/shadow, which allows attackers to log in as root.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-06-24T00:00:00.000Z
CVE-2024-38903 
H3C Magic R230 V100R002's udpserver opens port 9034, allowing attackers to execute arbitrary commands.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-06-24T00:00:00.000Z
CVE-2024-38909 
Studio 42 elFinder 2.1.64 is vulnerable to Incorrect Access Control. Copying files with an unauthorized extension between server directories allows an arbitrary attacker to expose secrets, perform RCE, etc.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-07-30T00:00:00.000Z
CVE-2024-38910 
Open Robotics Robotic Operating System 2 (ROS2) and Nav2 humble version was discovered to contain a use-after-free in the nav2_amcl process. This vulnerability is triggered via sending a request to change dynamic parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-12-05T00:00:00.000Z
CVE-2024-38920 
Open Robotics Robotic Operating System 2 (ROS2) and Nav2 humble versions were discovered to contain a use-after-free via the nav2_amcl process. This vulnerability is triggerd via remotely sending a request for change the value of dynamic-parameter`/amcl max_beams` .
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-12-05T00:00:00.000Z
CVE-2024-38921 
Open Robotics Robotic Operating System 2 (ROS2) and Nav2 humble versions were discovered to contain a use-after-free via the nav2_amcl process. This vulnerability is triggered via remotely sending a request for change the value of dynamic-parameter`/amcl z_rand ` .
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-12-06T00:00:00.000Z
CVE-2024-38922 
Open Robotics Robotic Operating System 2 (ROS2) and Nav2 humble version was discovered to contain a heap overflow in the nav2_amcl process. This vulnerability is triggered via sending a crafted message to the component /initialpose.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-12-06T00:00:00.000Z
CVE-2024-38923 
Open Robotics Robotic Operating System 2 (ROS2) and Nav2 humble versions were discovered to contain a use-after-free via the nav2_amcl process. This vulnerability is triggered via remotely sending a request to change the value of dynamic-parameter`/amcl odom_frame_id` .
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-12-06T00:00:00.000Z
CVE-2024-38924 
Open Robotics Robotic Operating System 2 (ROS2) and Nav2 humble versions were discovered to contain a use-after-free via the nav2_amcl process. This vulnerability is triggered via remotely sending a request to change the value of dynamic-parameter`/amcl laser_model_type` .
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-12-06T00:00:00.000Z
CVE-2024-38925 
Open Robotics Robotic Operating System 2 (ROS2) and Nav2 humble versions were discovered to contain a use-after-free via the nav2_amcl process. This vulnerability is triggered via remotely sending a request for change the value of dynamic-parameter`/amcl z_max` .
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-12-06T00:00:00.000Z
CVE-2024-38926 
Open Robotics Robotic Operating System 2 (ROS2) and Nav2 humble versions were discovered to contain a use-after-free via the nav2_amcl process. This vulnerability is triggered via remotely sending a request for change the value of dynamic-parameter `/amcl z_short`.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-12-06T00:00:00.000Z
CVE-2024-38927 
Open Robotics Robotic Operating System 2 (ROS2) and Nav2 humble versions were discovered to contain a use-after-free via the nav2_amcl process. This vulnerability is triggered via remotely sending a request to change the value of dynamic-parameter `/amcl do_beamskip`.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-12-06T00:00:00.000Z
CVE-2024-38944 
An issue in Intelight X-1L Traffic controller Maxtime v.1.9.6 allows a remote attacker to execute arbitrary code via the /cgi-bin/generateForm.cgi?formID=142 component.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-07-22T00:00:00.000Z
CVE-2024-38949 
Heap Buffer Overflow vulnerability in Libde265 v1.0.15 allows attackers to crash the application via crafted payload to display444as420 function at sdl.cc
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-06-26T00:00:00.000Z
CVE-2024-38950 
Heap Buffer Overflow vulnerability in Libde265 v1.0.15 allows attackers to crash the application via crafted payload to __interceptor_memcpy function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-06-26T00:00:00.000Z
CVE-2024-38951 
A buffer overflow in PX4-Autopilot v1.12.3 allows attackers to cause a Denial of Service (DoS) via a crafted MavLink message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-06-25T00:00:00.000Z
CVE-2024-38952 
PX4-Autopilot v1.14.3 was discovered to contain a buffer overflow via the topic_name parameter at /logger/logged_topics.cpp.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-06-25T00:00:00.000Z
CVE-2024-38953 
phpok 6.4.003 contains a Cross Site Scripting (XSS) vulnerability in the ok_f() method under the framework/api/upload_control.php file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-07-01T00:00:00.000Z
CVE-2024-38959 
Cross Site Scripting vulnerability in Creativeitem Academy LMS Learning Management System v.6.8.1 allows a remote attacker to execute arbitrary code and obtain sensitive information via the string parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-07-09T00:00:00.000Z
CVE-2024-38963 
Nopcommerce 4.70.1 is vulnerable to Cross Site Scripting (XSS) via the combined "AddProductReview.Title" and "AddProductReview.ReviewText" parameter(s) (Reviews) when creating a new review.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-07-09T00:00:00.000Z