rainbutterfly/cve_corpus huggingface dataset:
CVE-2024-6863 Encryption of Arbitrary Files with Attacker-Controlled Key in h2oai/h2o-3
In h2oai/h2o-3 version 3.46.0, an endpoint exposing a custom EncryptionTool allows an attacker to encrypt any files on the target server with a key of their choosing. The chosen key can also be overwritten, resulting in ransomware-like behavior. This vulnerability makes it possible for an attacker to encrypt arbitrary files with keys of their choice, making it exceedingly difficult for the target to recover the keys needed for decryption.
Problem types: cwe_id: CWE-749
description: CWE-749 Exposed Dangerous Method or Function
Affected products: vendor: h2oai
product: h2oai/h2o-3
Published: 2025-03-20T10:10:30.190Z
CVE-2024-6864 WP Last Modified Info <= 1.9.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via lmt-post-modified-info Shortcode
The WP Last Modified Info plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘template’ attribute of the lmt-post-modified-info shortcode in all versions up to, and including, 1.9.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: infosatech
product: WP Last Modified Info
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
baseScore: 6.4
baseSeverity: MEDIUM
Credits: lang: en
value: Craig Smith
Published: 2024-08-20T04:28:33.896Z
CVE-2024-6866 Case-Insensitive Path Matching in corydolphin/flask-cors
corydolphin/flask-cors version 4.01 contains a vulnerability where the request path matching is case-insensitive due to the use of the `try_match` function, which is originally intended for matching hosts. This results in a mismatch because paths in URLs are case-sensitive, but the regex matching treats them as case-insensitive. This misconfiguration can lead to significant security vulnerabilities, allowing unauthorized origins to access paths meant to be restricted, resulting in data exposure and potential data leaks.
Problem types: cwe_id: CWE-178
description: CWE-178 Improper Handling of Case Sensitivity
Affected products: vendor: corydolphin
product: corydolphin/flask-cors
Published: 2025-03-20T10:10:59.521Z
CVE-2024-6867 Information Disclosure in lunary-ai/lunary
An information disclosure vulnerability exists in the lunary-ai/lunary, specifically in the `runs/{run_id}/related` endpoint. This endpoint does not verify that the user has the necessary access rights to the run(s) they are accessing. As a result, it returns not only the specified run but also all runs that have the `run_id` listed as their parent run. This issue affects the main branch, commit a761d833. The vulnerability allows unauthorized users to obtain information about non-public runs and their related runs, given the `run_id` of a public or non-public run.
Problem types: cwe_id: CWE-1220
description: CWE-1220 Insufficient Granularity of Access Control
Affected products: vendor: lunary-ai
product: lunary-ai/lunary
Published: 2024-09-13T16:13:02.869Z
CVE-2024-6868 Arbitrary File Write in mudler/LocalAI
mudler/LocalAI version 2.17.1 allows for arbitrary file write due to improper handling of automatic archive extraction. When model configurations specify additional files as archives (e.g., .tar), these archives are automatically extracted after downloading. This behavior can be exploited to perform a 'tarslip' attack, allowing files to be written to arbitrary locations on the server, bypassing checks that normally restrict files to the models directory. This vulnerability can lead to remote code execution (RCE) by overwriting backend assets used by the server.
Problem types: cwe_id: CWE-59
description: CWE-59 Improper Link Resolution Before File Access
Affected products: vendor: mudler
product: mudler/localai
Published: 2024-10-29T12:46:54.732Z
CVE-2024-6869 Falang multilanguage for WordPress <= 1.3.52 - Missing Authorization to Translation Update and Information Exposure
The Falang multilanguage for WordPress plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on several functions in all versions up to, and including, 1.3.52. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update and delete translations and expose the administrator email address.
Problem types: cwe_id: CWE-862
description: CWE-862 Missing Authorization
Affected products: vendor: sbouey
product: Falang multilanguage for WordPress
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
baseScore: 5.4
baseSeverity: MEDIUM
Credits: lang: en
value: Lucio Sá
Published: 2024-08-08T04:11:38.071Z
CVE-2024-6870 Responsive Lightbox & Gallery <= 2.4.7 - Authenticated (Author+) Stored Cross-Site Scripting via File Upload
The Responsive Lightbox & Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via file uploads in all versions up to, and including, 2.4.7 due to insufficient input sanitization and output escaping affecting the rl_upload_image AJAX endpoint. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the 3gp2 file.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: dfactory
product: Responsive Lightbox & Gallery
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
baseScore: 6.4
baseSeverity: MEDIUM
Credits: lang: en
value: wesley
Published: 2024-08-22T09:29:30.755Z
CVE-2024-6871 G DATA Total Security Incorrect Permission Assignment Local Privilege Escalation Vulnerability
G DATA Total Security Incorrect Permission Assignment Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of G DATA Total Security. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.

The specific flaw exists within the handling of autostart tasks. The issue results from incorrect permissions set on folders. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-22629.
Problem types: cwe_id: CWE-732
description: CWE-732: Incorrect Permission Assignment for Critical Resource
Affected products: vendor: G DATA
product: Total Security
default_status: unknown
Published: 2024-11-22T21:30:23.472Z
CVE-2024-6872 Build Your Dream Website Fast with 400+ Starter Templates and Landing Pages, No Coding Needed, One-Click Import for Elementor & Gutenberg Blocks! – TemplateSpare <= 2.4.2 - Missing Authorization to Authenticated (Subscriber+) Theme Update
The Build Your Dream Website Fast with 400+ Starter Templates and Landing Pages, No Coding Needed, One-Click Import for Elementor & Gutenberg Blocks! – TemplateSpare plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'templatespare_activate_required_theme' and 'templatespare_get_theme_status' functions in all versions up to, and including, 2.4.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to activate any installed theme and read any theme status. If the attacker attempts to activate a theme that is not installed, a non-existent theme with the slug chosen by the attacker will be considered the active theme, leaving the site with no theme functionality.
Problem types: cwe_id: CWE-862
description: CWE-862 Missing Authorization
Affected products: vendor: templatespare
product: TemplateSpare – 1000+ WordPress Starter Templates & Full Site Migration Tool | 1-Click Import/Export & No-Code Builder
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
baseScore: 4.3
baseSeverity: MEDIUM
Credits: lang: en
value: Lucio Sá
Published: 2024-08-03T11:37:38.535Z
CVE-2024-6873 Specially crafted request could caused undefined behaviour which may lead to Remote Code Execution.
It is possible to crash or redirect the execution flow of the ClickHouse server process from an unauthenticated vector by sending a specially crafted request to the ClickHouse server native interface. This redirection is limited to what is available within a 256-byte range of memory at the time of execution, and no known remote code execution (RCE) code has been produced or exploited.

 Fixes have been merged to all currently supported version of ClickHouse. If you are maintaining your own forked version of ClickHouse or using an older version and cannot upgrade, the fix for this vulnerability can be found in this commit  https://github.com/ClickHouse/ClickHouse/pull/64024 .
Problem types: cwe_id: CWE-122
description: CWE-122 Heap-based Buffer Overflow
Affected products: vendor: ClickHouse
product: ClickHouse
default_status: unknown
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.1
baseSeverity: HIGH
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:H
version: 3.1
Credits: lang: en
value: malacupa (Independent researcher)
Published: 2024-08-01T15:57:25.304Z
CVE-2024-6874 macidn punycode buffer overread
libcurl's URL API function
[curl_url_get()](https://curl.se/libcurl/c/curl_url_get.html) offers punycode
conversions, to and from IDN. Asking to convert a name that is exactly 256
bytes, libcurl ends up reading outside of a stack based buffer when built to
use the *macidn* IDN backend. The conversion function then fills up the
provided buffer exactly - but does not null terminate the string.

This flaw can lead to stack contents accidently getting returned as part of
the converted string.
Problem types: description: CWE-126 Buffer Over-read
Affected products: vendor: curl
product: curl
default_status: unaffected
Credits: lang: en
value: z2_
lang: en
value: z2_
Published: 2024-07-24T07:36:26.887Z
CVE-2024-6875 Infinispan: infinispan: rest compare api has buffer leak
A vulnerability was found in the Infinispan component in Red Hat Data Grid. The REST compare API may have a buffer leak and an out of memory error can occur when sending continual requests with large POST data to the REST API.
Problem types: cwe_id: CWE-401
description: Missing Release of Memory after Effective Lifetime
Affected products: default_status: unaffected
vendor: Red Hat
product: Red Hat Data Grid 8
cpes: cpe:/a:redhat:jboss_data_grid:8
default_status: affected
vendor: Red Hat
product: Red Hat JBoss Data Grid 7
cpes: cpe:/a:redhat:jboss_data_grid:7
default_status: affected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Published: 2025-03-28T20:34:30.859Z
CVE-2024-6876 Out-of-bounds read in OSCAT-Library
Out-of-Bounds read vulnerability in OSCAT Basic Library allows an local, unprivileged attacker to access limited internal data of the PLC which may lead to a crash of the affected service.
Problem types: cwe_id: CWE-125
description: CWE-125 Out-of-bounds Read
Affected products: vendor: oscat.de
product: OSCAT Basic Library
default_status: unaffected
vendor: oscat.de
product: OSCAT Basic Library
default_status: unaffected
vendor: CODESYS
product: OSCAT Basic Library
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: LOW
baseScore: 4.4
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L
version: 3.1
Credits: lang: en
value: Corban Villa
lang: en
value: Hithem Lamri
lang: en
value: Constantine Doumanidis
lang: en
value: Michail Maniatakos
lang: en
value: Modern Microprocessors Architecture (MoMA) Lab at NYU Abu Dhabi
lang: en
value: CODESYS
Published: 2024-09-10T15:08:16.212Z
CVE-2024-6877 Reflected XSS in Eliz Software's Panel
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Eliz Software Panel allows Reflected XSS.

This issue affects Panel: before v2.3.24.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Affected products: vendor: Eliz Software
product: Panel
default_status: unaffected
Credits: lang: en
value: Serhat YAPICI
Published: 2024-09-18T14:51:32.753Z
CVE-2024-6878 Directory Browsing in Eliz Software's Panel
Files or Directories Accessible to External Parties vulnerability in Eliz Software Panel allows Collect Data from Common Resource Locations.

This issue affects Panel: before v2.3.24.
Problem types: cwe_id: CWE-552
description: CWE-552 Files or Directories Accessible to External Parties
Affected products: vendor: Eliz Software
product: Panel
default_status: unaffected
Credits: lang: en
value: Serhat YAPICI
Published: 2024-09-18T14:55:24.769Z
CVE-2024-6879 Quiz and Survey Master (QSM) < 9.1.1 - Contributor+ Stored XSS
The Quiz and Survey Master (QSM)  WordPress plugin before 9.1.1 fails to validate and escape certain Quiz fields before displaying them on a page or post where the Quiz is embedded, which could allows contributor and above roles to perform Stored Cross-Site Scripting (XSS) attacks.
Problem types: description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: Quiz and Survey Master (QSM)
default_status: unaffected
Credits: lang: en
value: Bereket Miheret
lang: en
value: WPScan
Published: 2024-08-26T06:00:01.427Z
CVE-2024-6880 CSRF in MegaBIP
During MegaBIP installation process, a user is encouraged to change a default path to administrative portal, as keeping it secret is listed by the author as one of the protection mechanisms. 
Publicly available source code of "/registered.php" discloses that path, allowing an attacker to attempt further attacks.  

This issue affects MegaBIP software versions below 5.15
Problem types: cwe_id: CWE-538
description: CWE-538 Insertion of Sensitive Information into Externally-Accessible File or Directory
Affected products: vendor: Jan Syski
product: MegaBIP
default_status: unaffected
Published: 2025-01-10T17:51:32.583Z
CVE-2024-6881 Stored XSS Vulnerability
Stored XSS in M-Files Hubshare versions before 5.0.6.0 allows an authenticated attacker to execute arbitrary JavaScript in user's browser session
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Affected products: vendor: M-Files Corporation
product: Hubshare
default_status: unaffected
Credits: lang: en
value: Markus Tirrenberg / WithSecure
lang: en
value: Emma Kantanen / WithSecure
Published: 2024-07-29T12:56:51.695Z
CVE-2024-6883 Event Espresso 4 Decaf – Event Registration Event Ticketing <= 4.10.46.decaf- Authenticated (Subscriber+) Missing Authorization to Limited Plugin Settings Modification
The Event Espresso 4 Decaf – Event Registration Event Ticketing plugin for WordPress is vulnerable to limited unauthorized plugin settings modification due to a missing capability check on the saveTimezoneString and some other functions in all versions up to and including 4.10.46.decaf. This makes it possible for authenticated attackers, with Subscriber-level access and above, to modify some of the plugin settings.
Problem types: cwe_id: CWE-862
description: CWE-862 Missing Authorization
Affected products: vendor: eventespresso
product: Event Espresso – Event Registration & Ticketing Sales
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
baseScore: 4.3
baseSeverity: MEDIUM
Credits: lang: en
value: Lucio Sá
Published: 2024-08-21T05:30:21.157Z
CVE-2024-6884 Gutenberg Blocks with AI by Kadence WP < 3.2.39 - Contributor+ Stored XSS
The Gutenberg Blocks with AI by Kadence WP  WordPress plugin before 3.2.39 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
Problem types: description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: Gutenberg Blocks with AI by Kadence WP
default_status: unaffected
Credits: lang: en
value: Dmitrii Ignatyev
lang: en
value: WPScan
Published: 2024-08-08T06:00:04.409Z
CVE-2024-6885 MaxiBlocks: 2200+ Patterns, 190 Pages, 14.2K Icons & 100 Styles <= 1.9.2 - Authenticated (Subscriber+) Arbitrary File Deletion
The MaxiBlocks: 2200+ Patterns, 190 Pages, 14.2K Icons & 100 Styles plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the maxi_remove_custom_image_size and maxi_add_custom_image_size functions in all versions up to, and including, 1.9.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).
Problem types: cwe_id: CWE-22
description: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products: vendor: ckp267
product: MaxiBlocks Builder | 17,000+ Design Assets, Patterns, Icons & Starter Sites
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
baseScore: 8.1
baseSeverity: HIGH
Credits: lang: en
value: Lucio Sá
Published: 2024-07-23T02:01:41.694Z
CVE-2024-6886 Inproper Sanitation of field leading to stored XSS
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Gitea Gitea Open Source Git Server allows Stored XSS.This issue affects Gitea Open Source Git Server: 1.22.0.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Affected products: vendor: Gitea
product: Gitea Open Source Git Server
default_status: unaffected
Credits: lang: en
value: Catalin Iovita (https://github.com/catalin-iovita)
lang: en
value: Alexandru Postolache (https://github.com/alex-postolache)
Published: 2024-08-06T03:23:21.692Z
CVE-2024-6887 Giveaways and Contests by RafflePress < 1.12.16 - Editor+ Stored XSS
The Giveaways and Contests by RafflePress  WordPress plugin before 1.12.16 does not sanitise and escape some of its Giveaways settings, which could allow high privilege users such as editor and above to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Problem types: description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: Giveaways and Contests by RafflePress
default_status: unaffected
Credits: lang: en
value: Dmitrii Ignatyev
lang: en
value: WPScan
Published: 2024-09-12T06:00:04.189Z
CVE-2024-6888 Secure Copy Content Protection and Content Locking < 4.1.7 - Admin+ Stored XSS
The Secure Copy Content Protection and Content Locking WordPress plugin before 4.1.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Problem types: description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: Secure Copy Content Protection and Content Locking
default_status: unaffected
Credits: lang: en
value: bob.matyas@automattic.com
lang: en
value: WPScan
Published: 2024-09-04T06:00:03.859Z
CVE-2024-6889 Secure Copy Content Protection and Content Locking < 4.1.7 - Admin+ Stored XSS
The Secure Copy Content Protection and Content Locking WordPress plugin before 4.1.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Problem types: description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: Secure Copy Content Protection and Content Locking
default_status: unaffected
Credits: lang: en
value: Dmitrii Ignatyev
lang: en
value: WPScan
Published: 2024-09-04T06:00:04.054Z
CVE-2024-6890 Journyx Unauthenticated Password Reset Bruteforce
Password reset tokens are generated using an insecure source of randomness. Attackers who know the username of the Journyx installation user can bruteforce the password reset and change the administrator password.
Problem types: cwe_id: CWE-321
description: CWE-321 Use of Hard-coded Cryptographic Key
cwe_id: CWE-334
description: CWE-334 Small Space of Random Values
cwe_id: CWE-799
description: CWE-799 Improper Control of Interaction Frequency
Affected products: vendor: Journyx
product: Journyx (jtime)
default_status: unaffected
Credits: lang: en
value: Jaggar Henry of KoreLogic, Inc.
Published: 2024-08-07T23:09:40.249Z
CVE-2024-6891 Journyx Authenticated Remote Code Execution
Attackers with a valid username and password can exploit a python code injection vulnerability during the natural login flow.
Problem types: cwe_id: CWE-94
description: CWE-94 Improper Control of Generation of Code ('Code Injection')
cwe_id: CWE-95
description: CWE-95 Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')
Affected products: vendor: Journyx
product: Journyx (jtime)
default_status: unaffected
Credits: lang: en
value: Jaggar Henry of KoreLogic, Inc.
Published: 2024-08-07T23:13:56.924Z
CVE-2024-6892 Journyx Reflected Cross Site Scripting
Attackers can craft a malicious link that once clicked will execute arbitrary JavaScript in the context of the Journyx web application.
Problem types: cwe_id: CWE-81
description: CWE-81 Improper Neutralization of Script in an Error Message Web Page
Affected products: vendor: Journyx
product: Journyx (jtime)
default_status: unaffected
Credits: lang: en
value: Jaggar Henry of KoreLogic, Inc.
Published: 2024-08-07T23:19:00.527Z
CVE-2024-6893 Journyx Unauthenticated XML External Entities Injection
The "soap_cgi.pyc" API handler allows the XML body of SOAP requests to contain references to external entities. This allows an unauthenticated attacker to read local files, perform server-side request forgery, and overwhelm the web server resources.
Problem types: cwe_id: CWE-611
description: CWE-611 Improper Restriction of XML External Entity Reference
Affected products: vendor: Journyx
product: Journyx (jtime)
default_status: unaffected
Credits: lang: en
value: Jaggar Henry of KoreLogic, Inc.
Published: 2024-08-07T23:22:08.667Z