rainbutterfly/cve_corpus huggingface dataset:
CVE-2024-44739 
Sourcecodester Simple Forum Website v1.0 has a SQL injection vulnerability in /php-sqlite-forum/?page=manage_user&id=.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-09-06T00:00:00.000Z
CVE-2024-44744 
An issue in Malwarebytes Premium Security v5.0.0.883 allows attackers to execute arbitrary code via placing crafted binaries into unspecified directories. NOTE: Malwarebytes argues that this issue requires admin privileges and that the contents cannot be altered by non-admin users.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-10-01T00:00:00.000Z
CVE-2024-44754 
Cryptographic key extraction from internal flash in Minut M2 with firmware version #15142 allows physically proximate attackers to inject modified firmware into any other Minut M2 product via USB.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-02-28T00:00:00.000Z
CVE-2024-44756 
NUS-M9 ERP Management Software v3.0.0 was discovered to contain a SQL injection vulnerability via the usercode parameter at /UserWH/checkLogin.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-11-18T00:00:00.000Z
CVE-2024-44757 
An arbitrary file download vulnerability in the component /Basics/DownloadInpFile of NUS-M9 ERP Management Software v3.0.0 allows attackers to download arbitrary files and access sensitive information via a crafted interface request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-11-18T00:00:00.000Z
CVE-2024-44758 
An arbitrary file upload vulnerability in the component /Production/UploadFile of NUS-M9 ERP Management Software v3.0.0 allows attackers to execute arbitrary code via uploading crafted files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-11-15T00:00:00.000Z
CVE-2024-44759 
An arbitrary file download vulnerability in the component /Doc/DownloadFile of NUS-M9 ERP Management Software v3.0.0 allows attackers to download arbitrary files and access sensitive information via a crafted interface request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-11-15T00:00:00.000Z
CVE-2024-44760 
Incorrect access control in the component /servlet/SnoopServlet of Shenzhou News Union Enterprise Management System v5.0 through v18.8 allows attackers to access sensitive information regarding the server.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-28T00:00:00.000Z
CVE-2024-44761 
An issue in EQ Enterprise Management System before v2.0.0 allows attackers to execute a directory traversal via crafted requests.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-28T00:00:00.000Z
CVE-2024-44762 
A discrepancy in error messages for invalid login attempts in Webmin Usermin v2.100 allows attackers to enumerate valid user accounts.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-10-16T00:00:00.000Z
CVE-2024-44765 
An Improper Authorization (Access Control Misconfiguration) vulnerability in MGT-COMMERCE GmbH CloudPanel v2.0.0 to v2.4.2 allows low-privilege users to bypass access controls and gain unauthorized access to sensitive configuration files and administrative functionality.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-11-08T00:00:00.000Z
CVE-2024-44771 
BigId PrivacyPortal v179 is vulnerable to Cross Site Scripting (XSS) via the "Label" field in the Report template function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-01-13T00:00:00.000Z
CVE-2024-44775 
kmqtt v0.2.7 is vulnerable to Denial of Service (DoS) due to a Null Pointer Exception. A remote attacker can cause the broker to crash by sending a specially crafted MQTT CONNECT packet that triggers an unhandled null reference, leading to an immediate process termination.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-10-15T00:00:00.000Z
CVE-2024-44776 
An Open Redirect vulnerability in the page parameter of vTiger CRM v7.4.0 allows attackers to redirect users to a malicious site via a crafted URL.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-29T00:00:00.000Z
CVE-2024-44777 
A reflected cross-site scripting (XSS) vulnerability in the tag parameter in the index page of vTiger CRM 7.4.0 allows attackers to execute arbitrary code in the context of a user's browser via injecting a crafted payload.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-29T00:00:00.000Z
CVE-2024-44778 
A reflected cross-site scripting (XSS) vulnerability in the parent parameter in the index page of vTiger CRM 7.4.0 allows attackers to execute arbitrary code in the context of a user's browser via injecting a crafted payload.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-29T00:00:00.000Z
CVE-2024-44779 
A reflected cross-site scripting (XSS) vulnerability in the viewname parameter in the index page of vTiger CRM 7.4.0 allows attackers to execute arbitrary code in the context of a user's browser via injecting a crafted payload.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-29T00:00:00.000Z
CVE-2024-44786 
Incorrect access control in Meabilis CMS 1.0 allows attackers to access other users' address books via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-11-22T00:00:00.000Z
CVE-2024-44793 
A cross-site scripting (XSS) vulnerability in the component /managers/multiple_freeleech.php of Gazelle commit 63b3370 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the torrents parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-26T00:00:00.000Z
CVE-2024-44794 
A cross-site scripting (XSS) vulnerability in the component /master/auth/OnedriveRedirect.php of PicUploader commit fcf82ea allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the error_description parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-26T00:00:00.000Z
CVE-2024-44795 
A cross-site scripting (XSS) vulnerability in the component /login/disabled.php of Gazelle commit 63b3370 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the username parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-26T00:00:00.000Z
CVE-2024-44796 
A cross-site scripting (XSS) vulnerability in the component /auth/AzureRedirect.php of PicUploader commit fcf82ea allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the error_description parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-26T00:00:00.000Z
CVE-2024-44797 
A cross-site scripting (XSS) vulnerability in the component /managers/enable_requests.php of Gazelle commit 63b3370 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the view parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-26T00:00:00.000Z
CVE-2024-44798 
phpgurukul Bus Pass Management System 1.0 is vulnerable to Cross-site scripting (XSS) in /admin/pass-bwdates-reports-details.php via fromdate and todate parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-09-13T00:00:00.000Z
CVE-2024-44807 
A directory listing issue in the baserCMS plugin in D-ZERO CO., LTD. BurgerEditor and BurgerEditor Limited Edition before 2.25.1 allows remote attackers to obtain sensitive information by exposing a list of the uploaded files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-10-11T00:00:00.000Z
CVE-2024-44808 
An issue in Vypor Attack API System v.1.0 allows a remote attacker to execute arbitrary code via the user GET parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-09-04T00:00:00.000Z
CVE-2024-44809 
A remote code execution (RCE) vulnerability exists in the Pi Camera project, version 1.0, maintained by RECANTHA. The issue arises from improper sanitization of user input passed to the "position" GET parameter in the tilt.php script. An attacker can exploit this by sending crafted input data that includes malicious command sequences, allowing arbitrary commands to be executed on the server with the privileges of the web server user. This vulnerability is exploitable remotely and poses significant risk if the application is exposed to untrusted networks.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-09-03T00:00:00.000Z
CVE-2024-44812 
SQL Injection vulnerability in Online Complaint Site v.1.0 allows a remote attacker to escalate privileges via the username and password parameters in the /admin.index.php component.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-10-22T00:00:00.000Z
CVE-2024-44815 
Vulnerability in Hathway Skyworth Router CM5100 v.4.1.1.24 allows a physically proximate attacker to obtain user credentials via SPI flash Firmware W25Q64JV.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-09-10T00:00:00.000Z
CVE-2024-44817 
SQL Injection vulnerability in ZZCMS v.2023 and before allows a remote attacker to obtain sensitive information via the id parameter in the adv2.php component.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-09-04T00:00:00.000Z
CVE-2024-44818 
Cross Site Scripting vulnerability in ZZCMS v.2023 and before allows a remote attacker to obtain sensitive information via the HTTP_Referer header of the caina.php component.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-09-04T00:00:00.000Z
CVE-2024-44819 
Cross Site Scripting vulnerability in ZZCMS v.2023 and before allows a remote attacker to obtain sensitive information via a crafted script to the pagename parameter of the admin/del.php component.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-09-04T00:00:00.000Z
CVE-2024-44820 
A sensitive information disclosure vulnerability exists in ZZCMS v.2023 and before within the eginfo.php file located at /3/E_bak5.1/upload/. When accessed with the query parameter phome=ShowPHPInfo, the application executes the phpinfo() function, which exposes detailed information about the PHP environment, including server configuration, loaded modules, and environment variables.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-09-04T00:00:00.000Z
CVE-2024-44821 
ZZCMS 2023 contains a vulnerability in the captcha reuse logic located in /inc/function.php. The checkyzm function does not properly refresh the captcha value after a failed validation attempt. As a result, an attacker can exploit this flaw by repeatedly submitting the same incorrect captcha response, allowing them to capture the correct captcha value through error messages.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-09-04T00:00:00.000Z
CVE-2024-44825 
Directory Traversal vulnerability in Centro de Tecnologia da Informaco Renato Archer InVesalius3 v3.1.99995 allows attackers to write arbitrary files unto the system via a crafted .inv3 file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-09-25T00:00:00.000Z
CVE-2024-44837 
A cross-site scripting (XSS) vulnerability in the component \bean\Manager.java of Drug v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the user parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-09-06T00:00:00.000Z
CVE-2024-44838 
RapidCMS v1.3.1 was discovered to contain a SQL injection vulnerability via the username parameter at /resource/runlogin.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-09-06T00:00:00.000Z
CVE-2024-44839 
RapidCMS v1.3.1 was discovered to contain a SQL injection vulnerability via the articleid parameter at /default/article.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-09-06T00:00:00.000Z
CVE-2024-44843 
An issue in the web socket handshake process of SteVe v3.7.1 allows attackers to bypass authentication and execute arbitrary coammands via supplying crafted OCPP requests.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-04-15T00:00:00.000Z
CVE-2024-44844 
DrayTek Vigor3900 v1.5.1.6 was discovered to contain an authenticated command injection vulnerability via the name parameter in the run_command function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-09-06T00:00:00.000Z
CVE-2024-44845 
DrayTek Vigor3900 v1.5.1.6 was discovered to contain an authenticated command injection vulnerability via the value parameter in the filter_string function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-09-06T00:00:00.000Z
CVE-2024-44849 
Qualitor up to 8.24 is vulnerable to Remote Code Execution (RCE) via Arbitrary File Upload in checkAcesso.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-09-09T00:00:00.000Z
CVE-2024-44851 
A stored cross-site scripting (XSS) vulnerability in the Discussion section of Perfex CRM v1.1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Content parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-09-11T00:00:00.000Z
CVE-2024-44852 
Open Robotics Robotic Operating System 2 ROS2 navigation2 v.humble was discovered to contain a segmentation violation via the component theta_star::ThetaStar::isUnsafeToPlan().
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-12-06T00:00:00.000Z
CVE-2024-44853 
Open Robotics Robotic Operating System 2 ROS2 navigation2 v.humble was discovered to contain a NULL pointer dereference via the component computeControl().
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-12-06T00:00:00.000Z
CVE-2024-44854 
Open Robotics Robotic Operating System 2 ROS2 navigation2 v.humble was discovered to contain a NULL pointer dereference via the component smoothPlan().
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-12-06T00:00:00.000Z
CVE-2024-44855 
Open Robotics Robotic Operating System 2 ROS2 navigation2 v.humble was discovered to contain a NULL pointer dereference via the component nav2_navfn_planner().
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-12-06T00:00:00.000Z
CVE-2024-44856 
Open Robotics Robotic Operating System 2 ROS2 navigation2 v.humble was discovered to contain a NULL pointer dereference via the component nav2_smac_planner().
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-12-06T00:00:00.000Z
CVE-2024-44859 
Tenda FH1201 v1.2.0.14 has a stack buffer overflow vulnerability in `formWrlExtraGet`.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-09-04T00:00:00.000Z
CVE-2024-44860 
An information disclosure vulnerability in the /Letter/PrintQr/ endpoint of Solvait v24.4.2 allows attackers to access sensitive data via a crafted request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-09-26T00:00:00.000Z
CVE-2024-44866 
A buffer overflow in the GuitarPro1::read function of MuseScore Studio v4.3.2 allows attackers to to execute arbitrary code or cause a Denial of Service (DoS) via opening a crafted GuitarPro file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-03-17T00:00:00.000Z
CVE-2024-44867 
phpok v3.0 was discovered to contain an arbitrary file read vulnerability via the component /autoload/file.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-09-10T00:00:00.000Z
CVE-2024-44871 
An arbitrary file upload vulnerability in the component /admin/index.php of moziloCMS v3.0 allows attackers to execute arbitrary code via uploading a crafted file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-09-10T00:00:00.000Z
CVE-2024-44872 
A reflected cross-site scripting (XSS) vulnerability in moziloCMS v3.0 allows attackers to execute arbitrary code in the context of a user's browser via injecting a crafted payload.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-09-10T00:00:00.000Z
CVE-2024-44893 
An issue in the component /jeecg-boot/jmreport/dict/list of JimuReport v1.7.8 allows attacker to escalate privileges via a crafted GET request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-09-10T00:00:00.000Z
CVE-2024-44902 
A deserialization vulnerability in Thinkphp v6.1.3 to v8.0.4 allows attackers to execute arbitrary code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-09-09T00:00:00.000Z
CVE-2024-44903 
SQL Injection can occur in the SirsiDynix Horizon Information Portal (IPAC20) through 3.25_9382; however, a patch is available from the vendor. This is in ipac.jsp in a SELECT WHERE statement, in a part of the uri= variable in the second part of the full= inner variable.
Problem types: cwe_id: CWE-89
description: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: SirsiDynix
product: IPAC20
default_status: unknown
CVSS v3.1: version: 3.1
baseScore: 7.5
baseSeverity: HIGH
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Published: 2025-03-25T00:00:00.000Z
CVE-2024-44905 
go-pg pg v10.13.0 was discovered to contain a SQL injection vulnerability via the component /types/append_value.go.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-06-12T00:00:00.000Z
CVE-2024-44906 
uptrace pgdriver v1.2.1 was discovered to contain a SQL injection vulnerability via the appendArg function in /pgdriver/format.go. The maintainer has stated that the issue is fixed in v1.2.15.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-06-12T00:00:00.000Z
CVE-2024-44910 
NASA CryptoLib v1.3.0 was discovered to contain an Out-of-Bounds read via the AOS subsystem (crypto_aos.c).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-09-27T00:00:00.000Z
CVE-2024-44911 
NASA CryptoLib v1.3.0 was discovered to contain an Out-of-Bounds read via the TC subsystem (crypto_tc.c).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-09-27T00:00:00.000Z
CVE-2024-44912 
NASA CryptoLib v1.3.0 was discovered to contain an Out-of-Bounds read via the TM subsystem (crypto_tm.c).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-09-27T00:00:00.000Z
CVE-2024-44913 
An issue in the component EXR!ReadEXR+0x40ef1 of Irfanview v4.67.1.0 allows attackers to cause an access violation via a crafted EXR file. This vulnerability can lead to a Denial of Service (DoS).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-28T00:00:00.000Z
CVE-2024-44914 
An issue in the component EXR!ReadEXR+0x3df50 of Irfanview v4.67.1.0 allows attackers to cause an access violation via a crafted EXR file. This vulnerability can lead to a Denial of Service (DoS).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-28T00:00:00.000Z
CVE-2024-44915 
An issue in the component EXR!ReadEXR+0x4eef0 of Irfanview v4.67.1.0 allows attackers to cause an access violation via a crafted EXR file. This vulnerability can lead to a Denial of Service (DoS).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-28T00:00:00.000Z
CVE-2024-44916 
Vulnerability in admin_ip.php in Seacms v13.1, when action=set, allows attackers to control IP parameters that are written to the data/admin/ip.php file and could result in arbitrary command execution.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-30T00:00:00.000Z
CVE-2024-44918 
A cross-site scripting (XSS) vulnerability in the component admin_datarelate.php of SeaCMS v12.9 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-30T00:00:00.000Z
CVE-2024-44919 
A cross-site scripting (XSS) vulnerability in the component admin_ads.php of SeaCMS v12.9 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the ad description parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-29T00:00:00.000Z
CVE-2024-44920 
A cross-site scripting (XSS) vulnerability in the component admin_collect_news.php of SeaCMS v12.9 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the siteurl parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-09-03T00:00:00.000Z
CVE-2024-44921 
SeaCMS v12.9 was discovered to contain a SQL injection vulnerability via the id parameter at /dmplayer/dmku/index.php?ac=del.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-09-03T00:00:00.000Z
CVE-2024-44930 
Serilog before v2.1.0 was discovered to contain a Client IP Spoofing vulnerability, which allows attackers to falsify their IP addresses by specifying an arbitrary IP as a value of X-Forwarded-For or Client-Ip headers while performing HTTP requests.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-29T00:00:00.000Z
CVE-2024-44931 gpio: prevent potential speculation leaks in gpio_device_get_desc()
In the Linux kernel, the following vulnerability has been resolved:

gpio: prevent potential speculation leaks in gpio_device_get_desc()

Userspace may trigger a speculative read of an address outside the gpio
descriptor array.
Users can do that by calling gpio_ioctl() with an offset out of range.
Offset is copied from user and then used as an array index to get
the gpio descriptor without sanitization in gpio_device_get_desc().

This change ensures that the offset is sanitized by using
array_index_nospec() to mitigate any possibility of speculative
information leaks.

This bug was discovered and resolved using Coverity Static Analysis
Security Testing (SAST) by Synopsys, Inc.
Affected products: vendor: Linux
product: Linux
default_status: unaffected
vendor: Linux
product: Linux
default_status: affected
Published: 2024-08-26T10:11:21.425Z