rainbutterfly/cve_corpus huggingface dataset:
CVE-2024-50590 Local Privilege Escalation via Weak Service Binary Permissions
Attackers with local access to the medical office computer can 
escalate their Windows user privileges to "NT AUTHORITY\SYSTEM" by 
overwriting one of two Elefant service binaries with weak permissions. The default installation directory of Elefant is "C:\Elefant1" which is 
writable for all users. In addition, the Elefant installer registers two
 Firebird database services which are running as “NT AUTHORITY\SYSTEM”. 

Path: C:\Elefant1\Firebird_2\bin\fbserver.exe

Path: C:\Elefant1\Firebird_2\bin\fbguard.exe


Both service binaries are user writable. This means that a local 
attacker can rename one of the service binaries, replace the service 
executable with a new executable, and then restart the system. Once the 
system has rebooted, the new service binary is executed as "NT 
AUTHORITY\SYSTEM".
Problem types: cwe_id: CWE-276
description: CWE-276 Incorrect Default Permissions
cwe_id: CWE-732
description: CWE-732 Incorrect Permission Assignment for Critical Resource
cwe_id: CWE-250
description: CWE-250 Execution with Unnecessary Privileges
Affected products: vendor: HASOMED
product: Elefant
default_status: unaffected
Credits: lang: en
value: Tobias Niemann, SEC Consult Vulnerability Lab
lang: en
value: Daniel Hirschberger, SEC Consult Vulnerability Lab
lang: en
value: Florian Stuhlmann, SEC Consult Vulnerability Lab
Published: 2024-11-08T11:45:04.756Z
CVE-2024-50591 Local Privilege Escalation via Command Injection
An attacker with local access the to medical office computer can 
escalate his Windows user privileges to "NT AUTHORITY\SYSTEM" by 
exploiting a command injection vulnerability in the Elefant Update 
Service. The command injection can be exploited by communicating with 
the Elefant Update Service which is running as "SYSTEM" via Windows 
Named Pipes.The Elefant Software Updater (ESU) consists of two components. An ESU
 service which runs as "NT AUTHORITY\SYSTEM" and an ESU tray client 
which communicates with the service to update or repair the installation
 and is running with user permissions. The communication is implemented 
using named pipes. A crafted message of type 
"MessageType.SupportServiceInfos" can be sent to the local ESU service 
to inject commands, which are then executed as "NT AUTHORITY\SYSTEM".
Problem types: cwe_id: CWE-77
description: CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')
Affected products: vendor: HASOMED
product: Elefant Software Updater
default_status: unaffected
Credits: lang: en
value: Tobias Niemann, SEC Consult Vulnerability Lab
lang: en
value: Daniel Hirschberger, SEC Consult Vulnerability Lab
lang: en
value: Florian Stuhlmann, SEC Consult Vulnerability Lab
Published: 2024-11-08T12:01:18.862Z
CVE-2024-50592 Local Privilege Escalation via Race Condition
An attacker with local access the to medical office computer can 
escalate his Windows user privileges to "NT AUTHORITY\SYSTEM" by 
exploiting a race condition in the Elefant Update Service during the 
repair or update process. When using the repair function, the service queries the server for a 
list of files and their hashes. In addition, instructions to execute 
binaries to finalize the repair process are included. The executables are executed as "NT AUTHORITY\SYSTEM" after they are 
copied over to the user writable installation folder (C:\Elefant1). This
 means that a user can overwrite either "PostESUUpdate.exe" or 
"Update_OpenJava.exe" in the time frame after the copy and before the 
execution of the final repair step. The overwritten executable is then executed as "NT AUTHORITY\SYSTEM".
Problem types: cwe_id: CWE-367
description: CWE-367 Time-of-check Time-of-use (TOCTOU) Race Condition
Affected products: vendor: HASOMED
product: Elefant Software Updater
default_status: unaffected
Credits: lang: en
value: Tobias Niemann, SEC Consult Vulnerability Lab
lang: en
value: Daniel Hirschberger, SEC Consult Vulnerability Lab
lang: en
value: Florian Stuhlmann, SEC Consult Vulnerability Lab
Published: 2024-11-08T12:15:25.835Z
CVE-2024-50593 Hardcoded Service Password
An attacker with local access to the medical office computer can 
access restricted functions of the Elefant Service tool by using a 
hard-coded "Hotline" password in the Elefant service binary, which is shipped with the software.
Problem types: cwe_id: CWE-798
description: CWE-798 Use of Hard-coded Credentials
Affected products: vendor: HASOMED
product: Elefant
default_status: unaffected
Credits: lang: en
value: Tobias Niemann, SEC Consult Vulnerability Lab
lang: en
value: Daniel Hirschberger, SEC Consult Vulnerability Lab
lang: en
value: Florian Stuhlmann, SEC Consult Vulnerability Lab
Published: 2024-11-08T12:06:28.619Z
CVE-2024-50594 
An integer underflow vulnerability exists in the HTTP server PUT request functionality of STMicroelectronics X-CUBE-AZRTOS-WL 2.0.0. A specially crafted series of network requests can lead to denial of service. An attacker can send a sequence of malicious packets to trigger this vulnerability.This vulnerability affects the NetX Duo Web Component HTTP Server implementation which can be found in x-cube-azrtos-f7\Middlewares\ST\netxduo\addons\web\nx_web_http_server.c
Problem types: cwe_id: CWE-191
description: CWE-191: Integer Underflow (Wrap or Wraparound)
Affected products: vendor: STMicroelectronics
product: X-CUBE-AZRT-H7RS
vendor: STMicroelectronics
product: X-CUBE-AZRTOS-F4
vendor: STMicroelectronics
product: X-CUBE-AZRTOS-F7
vendor: STMicroelectronics
product: X-CUBE-AZRTOS-G0
vendor: STMicroelectronics
product: X-CUBE-AZRTOS-G4
vendor: STMicroelectronics
product: X-CUBE-AZRTOS-H7
vendor: STMicroelectronics
product: X-CUBE-AZRTOS-L4
vendor: STMicroelectronics
product: X-CUBE-AZRTOS-L5
vendor: STMicroelectronics
product: X-CUBE-AZRTOS-WB
vendor: STMicroelectronics
product: X-CUBE-AZRTOS-WL
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: LOW
baseScore: 4.3
baseSeverity: MEDIUM
Credits: lang: en
value: Discovered by Kelly Patterson of Cisco Talos.
Published: 2025-04-02T13:41:56.253Z
CVE-2024-50595 
An integer underflow vulnerability exists in the HTTP server PUT request functionality of STMicroelectronics X-CUBE-AZRTOS-WL 2.0.0. A specially crafted series of network requests can lead to denial of service. An attacker can send a sequence of malicious packets to trigger this vulnerability.This vulnerability affects the NetX Duo Component HTTP Server implementation which can be found in x-cube-azrtos-f7\Middlewares\ST\netxduo\addons\http\nxd_http_server.c
Problem types: cwe_id: CWE-191
description: CWE-191: Integer Underflow (Wrap or Wraparound)
Affected products: vendor: STMicroelectronics
product: X-CUBE-AZRT-H7RS
vendor: STMicroelectronics
product: X-CUBE-AZRTOS-F4
vendor: STMicroelectronics
product: X-CUBE-AZRTOS-F7
vendor: STMicroelectronics
product: X-CUBE-AZRTOS-G0
vendor: STMicroelectronics
product: X-CUBE-AZRTOS-G4
vendor: STMicroelectronics
product: X-CUBE-AZRTOS-H7
vendor: STMicroelectronics
product: X-CUBE-AZRTOS-L4
vendor: STMicroelectronics
product: X-CUBE-AZRTOS-L5
vendor: STMicroelectronics
product: X-CUBE-AZRTOS-WB
vendor: STMicroelectronics
product: X-CUBE-AZRTOS-WL
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: LOW
baseScore: 4.3
baseSeverity: MEDIUM
Credits: lang: en
value: Discovered by Kelly Patterson of Cisco Talos.
Published: 2025-04-02T13:41:56.435Z
CVE-2024-50596 
An integer underflow vulnerability exists in the HTTP server PUT request functionality of STMicroelectronics X-CUBE-AZRTOS-WL 2.0.0. A specially crafted network packet can lead to denial of service. An attacker can send a malicious packet to trigger this vulnerability.This vulnerability affects the NetX Duo Web Component HTTP Server implementation which can be found in x-cube-azrtos-f7\Middlewares\ST\netxduo\addons\web\nx_web_http_server.c
Problem types: cwe_id: CWE-191
description: CWE-191: Integer Underflow (Wrap or Wraparound)
Affected products: vendor: STMicroelectronics
product: X-CUBE-AZRT-H7RS
vendor: STMicroelectronics
product: X-CUBE-AZRTOS-F4
vendor: STMicroelectronics
product: X-CUBE-AZRTOS-F7
vendor: STMicroelectronics
product: X-CUBE-AZRTOS-G0
vendor: STMicroelectronics
product: X-CUBE-AZRTOS-G4
vendor: STMicroelectronics
product: X-CUBE-AZRTOS-H7
vendor: STMicroelectronics
product: X-CUBE-AZRTOS-L4
vendor: STMicroelectronics
product: X-CUBE-AZRTOS-L5
vendor: STMicroelectronics
product: X-CUBE-AZRTOS-WB
vendor: STMicroelectronics
product: X-CUBE-AZRTOS-WL
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: LOW
baseScore: 4.3
baseSeverity: MEDIUM
Credits: lang: en
value: Discovered by Kelly Patterson of Cisco Talos.
Published: 2025-04-02T13:41:55.311Z
CVE-2024-50597 
An integer underflow vulnerability exists in the HTTP server PUT request functionality of STMicroelectronics X-CUBE-AZRTOS-WL 2.0.0. A specially crafted network packet can lead to denial of service. An attacker can send a malicious packet to trigger this vulnerability.This vulnerability affects the NetX Duo Component HTTP Server implementation which can be found in x-cube-azrtos-f7\Middlewares\ST\netxduo\addons\http\nxd_http_server.c
Problem types: cwe_id: CWE-191
description: CWE-191: Integer Underflow (Wrap or Wraparound)
Affected products: vendor: STMicroelectronics
product: X-CUBE-AZRT-H7RS
vendor: STMicroelectronics
product: X-CUBE-AZRTOS-F4
vendor: STMicroelectronics
product: X-CUBE-AZRTOS-F7
vendor: STMicroelectronics
product: X-CUBE-AZRTOS-G0
vendor: STMicroelectronics
product: X-CUBE-AZRTOS-G4
vendor: STMicroelectronics
product: X-CUBE-AZRTOS-H7
vendor: STMicroelectronics
product: X-CUBE-AZRTOS-L4
vendor: STMicroelectronics
product: X-CUBE-AZRTOS-L5
vendor: STMicroelectronics
product: X-CUBE-AZRTOS-WB
vendor: STMicroelectronics
product: X-CUBE-AZRTOS-WL
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: LOW
baseScore: 4.3
baseSeverity: MEDIUM
Credits: lang: en
value: Discovered by Kelly Patterson of Cisco Talos.
Published: 2025-04-02T13:41:55.517Z
CVE-2024-50599 
A reflected Cross-Site Scripting (XSS) vulnerability has been identified in Zimbra Collaboration Suite (ZCS) 8.8.15, affecting one of the webmail calendar endpoints. This arises from improper handling of user-supplied input, allowing an attacker to inject malicious code that is reflected back in the HTML response.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-11-07T00:00:00.000Z
CVE-2024-50600 
An issue was discovered in Samsung Mobile Processor and Wearable Processor Exynos 980, 850, 1080, 1280, 1330, 1380, 1480, W920, W930, and W1000. Lack of a boundary check in STOP_KEEP_ALIVE_OFFLOAD leads to out-of-bounds access. An attacker can send a malformed message to the target through the Wi-Fi driver.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-03-06T00:00:00.000Z
CVE-2024-50601 
Persistent and reflected XSS vulnerabilities in the themeMode cookie and _h URL parameter of Axigen Mail Server up to version 10.5.28 allow attackers to execute arbitrary Javascript. Exploitation could lead to session hijacking, data leakage, and further exploitation via a multi-stage attack. Fixed in versions 10.3.3.67, 10.4.42, and 10.5.29.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-11-11T00:00:00.000Z
CVE-2024-50602 
An issue was discovered in libexpat before 2.6.4. There is a crash within the XML_ResumeParser function because XML_StopParser can stop/suspend an unstarted parser.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-10-27T00:00:00.000Z
CVE-2024-50603 
An issue was discovered in Aviatrix Controller before 7.1.4191 and 7.2.x before 7.2.4996. Due to the improper neutralization of special elements used in an OS command, an unauthenticated attacker is able to execute arbitrary code. Shell metacharacters can be sent to /v1/api in cloud_type for list_flightpath_destination_instances, or src_cloud_type for flightpath_connection_test.
Problem types: cwe_id: CWE-78
description: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected products: vendor: Aviatrix
product: Controller
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 10
baseSeverity: CRITICAL
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Published: 2025-01-08T00:00:00.000Z
CVE-2024-50608 
An issue was discovered in Fluent Bit 3.1.9. When the Prometheus Remote Write input plugin is running and listening on an IP address and port, one can send a packet with Content-Length: 0 and it crashes the server. Improper handling of the case when Content-Length is 0 allows a user (with access to the endpoint) to perform a remote Denial of service attack. The crash happens because of a NULL pointer dereference when 0 (from the Content-Length) is passed to the function cfl_sds_len, which in turn tries to cast a NULL pointer into struct cfl_sds. This is related to process_payload_metrics_ng() at prom_rw_prot.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-02-18T00:00:00.000Z
CVE-2024-50609 
An issue was discovered in Fluent Bit 3.1.9. When the OpenTelemetry input plugin is running and listening on an IP address and port, one can send a packet with Content-Length: 0 and it crashes the server. Improper handling of the case when Content-Length is 0 allows a user (with access to the endpoint) to perform a remote Denial of service attack. The crash happens because of a NULL pointer dereference when 0 (from the Content-Length) is passed to the function cfl_sds_len, which in turn tries to cast a NULL pointer into struct cfl_sds. This is related to process_payload_traces_proto_ng() at opentelemetry_prot.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-02-18T00:00:00.000Z
CVE-2024-50610 
GSL (GNU Scientific Library) through 2.8 has an integer signedness error in gsl_siman_solve_many in siman/siman.c. When params.n_tries is negative, incorrect memory allocation occurs.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-10-27T00:00:00.000Z
CVE-2024-50611 
CycloneDX cdxgen through 10.10.7, when run against an untrusted codebase, may execute code contained within build-related files such as build.gradle.kts, a similar issue to CVE-2022-24441. cdxgen is used by, for example, OWASP dep-scan. NOTE: this has been characterized as a design limitation, rather than an implementation mistake.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-10-27T00:00:00.000Z
CVE-2024-50612 
libsndfile through 1.2.2 has an ogg_vorbis.c vorbis_analysis_wrote out-of-bounds read.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-10-27T00:00:00.000Z
CVE-2024-50613 
libsndfile through 1.2.2 has a reachable assertion, that may lead to application exit, in mpeg_l3_encode.c mpeg_l3_encoder_close.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-10-27T00:00:00.000Z
CVE-2024-50614 
TinyXML2 through 10.0.0 has a reachable assertion for UINT_MAX/16, that may lead to application exit, in tinyxml2.cpp XMLUtil::GetCharacterRef.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-10-27T00:00:00.000Z
CVE-2024-50615 
TinyXML2 through 10.0.0 has a reachable assertion for UINT_MAX/digit, that may lead to application exit, in tinyxml2.cpp XMLUtil::GetCharacterRef.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-10-27T00:00:00.000Z
CVE-2024-50616 
Ironman PowerShell Universal 5.x before 5.0.12 allows an authenticated attacker to elevate their privileges and view job information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-10-27T00:00:00.000Z
CVE-2024-50617 
Vulnerabilities in the File Download and Get File handler components in CIPPlanner CIPAce before 9.17 allow attackers to download unauthorized files. An authenticated user can easily change the file id parameter or pass the physical file path in the URL query string to retrieve the files. (Retrieval is not intended without correct data access configured for documents.)
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-02-11T00:00:00.000Z
CVE-2024-50618 
A Use of Single-factor Authentication vulnerability in the Authentication component of CIPPlanner CIPAce before 9.17 allows attackers to bypass a protection mechanism. When the system is configured to allow login with internal accounts, an attacker can possibly obtain full authentication if the secret in a single-factor authentication scheme gets compromised.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-02-11T00:00:00.000Z
CVE-2024-50619 
Vulnerabilities in the My Account and User Management components in CIPPlanner CIPAce before 9.17 allows attackers to escalate their access levels. A low-privileged authenticated user can gain access to other people's accounts by tampering with the client's user id to change their account information. A low-privileged authenticated user can elevate his or her system privileges by modifying the information of a user role that is disabled in the client.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-02-11T00:00:00.000Z
CVE-2024-50620 
Unrestricted Upload of File with Dangerous Type vulnerabilities exist in the rich text editor and document manage components in CIPPlanner CIPAce before 9.17. An authorized user can upload executable files when inserting images in the rich text editor, and upload executable files when uploading files on the document management page. Those executables can be executed if they are not stored in a shared directory or if the storage directory has executed permissions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-02-11T00:00:00.000Z
CVE-2024-50623 
In Cleo Harmony before 5.8.0.21, VLTrader before 5.8.0.21, and LexiCom before 5.8.0.21, there is an unrestricted file upload and download that could lead to remote code execution.
Problem types: cwe_id: CWE-434
description: CWE-434 Unrestricted Upload of File with Dangerous Type
Affected products: vendor: n/a
product: n/a
Published: 2024-10-27T00:00:00.000Z
CVE-2024-50624 
ispdbservice.cpp in KDE Kmail before 6.2.0 allows man-in-the-middle attackers to trigger use of an attacker-controlled mail server because cleartext HTTP is used for a URL such as http://autoconfig.example.com or http://example.com/.well-known/autoconfig for retrieving the configuration. This is related to kmail-account-wizard.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-10-27T00:00:00.000Z
CVE-2024-50625 
An issue was discovered in Digi ConnectPort LTS before 1.4.12. A vulnerability in the file upload handling of a web application allows manipulation of file paths via POST requests. This can lead to arbitrary file uploads within specific directories, potentially enabling privilege escalation when combined with other vulnerabilities.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-12-09T00:00:00.000Z
CVE-2024-50626 
An issue was discovered in Digi ConnectPort LTS before 1.4.12. A Directory Traversal vulnerability exists in WebFS. This allows an attacker on the local area network to manipulate URLs to include traversal sequences, potentially leading to unauthorized access to data.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-12-09T00:00:00.000Z
CVE-2024-50627 
An issue was discovered in Digi ConnectPort LTS before 1.4.12. A Privilege Escalation vulnerability exists in the file upload feature. It allows an attacker on the local area network (with specific permissions) to upload and execute malicious files, potentially leading to unauthorized system access.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-12-09T00:00:00.000Z
CVE-2024-50628 
An issue was discovered in the web services of Digi ConnectPort LTS before 1.4.12. It allows an attacker on the local area network to achieve unauthorized manipulation of resources, which may lead to remote code execution when combined with other issues.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-12-09T00:00:00.000Z
CVE-2024-50629 
Improper encoding or escaping of output vulnerability in the webapi component in Synology BeeStation OS (BSM) before 1.1-65374 and Synology DiskStation Manager (DSM) before 7.1.1-42962-7, 7.2-64570-4, 7.2.1-69057-6 and 7.2.2-72806-1 allow remote attackers to read limited files via unspecified vectors.
Problem types: cwe_id: CWE-116
description: Improper Encoding or Escaping of Output
Affected products: vendor: Synology
product: DiskStation Manager (DSM)
default_status: affected
vendor: Synology
product: BeeStation OS (BSM)
default_status: affected
CVSS v3.1: baseScore: 5.3
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: NONE
availabilityImpact: NONE
version: 3.1
Credits: lang: en
value: Pumpkin Chang (@u1f383) and Orange Tsai (@orange_8361) from DEVCORE Research Team
Published: 2025-03-19T05:49:56.438Z
CVE-2024-50630 
Missing authentication for critical function vulnerability in the webapi component in Synology Drive Server before 3.0.4-12699, 3.2.1-23280, 3.5.0-26085 and 3.5.1-26102 allows remote attackers to obtain administrator credentials via unspecified vectors.
Problem types: cwe_id: CWE-306
description: Missing Authentication for Critical Function
Affected products: vendor: Synology
product: Synology Drive Server
default_status: affected
CVSS v3.1: baseScore: 7.5
baseSeverity: HIGH
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: NONE
availabilityImpact: NONE
version: 3.1
Credits: lang: en
value: Pumpkin Chang (@u1f383) and Orange Tsai (@orange_8361) from DEVCORE Research Team
Published: 2025-03-19T05:50:05.059Z
CVE-2024-50631 
Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in the system syncing daemon in Synology Drive Server before 3.0.4-12699, 3.2.1-23280, 3.5.0-26085 and 3.5.1-26102 allows remote attackers to inject SQL commands, limited to write operations, via unspecified vectors.
Problem types: cwe_id: CWE-89
description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: Synology
product: Synology Drive Server
default_status: affected
CVSS v3.1: baseScore: 7.5
baseSeverity: HIGH
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: HIGH
availabilityImpact: NONE
version: 3.1
Credits: lang: en
value: Pumpkin Chang (@u1f383) and Orange Tsai (@orange_8361) from DEVCORE Research Team
Published: 2025-03-19T05:50:08.565Z