rainbutterfly/cve_corpus huggingface dataset:
CVE-2024-45854 
Deserialization of untrusted data can occur in versions 23.10.3.0 and newer of the MindsDB platform, enabling a maliciously uploaded ‘inhouse’ model to run arbitrary code on the server when a ‘describe’ query is run on it.
Problem types: cwe_id: CWE-502
description: CWE-502 Deserialization of Untrusted Data
Affected products: vendor: mindsdb
product: mindsdb
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.1
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
version: 3.1
Published: 2024-09-12T13:03:30.197Z
CVE-2024-45855 
Deserialization of untrusted data can occur in versions 23.10.2.0 and newer of the MindsDB platform, enabling a maliciously uploaded ‘inhouse’ model to run arbitrary code on the server when using ‘finetune’ on it.
Problem types: cwe_id: CWE-502
description: CWE-502 Deserialization of Untrusted Data
Affected products: vendor: mindsdb
product: mindsdb
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.1
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
version: 3.1
Published: 2024-09-12T13:04:13.076Z
CVE-2024-45856 
A cross-site scripting (XSS) vulnerability exists in all versions of the MindsDB platform, enabling the execution of a JavaScript payload whenever a user enumerates an ML Engine, database, project, or dataset containing arbitrary JavaScript code within the web UI.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Affected products: vendor: mindsdb
product: mindsdb
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
version: 3.1
Published: 2024-09-12T13:05:01.526Z
CVE-2024-45857 
Deserialization of untrusted data can occur in versions 2.4.0 or newer of the Cleanlab project, enabling a maliciously crafted datalab.pkl file to run arbitrary code on an end user’s system when the data directory is loaded.
Problem types: cwe_id: CWE-502
description: CWE-502 Deserialization of Untrusted Data
Affected products: vendor: Cleanlab
product: cleanlab
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
version: 3.1
Published: 2024-09-12T12:53:43.963Z
CVE-2024-45858 
An arbitrary code execution vulnerability exists in versions 0.2.9 up to 0.5.10 of the Guardrails AI Guardrails framework because of the way it validates XML files. If a victim user loads a maliciously crafted XML file containing Python code, the code will be passed to an eval function, causing it to execute on the user's machine.
Problem types: cwe_id: CWE-95
description: CWE-95 Improper Neutralization of Directives in Dynamically Evaluated Code (‘Eval Injection’)
Affected products: vendor: Guardrails AI
product: guardrails
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
version: 3.1
Published: 2024-09-18T15:02:17.891Z
CVE-2024-45861 Use of Hard-coded Credentials in Kastle Systems Access Control System
Kastle Systems firmware prior to May 1, 2024, contained a hard-coded credential, which if accessed may allow an attacker to access sensitive information.
Problem types: cwe_id: CWE-798
description: CWE-798 Use of Hard-coded Credentials
Affected products: vendor: Kastle Systems
product: Access Control System
default_status: unaffected
Credits: lang: en
value: evildaemond (Adam Foster) reported these vulnerabilities to CISA.
Published: 2024-09-19T15:51:06.115Z
CVE-2024-45862 Cleartext Storage of Sensitive Information in Kastle Systems Access Control System
Kastle Systems firmware prior to May 1, 2024, stored machine credentials in cleartext, which may allow an attacker to access sensitive information.
Problem types: cwe_id: CWE-312
description: CWE-312 Cleartext Storage of Sensitive Information
Affected products: vendor: Kastle Systems
product: Access Control System
default_status: unaffected
Credits: lang: en
value: evildaemond (Adam Foster) reported these vulnerabilities to CISA.
Published: 2024-09-19T15:54:32.596Z
CVE-2024-45863 
A null-dereference vulnerability involving parsing requests specifying invalid protocols can cause the application to crash or potentially result in other undesirable effects. This issue affects Facebook Thrift from v2024.09.09.00 until v2024.09.23.00.
Problem types: description: NULL Pointer Dereference (CWE-476)
Affected products: vendor: Facebook
product: Facebook Thrift
default_status: unaffected
Published: 2024-09-27T13:50:29.254Z
CVE-2024-45870 
Bandisoft BandiView 7.05 is vulnerable to Incorrect Access Control in sub_0x3d80fc via a crafted POC file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-10-03T00:00:00.000Z
CVE-2024-45871 
Bandisoft BandiView 7.05 is Incorrect Access Control via sub_0x232bd8 resulting in denial of service (DOS).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-10-03T00:00:00.000Z
CVE-2024-45872 
Bandisoft BandiView 7.05 is vulnerable to Buffer Overflow via sub_0x410d1d. The vulnerability occurs due to insufficient validation of PSD files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-10-03T00:00:00.000Z
CVE-2024-45873 
A DLL hijacking vulnerability in VegaBird Yaazhini 2.0.2 allows attackers to execute arbitrary code / maintain persistence via placing a crafted DLL file in the same directory as Yaazhini.exe.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-10-07T00:00:00.000Z
CVE-2024-45874 
A DLL hijacking vulnerability in VegaBird Vooki 5.2.9 allows attackers to execute arbitrary code / maintain persistence via placing a crafted DLL file in the same directory as Vooki.exe.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-10-07T00:00:00.000Z
CVE-2024-45875 
The create user function in baltic-it TOPqw Webportal 1.35.287.1 (fixed in version1.35.291), in /Apps/TOPqw/BenutzerManagement.aspx/SaveNewUser, is vulnerable to SQL injection. The JSON object username allows the manipulation of SQL queries.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-11-13T00:00:00.000Z
CVE-2024-45876 
The login form of baltic-it TOPqw Webportal v1.35.283.2 (fixed in version 1.35.283.4) at /Apps/TOPqw/Login.aspx is vulnerable to SQL injection. The vulnerability exists in the POST parameter txtUsername, which allows for manipulation of SQL queries.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-11-13T00:00:00.000Z
CVE-2024-45877 
baltic-it TOPqw Webportal v1.35.283.2 is vulnerable to Incorrect Access Control in the User Management function in /Apps/TOPqw/BenutzerManagement.aspx. This allows a low privileged user to access all modules in the web portal, view and manipulate information and permissions of other users, lock other user or unlock the own account, change the password of other users, create new users or delete existing users and view, manipulate and delete reference data.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-11-13T00:00:00.000Z
CVE-2024-45878 
The "Stammdaten" menu of baltic-it TOPqw Webportal v1.35.283.2 (fixed in version 1.35.291), in /Apps/TOPqw/qwStammdaten.aspx, is vulnerable to persistent Cross-Site Scripting (XSS).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-11-13T00:00:00.000Z
CVE-2024-45879 
The file upload function in the "QWKalkulation" tool of baltic-it TOPqw Webportal v1.35.287.1 (fixed in version 1.35.291), in /Apps/TOPqw/QWKalkulation/QWKalkulation.aspx, is vulnerable to Cross-Site Scripting (XSS). To exploit the persistent XSS vulnerability, an attacker has to be authenticated to the application that uses the "TOPqw Webportal" as a software. When authenticated, the attacker can persistently place the malicious JavaScript code in the "QWKalkulation" menu.'
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-11-13T00:00:00.000Z
CVE-2024-45880 
A command injection vulnerability exists in Motorola CX2L router v1.0.2 and below. The vulnerability is present in the SetStationSettings function. The system directly invokes the system function to execute commands for setting parameters such as MAC address without proper input filtering. This allows malicious users to inject and execute arbitrary commands.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-10-08T00:00:00.000Z
CVE-2024-45882 
DrayTek Vigor3900 1.5.1.3 contains a command injection vulnerability. This vulnerability occurs when the `action` parameter in `cgi-bin/mainfunction.cgi` is set to `delete_map_profile.`
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-11-04T00:00:00.000Z
CVE-2024-45884 
DrayTek Vigor3900 1.5.1.3 contains a post-authentication command injection vulnerability. This vulnerability occurs when the `action` parameter in `cgi-bin/mainfunction.cgi` is set to `setSWMGroup.`
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-11-04T00:00:00.000Z
CVE-2024-45885 
DrayTek Vigor3900 1.5.1.3 contains a post-authentication command injection vulnerability. This vulnerability occurs when the `action` parameter in `cgi-bin/mainfunction.cgi` is set to `autodiscovery_clear.`
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-11-04T00:00:00.000Z
CVE-2024-45887 
DrayTek Vigor3900 1.5.1.3 contains a post-authentication command injection vulnerability. This vulnerability occurs when the `action` parameter in `cgi-bin/mainfunction.cgi` is set to `doOpenVPN.`
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-11-04T00:00:00.000Z
CVE-2024-45888 
DrayTek Vigor3900 1.5.1.3 contains a command injection vulnerability. This vulnerability occurs when the `action` parameter in `cgi-bin/mainfunction.cgi` is set to `set_ap_map_config.'
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-11-04T00:00:00.000Z
CVE-2024-45889 
DrayTek Vigor3900 1.5.1.3 contains a post-authentication command injection vulnerability. This vulnerability occurs when the `action` parameter in `cgi-bin/mainfunction.cgi` is set to `commandTable.`
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-11-04T00:00:00.000Z
CVE-2024-45890 
DrayTek Vigor3900 1.5.1.3 contains a post-authentication command injection vulnerability This vulnerability occurs when the `action` parameter in `cgi-bin/mainfunction.cgi` is set to `download_ovpn.`
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-11-04T00:00:00.000Z
CVE-2024-45891 
DrayTek Vigor3900 1.5.1.3 contains a post-authentication command injection vulnerability. This vulnerability occurs when the `action` parameter in `cgi-bin/mainfunction.cgi` is set to `delete_wlan_profile.`
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-11-04T00:00:00.000Z
CVE-2024-45893 
DrayTek Vigor3900 1.5.1.3 contains a post-authentication command injection vulnerability. This vulnerability occurs when the `action` parameter in `cgi-bin/mainfunction.cgi` is set to `setSWMOption.`
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-11-04T00:00:00.000Z
CVE-2024-45894 
BlueCMS 1.6 suffers from Arbitrary File Deletion via the file_name parameter in an /admin/database.php?act=del request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-10-07T00:00:00.000Z
CVE-2024-45918 
Fujian Kelixin Communication Command and Dispatch Platform <=7.6.6.4391 is vulnerable to SQL Injection via /client/get_gis_fence.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-10-08T00:00:00.000Z
CVE-2024-45919 
A security flaw has been discovered in Solvait version 24.4.2 that allows an attacker to elevate their privileges. By manipulating the Request ID and Action Type parameters in /AssignToMe/SetAction, an attacker can bypass approval workflows leading to unauthorized access to sensitive information or approval of fraudulent requests.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-10-07T00:00:00.000Z
CVE-2024-45920 
A Stored Cross-Site Scripting (XSS) vulnerability in Solvait 24.4.2 allows remote attackers to inject malicious scripts into the application. This issue arises due to insufficient input validation and sanitization in "Intrest" feature.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-09-30T00:00:00.000Z
CVE-2024-45932 
Krayin CRM v1.3.0 is vulnerable to Cross Site Scripting (XSS) via the organization name field in /admin/contacts/organizations/edit/2.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-10-07T00:00:00.000Z
CVE-2024-45933 
OnlineNewsSite v1.0 is vulnerable to Cross Site Scripting (XSS) which allows attackers to execute arbitrary code via the Title and summary fields in the /admin/post/edit/ endpoint.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-10-07T00:00:00.000Z
CVE-2024-45944 
In J2eeFAST <=2.7, the backend function has unsafe filtering, which allows an attacker to trigger certain sensitive functions resulting in arbitrary code execution.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-10-18T00:00:00.000Z
CVE-2024-45955 
Rocket Software Rocket Zena 4.4.1.26 is vulnerable to SQL Injection via the filter parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-07-30T00:00:00.000Z
CVE-2024-45960 
Zenario 9.7.61188 allows authenticated admin users to upload PDF files containing malicious code into the target system. If the PDF file is accessed through the website, it can trigger a Cross Site Scripting (XSS) attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-10-02T00:00:00.000Z
CVE-2024-45962 
October 3.6.30 allows an authenticated admin account to upload a PDF file containing malicious JavaScript into the target system. If the file is accessed through the website, it could lead to a Cross-Site Scripting (XSS) attack or execute arbitrary code via a crafted JavaScript to the target.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-10-02T00:00:00.000Z
CVE-2024-45964 
Zenario 9.7.61188 is vulnerable to Cross Site Scripting (XSS) in the Image library via the "Organizer tags" field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-10-02T00:00:00.000Z
CVE-2024-45965 
Contao before 5.5.6 allows XSS via an SVG document. This affects (in contao/core-bundle in Composer) 4.x before 4.13.54, 5.0.x through 5.3.x before 5.3.30, and 5.4.x and 5.5..x before 5.5.6.
Problem types: cwe_id: CWE-434
description: CWE-434 Unrestricted Upload of File with Dangerous Type
Affected products: vendor: Contao
product: Contao
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 6.4
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Published: 2024-10-02T00:00:00.000Z
CVE-2024-45967 
Pagekit 1.0.18 is vulnerable to Cross Site Scripting (XSS) in index.php/admin/site/widget.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-10-01T00:00:00.000Z
CVE-2024-45969 
NULL pointer dereference in the MMS Client in MZ Automation LibIEC1850 before commit 7afa40390b26ad1f4cf93deaa0052fe7e357ef33 allows a malicious server to Cause a Denial-of-Service via the MMS InitiationResponse message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-11-15T00:00:00.000Z
CVE-2024-45970 
Multiple Buffer overflows in the MMS Client in MZ Automation LibIEC61850 before commit ac925fae8e281ac6defcd630e9dd756264e9c5bc allow a malicious server to cause a stack-based buffer overflow via the MMS FileDirResponse message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-11-15T00:00:00.000Z
CVE-2024-45971 
Multiple Buffer overflows in the MMS Client in MZ Automation LibIEC61850 before commit 1f52be9ddeae00e69cd43e4cac3cb4f0c880c4f0 allow a malicious server to cause a stack-based buffer overflow via the MMS IdentifyResponse message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-11-15T00:00:00.000Z
CVE-2024-45979 
A host header injection vulnerability in Lines Police CAD 1.0 allows attackers to obtain the password reset token via user interaction with a crafted password reset link. This allows attackers to arbitrarily reset other users' passwords and compromise their accounts.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-09-26T00:00:00.000Z
CVE-2024-45980 
A host header injection vulnerability in MEANStore 1.0 allows attackers to obtain the password reset token via user interaction with a crafted password reset link. This allows attackers to arbitrarily reset other users' passwords and compromise their accounts.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-09-26T00:00:00.000Z
CVE-2024-45981 
A host header injection vulnerability in BookReviewLibrary 1.0 allows attackers to obtain the password reset token via user interaction with a crafted password reset link.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-09-26T00:00:00.000Z
CVE-2024-45982 
A host header injection vulnerability in scheduleR v0.0.18 allows attackers to obtain the password reset token via user interaction with a crafted password reset link. This allows attackers to arbitrarily reset other users' passwords and compromise their accounts.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-09-26T00:00:00.000Z
CVE-2024-45983 
A Cross-Site Request Forgery (CSRF) vulnerability exists in kishan0725's Hospital Management System version 6.3.5. The vulnerability allows an attacker to craft a malicious HTML form that submits a request to delete a doctor record. By enticing an authenticated admin user to visit the specially crafted web page, the attacker can leverage the victim's browser to make unauthorized requests to the vulnerable endpoint, effectively allowing the attacker to perform actions on behalf of the admin without their consent.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-09-26T00:00:00.000Z
CVE-2024-45984 
A Cross Site Scripting (XSS) vulnerability in add_donor.php of Blood Bank And Donation Management System 1.0 allows an attacker to inject malicious scripts that will be executed when the Donor List is viewed.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-09-26T00:00:00.000Z
CVE-2024-45985 
A Cross Site Scripting (XSS) vulnerability in update_contact.php of Blood Bank and Donation Management System v1.0 allows an attacker to inject malicious scripts via the name parameter of the update_contact.php
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-09-26T00:00:00.000Z
CVE-2024-45986 
A stored Cross-Site Scripting (XSS) vulnerability was identified in Projectworld Online Voting System 1.0 that occurs when an account is registered with a malicious javascript payload. The payload is stored and subsequently executed in the voter.php and profile.php pages whenever the account information is accessed.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-09-26T00:00:00.000Z
CVE-2024-45987 
Projectworld Online Voting System Version 1.0 is vulnerable to Cross Site Request Forgery (CSRF) via voter.php. This vulnerability allows an attacker to craft a malicious link that, when clicked by an authenticated user, automatically submits a vote for a specified party without the user's consent or knowledge. The attack leverages the user's active session to perform the unauthorized action, compromising the integrity of the voting process.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-09-26T00:00:00.000Z
CVE-2024-45989 
Monica AI Assistant desktop application v2.3.0 is vulnerable to Exposure of Sensitive Information to an Unauthorized Actor. A prompt injection allows an attacker to modify chatbot answer with an unloaded image that exfiltrates the user's sensitive chat data of the current session to a malicious third-party or attacker-controlled server.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-09-26T00:00:00.000Z
CVE-2024-45993 
Giflib Project v5.2.2 is vulnerable to a heap buffer overflow via gif2rgb.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-09-30T00:00:00.000Z
CVE-2024-45999 
A SQL Injection vulnerability was discovered in Cloudlog 2.6.15, specifically within the get_station_info()function located in the file /application/models/Oqrs_model.php. The vulnerability is exploitable via the station_id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-10-01T00:00:00.000Z
CVE-2024-46040 
IoT Haat Smart Plug IH-IN-16A-S IH-IN-16A-S v5.16.1 suffers from Insufficient Session Expiration. The lack of validation of the authentication token at the IoT Haat during the Access Point Pairing mode leads the attacker to replay the Wi-Fi packets and forcefully turn off the access point after the authentication token has expired.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-10-07T00:00:00.000Z
CVE-2024-46041 
IoT Haat Smart Plug IH-IN-16A-S v5.16.1 is vulnerable to Authentication Bypass by Capture-replay.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-10-07T00:00:00.000Z
CVE-2024-46044 
CH22 V1.0.0.6(468) has a stack overflow vulnerability located in the fromqossetting function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-09-13T00:00:00.000Z
CVE-2024-46045 
Tenda CH22 V1.0.0.6(468) has a stack overflow vulnerability located in the frmL7PlotForm function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-09-13T00:00:00.000Z
CVE-2024-46046 
Tenda FH451 v1.0.0.9 has a stack overflow vulnerability located in the RouteStatic function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-09-13T00:00:00.000Z
CVE-2024-46047 
Tenda FH451 v1.0.0.9 has a stack overflow vulnerability in the fromDhcpListClient function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-09-13T00:00:00.000Z